@platless/axom-cli 0.1.0 → 0.3.13

package/dist/workstation/qoderAdapter/usage.js

@@ -0,0 +1,37 @@
+export const QODER_CREDITS_LABEL = 'Qoder Credits（厂商报告）';
+const validCredits = (value) => typeof value === 'number' &&
+    Number.isFinite(value) && value >= 0;
+/** Qoder's report is cumulative. A missing/invalid report never erases a prior valid value. */
+export function applyCredits(previous, reported) {
+    if (validCredits(reported))
+        return reported;
+    return validCredits(previous) ? previous : undefined;
+}
+function reportedCredits(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return undefined;
+    const input = value;
+    for (const key of ['total_credits', 'totalCredits', 'credits'])
+        if (validCredits(input[key]))
+            return input[key];
+    return undefined;
+}
+/**
+ * Keeps vendor credits separate from ACP token/USD counters. Qoder's SDK does not
+ * provide equivalent token or USD values, so zero placeholders are intentionally omitted.
+ */
+export function normalizeQoderUsage(value, previousCredits) {
+    const input = value && typeof value === 'object' && !Array.isArray(value)
+        ? value : {};
+    const scope = input.cumulativeScope === 'unknown' ? 'unknown' : 'session';
+    const reported = reportedCredits(value);
+    if (scope === 'unknown') {
+        return { credits: undefined, creditsLabel: QODER_CREDITS_LABEL, creditsScope: scope,
+            inputTokens: undefined, outputTokens: undefined, costUsd: undefined,
+            ...(validCredits(previousCredits) ? { previousCredits } : {}) };
+    }
+    const credits = applyCredits(previousCredits, reported);
+    return { credits, creditsLabel: QODER_CREDITS_LABEL, creditsScope: scope,
+        inputTokens: undefined, outputTokens: undefined, costUsd: undefined,
+        ...(validCredits(previousCredits) ? { previousCredits } : {}) };
+}

package/dist/workstation/register.js

@@ -32,6 +32,10 @@ export async function registerWorkstation(server, clientName, token, ws) {
                 + `when the same machine re-registers after an axom-cli upgrade. Delete it under Settings → `
                 + 'Workstations, then run `axom workstation start` again.');
         }
+        if (res.status === 403) {
+            throw new UsageError('This credential is not authorized to register a workstation. '
+                + 'Run `axom auth` and select workstation, then try again.');
+        }
         throw new Error(`Registration failed: ${res.status} ${await res.text()}`);
     }
     const data = (await res.json());

package/dist/workstation/tools/browser.js

@@ -0,0 +1,394 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { integer, keys, string, validateRequest, TOOL_RESULT_BYTES, } from "./validation.js";
+const TIMEOUT = 4500;
+async function bounded(promise, timeout = TIMEOUT) {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(Error("Browser operation timed out; mutation outcome may be unknown")), Math.max(1, timeout));
+            }),
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** All ancestors are checked: mkdir recursive must never follow a planted profile symlink. */
+async function ownedDirectory(dir, privateMode = false) {
+    const absolute = path.resolve(dir);
+    const parts = absolute.split(path.sep).filter(Boolean);
+    let current = path.parse(absolute).root;
+    const uid = process.getuid?.();
+    let protectedByOwner = false;
+    for (const part of parts) {
+        current = path.join(current, part);
+        await fs.mkdir(current, { mode: 0o700 }).catch((e) => {
+            if (e.code !== "EEXIST")
+                throw e;
+        });
+        const stat = await fs.lstat(current);
+        if (!stat.isDirectory() ||
+            stat.isSymbolicLink() ||
+            (!protectedByOwner &&
+                (stat.mode & 0o022) !== 0 &&
+                !(stat.mode & 0o1000)) ||
+            (protectedByOwner && uid !== undefined && stat.uid !== uid))
+            throw Error("Unsafe browser directory");
+        // An owned 0700 ancestor blocks other UIDs from reaching owned descendants,
+        // even if an existing config directory below that fence has group-write bits.
+        // Symlink and ownership checks still apply at every level.
+        if (uid !== undefined && stat.uid === uid && (stat.mode & 0o077) === 0)
+            protectedByOwner = true;
+    }
+    const stat = await fs.lstat(absolute);
+    if (process.getuid && stat.uid !== process.getuid())
+        throw Error("Browser directory is not owned by this user");
+    if (privateMode)
+        await fs.chmod(absolute, 0o700);
+}
+function allowedUrl(params) {
+    const url = string(params, "url", 8192, "about:blank");
+    if (url === "about:blank")
+        return url;
+    try {
+        const parsed = new URL(url);
+        if (["http:", "https:"].includes(parsed.protocol))
+            return parsed.href;
+    }
+    catch { }
+    throw Error("Invalid browser URL: use http(s) or about:blank");
+}
+function browserKey(params) {
+    const key = string(params, "key", 64);
+    if (!/^(?:(?:Control|Alt|Shift|Meta)\+)*(?:Enter|Backspace|Tab|Escape|ArrowUp|ArrowDown|ArrowLeft|ArrowRight|Delete|Home|End|PageUp|PageDown|[a-zA-Z0-9])$/.test(key))
+        throw Error("Invalid browser key");
+    return key;
+}
+export class BrowserCore {
+    options;
+    chromium;
+    error;
+    sessions = new Map();
+    queue = Promise.resolve();
+    disposed = false;
+    constructor(options, chromium, error) {
+        this.options = options;
+        this.chromium = chromium;
+        this.error = error;
+    }
+    static async create(options) {
+        try {
+            const { chromium } = await import("playwright-core");
+            const executablePath = options.executablePath ?? chromium.executablePath();
+            await fs.access(executablePath);
+            await ownedDirectory(options.home);
+            await ownedDirectory(options.profileRoot, true);
+            await ownedDirectory(path.join(options.home, "Downloads"));
+            return new BrowserCore({ ...options, executablePath }, chromium);
+        }
+        catch (error) {
+            return new BrowserCore(options, undefined, `Browser unavailable: ${error instanceof Error ? error.message : "missing optional browser dependency"}`);
+        }
+    }
+    dispatch(method, params = {}) {
+        const task = this.queue.then(async () => {
+            if (this.disposed)
+                throw Error("Browser supervisor stopped");
+            validateRequest(method, params);
+            const result = await this.execute(method, params);
+            if (Buffer.byteLength(JSON.stringify(result)) > TOOL_RESULT_BYTES - 1024)
+                throw Error("Browser frame exceeds reply limit");
+            return result;
+        });
+        this.queue = task.catch(() => { });
+        return task;
+    }
+    descriptor(s) {
+        return {
+            id: s.id,
+            name: s.name,
+            url: s.page.url(),
+            controllerId: s.controllerId,
+            exited: s.exited,
+        };
+    }
+    async navigate(s, url, deadline = Date.now() + TIMEOUT) {
+        try {
+            await s.page.goto(url, {
+                waitUntil: "domcontentloaded",
+                timeout: Math.max(1, Math.min(TIMEOUT, deadline - Date.now())),
+            });
+        }
+        catch (error) {
+            if (String(error).includes("Download is starting"))
+                return;
+            await s.page
+                .goto("about:blank", { waitUntil: "commit", timeout: 500 })
+                .catch(() => { });
+            throw error;
+        }
+    }
+    watch(s, page) {
+        page.on("dialog", (dialog) => {
+            s.notice = `${dialog.type()}: ${dialog.message().slice(0, 300)} (dismissed)`;
+            void dialog.dismiss().catch(() => { });
+        });
+        page.on("download", (download) => {
+            void this.download(s, download).catch((error) => {
+                s.notice = `Download failed: ${error.message}`;
+            });
+        });
+        page.on("close", () => {
+            if (s.page === page) {
+                const others = s.context.pages().filter((p) => !p.isClosed());
+                if (others.length) {
+                    s.page = others[others.length - 1];
+                    s.notice = "Active tab closed; switched to remaining tab";
+                }
+                else {
+                    s.exited = true;
+                    s.controllerId = null;
+                }
+            }
+        });
+        page.on("crash", () => {
+            if (s.page === page) {
+                s.exited = true;
+                s.notice = "Browser page crashed; close and create a new session";
+            }
+        });
+    }
+    async download(s, download) {
+        const downloads = path.join(this.options.home, "Downloads");
+        await ownedDirectory(downloads);
+        const before = await fs.lstat(downloads);
+        const staging = await fs.mkdtemp(path.join(downloads, ".axom-browser-"));
+        await fs.chmod(staging, 0o700);
+        const temporary = path.join(staging, "download");
+        const timer = setTimeout(() => {
+            void download.cancel().catch(() => { });
+        }, 30000);
+        try {
+            await download.saveAs(temporary);
+            const failure = await download.failure();
+            if (failure)
+                throw Error(failure);
+            await ownedDirectory(downloads);
+            const after = await fs.lstat(downloads);
+            if (before.ino !== after.ino || before.dev !== after.dev)
+                throw Error("Downloads directory changed");
+            let suggested = download
+                .suggestedFilename()
+                .replace(/[\\/\x00-\x1f\x7f]/g, "_")
+                .replace(/^\.+/, "")
+                .slice(0, 160) || "download";
+            while (Buffer.byteLength(suggested) > 180)
+                suggested = [...suggested].slice(0, -1).join("");
+            const ext = path.extname(suggested), stem = suggested.slice(0, suggested.length - ext.length);
+            for (let n = 0; n < 100; n++) {
+                const name = n ? `${stem} (${n})${ext}` : suggested;
+                try {
+                    await fs.link(temporary, path.join(downloads, name));
+                    s.notice = `Downloaded: ${name}`;
+                    return;
+                }
+                catch (error) {
+                    if (error.code !== "EEXIST")
+                        throw error;
+                }
+            }
+            throw Error("Download filename collision limit reached");
+        }
+        finally {
+            clearTimeout(timer);
+            await fs.rm(staging, { recursive: true, force: true });
+        }
+    }
+    async execute(method, params) {
+        const deadline = Date.now() + 6000;
+        if (method === "tools.info") {
+            keys(params, []);
+            return {
+                browser: !!this.chromium,
+                ...(this.error ? { browserError: this.error } : {}),
+            };
+        }
+        if (!method.startsWith("browser."))
+            throw Error("Unsupported browser tool");
+        if (!this.chromium)
+            throw Error(this.error);
+        if (method === "browser.list") {
+            keys(params, []);
+            return {
+                sessions: [...this.sessions.values()].map((s) => this.descriptor(s)),
+            };
+        }
+        const id = string(params, "id", 128), clientId = string(params, "clientId", 128);
+        if (method === "browser.create") {
+            keys(params, ["id", "clientId", "url", "width", "height"]);
+            const url = allowedUrl(params), width = integer(params, "width", 320, 1600, 1024), height = integer(params, "height", 240, 1200, 768);
+            const existing = this.sessions.get(id);
+            if (existing)
+                return this.descriptor(existing);
+            if (this.sessions.size >= 2)
+                throw Error("Maximum browser session limit reached (2)");
+            await ownedDirectory(this.options.profileRoot, true);
+            const profile = path.join(this.options.profileRoot, createHash("sha256").update(id).digest("hex"));
+            await ownedDirectory(profile, true);
+            const context = await this.chromium.launchPersistentContext(profile, {
+                executablePath: this.options.executablePath,
+                headless: true,
+                acceptDownloads: true,
+                viewport: { width, height },
+                timeout: TIMEOUT,
+                ...(this.options.proxy
+                    ? { proxy: { server: this.options.proxy } }
+                    : {}),
+                args: process.platform === "linux" ? ["--no-sandbox"] : [],
+            });
+            context.setDefaultTimeout(TIMEOUT);
+            context.setDefaultNavigationTimeout(TIMEOUT);
+            const page = context.pages()[0] ?? (await context.newPage());
+            const s = {
+                id,
+                name: "Browser",
+                context,
+                page,
+                controllerId: clientId,
+                width,
+                height,
+                notice: "",
+                exited: false,
+            };
+            this.watch(s, page);
+            context.on("page", (newPage) => {
+                this.watch(s, newPage);
+                s.page = newPage;
+                s.exited = false;
+                s.notice = "Switched to new tab";
+                if (context.pages().length > 8)
+                    void context
+                        .pages()[0]
+                        .close()
+                        .catch(() => { });
+            });
+            context.on("close", () => {
+                s.exited = true;
+                s.controllerId = null;
+            });
+            this.sessions.set(id, s);
+            try {
+                await this.navigate(s, url, deadline);
+            }
+            catch (error) {
+                this.sessions.delete(id);
+                await context.close();
+                throw error;
+            }
+            return this.descriptor(s);
+        }
+        const s = this.sessions.get(id);
+        if (!s)
+            throw Error("Browser session not found");
+        if ([
+            "browser.attach",
+            "browser.takeover",
+            "browser.detach",
+            "browser.close",
+            "browser.frame",
+        ].includes(method))
+            keys(params, ["id", "clientId"]);
+        if (method === "browser.attach") {
+            if (!s.controllerId)
+                s.controllerId = clientId;
+            return {
+                session: this.descriptor(s),
+                control: s.controllerId === clientId,
+            };
+        }
+        if (method === "browser.takeover") {
+            s.controllerId = clientId;
+            return { ok: true };
+        }
+        if (method === "browser.detach") {
+            if (s.controllerId === clientId)
+                s.controllerId = null;
+            return { ok: true };
+        }
+        if (method === "browser.frame") {
+            const base = {
+                mime: "image/jpeg",
+                width: s.width,
+                height: s.height,
+                url: s.page.url(),
+                title: "",
+                control: s.controllerId === clientId,
+                exited: s.exited,
+                notice: s.notice,
+            };
+            if (s.exited)
+                return { ...base, data: "" };
+            const jpeg = await s.page.screenshot({
+                type: "jpeg",
+                quality: 70,
+                timeout: TIMEOUT,
+                animations: "disabled",
+            });
+            return {
+                ...base,
+                title: (await bounded(s.page.title(), 1000)).slice(0, 512),
+                data: jpeg.toString("base64"),
+            };
+        }
+        if (s.controllerId !== clientId)
+            throw Error("Browser is read-only; take control first");
+        if (method === "browser.close") {
+            await s.context.close();
+            this.sessions.delete(id);
+            return { ok: true };
+        }
+        if (s.exited)
+            throw Error("Browser exited");
+        if (method === "browser.navigate") {
+            keys(params, ["id", "clientId", "url"]);
+            await this.navigate(s, allowedUrl(params), deadline);
+            return { ok: true };
+        }
+        if (method === "browser.input") {
+            keys(params, [
+                "id",
+                "clientId",
+                "kind",
+                "x",
+                "y",
+                "deltaX",
+                "deltaY",
+                "key",
+                "text",
+            ]);
+            const kind = string(params, "kind", 16);
+            if (kind === "click")
+                await bounded(s.page.mouse.click(integer(params, "x", 0, s.width - 1), integer(params, "y", 0, s.height - 1)));
+            else if (kind === "scroll")
+                await bounded(s.page.mouse.wheel(integer(params, "deltaX", -4000, 4000, 0), integer(params, "deltaY", -4000, 4000, 0)));
+            else if (kind === "key")
+                await bounded(s.page.keyboard.press(browserKey(params)));
+            else if (kind === "text")
+                await bounded(s.page.keyboard.insertText(string(params, "text", 64 * 1024)));
+            else
+                throw Error("Invalid browser input kind");
+            return { ok: true };
+        }
+        throw Error("Unsupported browser tool");
+    }
+    async dispose() {
+        this.disposed = true;
+        await this.queue;
+        await Promise.all([...this.sessions.values()].map((s) => s.context.close().catch(() => { })));
+        this.sessions.clear();
+    }
+}