@quecue/dev-notify 0.0.0-stage → 0.1.0-alpha.3

package/dist/reply-state.js

@@ -0,0 +1,189 @@
+import { readFile, mkdir, open, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes, createHash } from 'node:crypto';
+import { setTimeout as delay } from 'node:timers/promises';
+import { ConfigError, decodeUtf8, loadConfig, ready } from './config.js';
+import { replyHooksReady } from './claude-code.js';
+export const TTL = 24 * 60 * 60 * 1000;
+export const digest = (text) => createHash('sha256').update(text).digest('hex');
+export const botKey = (config) => digest(config.telegram.token);
+export const targetEpoch = (target) => digest(JSON.stringify([target.session, target.pid, target.birth, target.tty]));
+export const policyPath = (config) => config + '.reply.json';
+export const replyDirectory = (config) => config + '.reply-data';
+export async function readJson(file) {
+    try {
+        const bytes = await readFile(file);
+        if (bytes.length > 16 * 1024 * 1024)
+            throw new Error();
+        return JSON.parse(decodeUtf8(bytes));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new ConfigError('无法读取回复配置或状态；未覆盖、未启用远程输入');
+    }
+}
+export async function atomicJson(file, value) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = path.join(path.dirname(file), `.reply-${randomBytes(12).toString('hex')}.tmp`);
+    const handle = await open(temporary, 'wx', 0o600);
+    try {
+        try {
+            await handle.writeFile(JSON.stringify(value) + '\n', 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+    }
+    finally {
+        await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+            throw error; });
+    }
+}
+export async function locked(file, work) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    let handle;
+    for (let attempt = 0; attempt < 100; attempt++) {
+        try {
+            handle = await open(file, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw new ConfigError('无法获取回复状态写入锁');
+            if (attempt === 99)
+                throw new ConfigError('回复状态锁繁忙；确认进程已退出后才能处理残留锁');
+            await delay(40);
+        }
+    }
+    try {
+        return await work();
+    }
+    finally {
+        await handle?.close();
+        await unlink(file);
+    }
+}
+export async function accessReplies(file, env = process.env) {
+    const policy = await readJson(policyPath(file));
+    if (policy === null || policy.enabled === false)
+        return null;
+    if (policy.version !== 1 || policy.enabled !== true || typeof policy.bot !== 'string' || !/^[a-f0-9]{64}$/.test(policy.bot)
+        || typeof policy.generation !== 'string' || !/^[a-f0-9]{32}$/.test(policy.generation)
+        || !Array.isArray(policy.users) || !policy.users.length || policy.users.some((id) => typeof id !== 'string' || !/^[1-9][0-9]*$/.test(id))) {
+        throw new ConfigError('回复授权配置无效，拒绝远程输入');
+    }
+    if (!await replyHooksReady(file, { env }))
+        throw new ConfigError('回复所需 hooks 缺失、异步时序不安全或已禁用；请先重新运行 integration claude-code install 并在 /hooks 确认加载');
+    const config = await loadConfig(file, true, env);
+    if (!ready(config, 'telegram') || botKey(config) !== policy.bot)
+        throw new ConfigError('Telegram Bot 已变更或不可用，请重新运行 reply setup 授权');
+    const users = policy.users.filter((id) => config.telegram.chatIds.includes(id));
+    if (!users.length)
+        throw new ConfigError('回复授权用户不在当前 Telegram 接收名单中，拒绝远程输入');
+    const effective = { ...policy, users };
+    return { file, config, policy: effective, identity: digest(JSON.stringify([policy.bot, policy.generation, users, policy.permissions === true])) };
+}
+export async function stateTransaction(access, work) {
+    const directory = replyDirectory(access.file);
+    return locked(path.join(directory, 'state.lock'), async () => {
+        const policy = await readJson(policyPath(access.file));
+        if (!policy?.enabled || policy.bot !== access.policy.bot || policy.generation !== access.policy.generation
+            || (policy.permissions === true) !== (access.policy.permissions === true))
+            throw new ConfigError('回复授权已撤销或变化，拒绝写入旧状态');
+        let state = await readJson(path.join(directory, 'state.json'));
+        if (!state || state.identity !== access.identity)
+            state = { version: 1, identity: access.identity, offset: 0, sessions: {}, entries: {}, pending: {}, requests: {}, calls: {} };
+        const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+        state.requests ??= {};
+        state.calls ??= {};
+        if (state.version !== 1 || !Number.isSafeInteger(state.offset) || state.offset < 0
+            || ![state.sessions, state.entries, state.pending, state.requests, state.calls].every(record))
+            throw new ConfigError('回复状态结构无效，拒绝远程输入');
+        const now = Date.now();
+        for (const section of [state.sessions, state.entries, state.pending, state.requests, state.calls])
+            for (const [key, value] of Object.entries(section)) {
+                if (!record(value) || typeof value.updated !== 'number' || !Number.isFinite(value.updated)
+                    || value.updated > now + 60000 || now - value.updated > TTL)
+                    delete section[key];
+            }
+        for (const [key, value] of Object.entries(state.sessions)) {
+            if (value.session !== key || !Number.isSafeInteger(value.pid) || value.pid <= 0 || typeof value.birth !== 'string'
+                || typeof value.tty !== 'string' || typeof value.working !== 'boolean')
+                delete state.sessions[key];
+        }
+        for (const [key, value] of Object.entries(state.entries)) {
+            if (typeof value.session !== 'string' || typeof value.epoch !== 'string')
+                delete state.entries[key];
+        }
+        for (const [key, value] of Object.entries(state.pending)) {
+            if (typeof value.epoch !== 'string' || !/^[1-9][0-9]*$/.test(value.chat) || typeof value.id !== 'string'
+                || !['queued', 'submitted', 'unknown'].includes(value.phase))
+                delete state.pending[key];
+        }
+        for (const [key, value] of Object.entries(state.requests)) {
+            if (value.id !== key || !['question', 'permission'].includes(value.kind) || !record(value.input)
+                || !Array.isArray(value.questions) || !record(value.answers) || !Array.isArray(value.selected)
+                || !Number.isFinite(value.expires))
+                delete state.requests[key];
+        }
+        const result = await work(state);
+        await atomicJson(path.join(directory, 'state.json'), state);
+        return result;
+    });
+}
+export async function configureReplies(file, prompts, env = process.env) {
+    if (!await replyHooksReady(file, { env }))
+        throw new ConfigError('请先运行 integration claude-code install 安装绑定此通知配置的本版完整 hooks，再配置回复');
+    const config = await loadConfig(file, true, env);
+    if (!ready(config, 'telegram'))
+        throw new ConfigError('回复 Claude 需要先配置 Telegram Bot 和私聊接收人');
+    const available = config.telegram.chatIds.filter(id => /^[1-9][0-9]*$/.test(id));
+    if (!available.length)
+        throw new ConfigError('远程回复只允许 Telegram 私聊用户，不支持群聊');
+    const before = await readJson(policyPath(file));
+    prompts.out('远程回复等同向本机 Claude Code 终端输入并提交内容；不会自动批准工具权限，但可提交 Claude 命令。只授权可信用户。');
+    prompts.out('飞书按钮跳转 Telegram；不直接接收飞书消息。需要独占 Bot 的 getUpdates：不得与旧 Python 桥接或另一台机器共用同一个 Bot。');
+    prompts.out('Windows 使用系统 PowerShell / 控制台 API；macOS 使用 Ghostty 或 tmux，需要相应系统权限。不依赖 Python。');
+    prompts.out('支持范围不含 VS Code 集成终端、WSL、SSH；不确定目标或会话已切换时拒绝输入。');
+    prompts.out('通知接收人不会自动获得输入权限。当前可选择的私聊 chat_id：' + available.join('、'));
+    const text = await prompts.text('输入本次明确授权的私聊 chat_id（逗号分隔，留空取消）：');
+    if (!text.trim())
+        return false;
+    const users = [...new Set(text.split(',').map(id => id.trim()))];
+    if (users.some(id => !available.includes(id)))
+        throw new ConfigError('只能授权当前通知名单中的明确私聊用户');
+    prompts.out('将授权以下用户远程输入：' + users.join('、'));
+    prompts.out('结构化问题将展示真实选项并允许自定义回答；普通回复只在本轮结束后输入。问题/选项及可选的工具请求参数可能含敏感信息，将发送到授权私聊和已配置的飞书渠道。');
+    const permissions = /^(y|yes)$/i.test(await prompts.text('是否另外允许这些用户逐次点击批准/拒绝工具权限？不修改永久规则。[y/N] '));
+    if (!/^(y|yes)$/i.test(await prompts.text('确认启用远程回复并接受上述权限范围？[y/N] ')))
+        return false;
+    await locked(policyPath(file) + '.lock', async () => {
+        if (JSON.stringify(before) !== JSON.stringify(await readJson(policyPath(file))))
+            throw new ConfigError('回复授权已被其他进程修改，请重试');
+        const effective = await loadConfig(file, true, env);
+        if (botKey(effective) !== botKey(config) || users.some(id => !effective.telegram.chatIds.includes(id)))
+            throw new ConfigError('通知配置在授权期间已变化，请重试');
+        await atomicJson(policyPath(file), { version: 1, enabled: true, bot: botKey(config), users, permissions, generation: randomBytes(16).toString('hex') });
+    });
+    prompts.out('回复授权已保存；旧消息映射不继承。新回复需从启用后的任务完成通知进入。');
+    return true;
+}
+export async function disableReplies(file, prompts) {
+    const before = await readJson(policyPath(file));
+    if (!before?.enabled) {
+        prompts.out('远程回复未启用。');
+        return true;
+    }
+    if (!/^(y|yes)$/i.test(await prompts.text('确认禁用远程回复？通知和凭据保持不变。[y/N] ')))
+        return false;
+    await locked(policyPath(file) + '.lock', async () => {
+        if (JSON.stringify(before) !== JSON.stringify(await readJson(policyPath(file))))
+            throw new ConfigError('回复授权已变化，请重试');
+        await atomicJson(policyPath(file), { ...before, enabled: false });
+    });
+    prompts.out('远程回复已禁用；正在进行中的注入不能撤回，桥接下次检查授权时退出。');
+    return true;
+}

package/dist/reply-telegram.js

@@ -0,0 +1,19 @@
+import { requestJson } from './channels.js';
+import { ConfigError } from './config.js';
+export function telegramApi(token, request = requestJson) {
+    return async (method, payload) => {
+        if (!['sendMessage', 'editMessageReplyMarkup', 'answerCallbackQuery', 'getMe', 'getUpdates', 'getWebhookInfo'].includes(method))
+            throw new ConfigError('不支持的 Telegram 桥接方法');
+        const response = await request(`https://api.telegram.org/bot${token}/${method}`, payload);
+        if (response.ok !== true) {
+            if (response.error_code === 409)
+                throw new ConfigError('Telegram 轮询冲突；检查旧 Python 桥接、其他机器或 webhook，桥接不会抢占或删除 webhook');
+            throw new ConfigError('Telegram 桥接请求失败；不输出服务端正文或秘密');
+        }
+        return response.result;
+    };
+}
+export async function replyHint(api, chat, title, content, replyTo, markup) {
+    return api('sendMessage', { chat_id: chat, text: title + '\n\n' + content,
+        ...(replyTo ? { reply_parameters: { message_id: replyTo } } : {}), ...(markup ? { reply_markup: markup } : {}) });
+}

package/dist/setup.js

@@ -0,0 +1,250 @@
+import { readFile, mkdir, open, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { ConfigError, decodeUtf8, example, parseConfig } from './config.js';
+import { encodeBundle, nativeStore } from './credentials.js';
+import { terminalPrompts } from './prompts.js';
+const yes = (text) => /^(y|yes)$/i.test(text.trim());
+export async function snapshot(file) {
+    try {
+        return await readFile(file);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new ConfigError('无法读取现有配置，未修改');
+    }
+}
+function same(left, right) { return left === null ? right === null : right !== null && left.equals(right); }
+export function readRaw(raw) {
+    if (raw === null)
+        return structuredClone(example);
+    let data;
+    try {
+        data = JSON.parse(decodeUtf8(raw));
+    }
+    catch {
+        throw new ConfigError('现有配置损坏，未覆盖；请先修复 JSON');
+    }
+    parseConfig(data, {}, () => ({}));
+    return data;
+}
+async function removeFile(file) {
+    try {
+        await unlink(file);
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+}
+export async function commitConfig(file, data, expected, store, values, options = {}) {
+    const warn = options.warn ?? (text => console.error(text));
+    const target = structuredClone(data);
+    const old = target.credentials;
+    const id = randomBytes(16).toString('hex');
+    if (values !== null) {
+        encodeBundle(values);
+        target.credentials = { backend: 'keyring', id };
+        parseConfig(target, {}, () => values);
+    }
+    else {
+        delete target.credentials;
+        parseConfig(target, {});
+    }
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const lockPath = file + '.setup.lock';
+    let lock;
+    try {
+        lock = await open(lockPath, 'wx', 0o600);
+    }
+    catch {
+        throw new ConfigError('配置写入锁不可用；请检查权限，或确认没有运行中的向导后处理残留 .setup.lock');
+    }
+    const temporary = path.join(path.dirname(file), `.config-${id}.tmp`);
+    let created = false, committed = false, tempCreated = false;
+    try {
+        await lock.close();
+        if (!same(await snapshot(file), expected))
+            throw new ConfigError('配置在向导期间已变化，未覆盖，请重试');
+        if (values !== null) {
+            store.create(id, values);
+            created = true;
+            const check = store.read(id);
+            if (check === null || JSON.stringify(check) !== JSON.stringify(values))
+                throw new ConfigError('凭据写入校验失败，未切换配置');
+        }
+        const stream = await open(temporary, 'wx', 0o600);
+        tempCreated = true;
+        try {
+            await stream.writeFile(JSON.stringify(target, null, 2) + '\n', 'utf8');
+            await stream.sync();
+        }
+        finally {
+            await stream.close();
+        }
+        if (!same(await snapshot(file), expected))
+            throw new ConfigError('配置在保存期间已变化，未覆盖，请重试');
+        await (options.replace ?? rename)(temporary, file);
+        committed = true;
+    }
+    finally {
+        if (tempCreated) {
+            try {
+                await removeFile(temporary);
+            }
+            catch {
+                warn(`临时配置清理失败：${path.basename(temporary)}`);
+            }
+        }
+        if (created && !committed) {
+            try {
+                store.remove(id);
+            }
+            catch {
+                warn(`配置未切换，但新凭据清理失败；引用 ID：${id}`);
+            }
+        }
+        try {
+            await removeFile(lockPath);
+        }
+        catch {
+            warn('配置写入锁清理失败，请确认没有向导运行后处理 .setup.lock');
+        }
+    }
+    if (old?.backend === 'keyring') {
+        try {
+            store.remove(old.id);
+        }
+        catch {
+            warn(`配置已保存，但旧凭据清理失败；引用 ID：${old.id}`);
+        }
+    }
+    else if (old?.backend === 'system') {
+        warn('Python 原型旧凭据未删除；仍由原型管理，避免跨实现误删');
+    }
+}
+export async function wizard(file, options = {}) {
+    const prompts = options.prompts ?? terminalPrompts();
+    const before = await snapshot(file), data = readRaw(before);
+    const { out } = prompts;
+    out(`配置路径：${file}`);
+    out('密钥隐藏输入并存入 Windows Credential Manager / macOS Keychain；JSON 只保存引用。');
+    out('本步骤仅配置渠道；保存后可另行确认启用 Claude Code 通知，不启用远程控制。只有额外同意测试时才发送测试消息。');
+    if (before && !yes(await prompts.text('已有配置，继续编辑？[y/N] ')))
+        return false;
+    const selection = await prompts.text('选择渠道：1 Telegram，2 飞书，3 两者；其他输入取消：');
+    if (!['1', '2', '3'].includes(selection))
+        return false;
+    const store = options.store ?? nativeStore();
+    let previous = {};
+    const reference = data.credentials;
+    if (reference?.backend === 'keyring') {
+        try {
+            const existing = store.read(reference.id);
+            if (!existing)
+                throw new Error();
+            previous = existing;
+        }
+        catch {
+            out('原凭据无法读取，可能缺失、锁定或权限不足。');
+            if (!yes(await prompts.text('放弃旧值，重新输入所选渠道凭据？[y/N] ')))
+                return false;
+        }
+    }
+    else if (reference?.backend === 'system')
+        out('检测到 Python 原型凭据；本次重新输入保存，旧凭据不读取、不删除。');
+    data.telegram ??= {};
+    data.feishu ??= {};
+    data.telegram.enabled = selection !== '2';
+    data.feishu.enabled = selection !== '1';
+    const values = {};
+    const readValue = async (label, key, required) => {
+        while (true) {
+            const hint = previous[key] ? '留空保留已存值' : '不从环境变量自动复制';
+            const answer = await prompts.secret(`${label}（${hint}${required ? '' : '；输入 - 清除'}）：`);
+            const value = !required && answer === '-' ? '' : answer || previous[key] || '';
+            if (required && !value) {
+                out('此项不能为空，请重试，或 Ctrl+C 取消。');
+                continue;
+            }
+            try {
+                const check = { telegram: { enabled: key === 'telegram_token', chat_ids: ['1'] },
+                    feishu: { enabled: key !== 'telegram_token' }, credentials: { backend: 'keyring', id: '0'.repeat(32) } };
+                parseConfig(check, {}, () => ({ [key]: value }));
+                return value;
+            }
+            catch {
+                out('格式不正确，请检查后重新输入；不会显示秘密。');
+            }
+        }
+    };
+    if (data.telegram.enabled) {
+        values.telegram_token = await readValue('Telegram Bot Token', 'telegram_token', true);
+        out('接收人需要先启动 Bot；本轮手动填写数字 chat_id，不启动 getUpdates 或自动配对。');
+        while (true) {
+            const entered = await prompts.text('接收人 chat_id，多个用逗号分隔（留空保留原名单）：');
+            const ids = entered ? entered.split(',').map(item => item.trim()) : data.telegram.chat_ids ?? [];
+            try {
+                if (!ids.length)
+                    throw new Error();
+                const check = parseConfig({ telegram: { chat_ids: ids } }, {});
+                data.telegram.chat_ids = check.telegram.chatIds;
+                break;
+            }
+            catch {
+                out('请填写至少一个有效数字 chat_id，或 Ctrl+C 取消。');
+            }
+        }
+    }
+    if (data.feishu.enabled) {
+        values.feishu_webhook = await readValue('飞书 webhook', 'feishu_webhook', true);
+        values.feishu_secret = await readValue('飞书签名密钥（可选）', 'feishu_secret', false);
+    }
+    encodeBundle(values);
+    const preview = { ...data, credentials: { backend: 'keyring', id: '0'.repeat(32) } };
+    parseConfig(preview, {}, () => values);
+    const env = options.env ?? process.env;
+    out(`将启用：${data.telegram.enabled ? `Telegram（${data.telegram.chat_ids.length} 个接收人）` : ''}${data.feishu.enabled ? ' 飞书' : ''}`);
+    out('环境变量仍优先（含显式空值）；测试通知会使用最终生效的配置，不一定是刚输入的值。');
+    const overrides = [data.telegram.token_env ?? 'TELEGRAM_BOT_TOKEN', data.feishu.webhook_env ?? 'FEISHU_WEBHOOK',
+        data.feishu.secret_env ?? 'FEISHU_SECRET', 'TELEGRAM_CHAT_ID', 'TELEGRAM_CHAT_IDS'].filter(name => Object.hasOwn(env, name));
+    if (overrides.length)
+        out('当前存在环境覆盖：' + overrides.join('、'));
+    if (reference?.backend === 'keyring')
+        out('保存成功后删除旧凭据；共享旧引用 ID 的配置副本也需更新。');
+    out('未选中的渠道会禁用；新条目只保存所选渠道凭据。');
+    if (!yes(await prompts.text('确认保存配置和系统凭据？[y/N] ')))
+        return false;
+    await commitConfig(file, data, before, store, values, { warn: out });
+    out('配置和系统凭据已保存。');
+    if (options.testSend && yes(await prompts.text('发送固定内容的测试通知到生效的接收目标？[y/N] '))) {
+        try {
+            const effective = parseConfig(preview, env, () => values);
+            const ok = await options.testSend(effective);
+            out(ok ? '测试通知发送成功。' : '配置已保存，但测试通知失败或没有可用渠道；请运行 doctor 检查。');
+        }
+        catch {
+            out('配置已保存，但环境覆盖或网络导致测试失败；请运行 doctor 检查。');
+        }
+    }
+    else
+        out('未发送测试通知。');
+    return true;
+}
+export async function clearCredentials(file, prompts, store) {
+    const before = await snapshot(file), data = readRaw(before);
+    const reference = data.credentials;
+    if (!reference) {
+        prompts.out('此配置没有系统凭据引用，未修改。');
+        return true;
+    }
+    if (reference.backend !== 'keyring')
+        throw new ConfigError('这是 Python 原型的凭据，Node 不执行跨实现删除');
+    prompts.out('将移除当前配置的系统凭据引用并删除其条目；环境变量不变，共享引用的配置副本将失效。');
+    if (!yes(await prompts.text('确认清除？[y/N] ')))
+        return false;
+    await commitConfig(file, data, before, store ?? nativeStore(), null, { warn: prompts.out });
+    prompts.out('凭据引用已移除；如删除条目失败，上方会显示警告。');
+    return true;
+}

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "@quecue/dev-notify",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0-alpha.3",
+  "description": "跨平台开发任务通知工具，支持 Telegram 与飞书",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QueCue/dev-notify.git"
+  },
+  "homepage": "https://github.com/QueCue/dev-notify#readme",
+  "bugs": {
+    "url": "https://github.com/QueCue/dev-notify/issues"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "bin": {
+    "dev-notify": "dist/cli.js"
+  },
+  "files": [
+    "dist/*.js",
+    "README.md",
+    "SECURITY.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "npm run build && node --test test-js/*.test.mjs",
+    "start": "node dist/cli.js",
+    "prepack": "npm run build"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.0"
+  },
+  "dependencies": {
+    "@napi-rs/keyring": "2.1.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}