@quecue/dev-notify 0.1.0-alpha.1 → 0.1.0-alpha.3

package/dist/reply-state.js

@@ -0,0 +1,189 @@
+import { readFile, mkdir, open, rename, unlink } from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes, createHash } from 'node:crypto';
+import { setTimeout as delay } from 'node:timers/promises';
+import { ConfigError, decodeUtf8, loadConfig, ready } from './config.js';
+import { replyHooksReady } from './claude-code.js';
+export const TTL = 24 * 60 * 60 * 1000;
+export const digest = (text) => createHash('sha256').update(text).digest('hex');
+export const botKey = (config) => digest(config.telegram.token);
+export const targetEpoch = (target) => digest(JSON.stringify([target.session, target.pid, target.birth, target.tty]));
+export const policyPath = (config) => config + '.reply.json';
+export const replyDirectory = (config) => config + '.reply-data';
+export async function readJson(file) {
+    try {
+        const bytes = await readFile(file);
+        if (bytes.length > 16 * 1024 * 1024)
+            throw new Error();
+        return JSON.parse(decodeUtf8(bytes));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return null;
+        throw new ConfigError('无法读取回复配置或状态；未覆盖、未启用远程输入');
+    }
+}
+export async function atomicJson(file, value) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    const temporary = path.join(path.dirname(file), `.reply-${randomBytes(12).toString('hex')}.tmp`);
+    const handle = await open(temporary, 'wx', 0o600);
+    try {
+        try {
+            await handle.writeFile(JSON.stringify(value) + '\n', 'utf8');
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+    }
+    finally {
+        await unlink(temporary).catch(error => { if (error.code !== 'ENOENT')
+            throw error; });
+    }
+}
+export async function locked(file, work) {
+    await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
+    let handle;
+    for (let attempt = 0; attempt < 100; attempt++) {
+        try {
+            handle = await open(file, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw new ConfigError('无法获取回复状态写入锁');
+            if (attempt === 99)
+                throw new ConfigError('回复状态锁繁忙；确认进程已退出后才能处理残留锁');
+            await delay(40);
+        }
+    }
+    try {
+        return await work();
+    }
+    finally {
+        await handle?.close();
+        await unlink(file);
+    }
+}
+export async function accessReplies(file, env = process.env) {
+    const policy = await readJson(policyPath(file));
+    if (policy === null || policy.enabled === false)
+        return null;
+    if (policy.version !== 1 || policy.enabled !== true || typeof policy.bot !== 'string' || !/^[a-f0-9]{64}$/.test(policy.bot)
+        || typeof policy.generation !== 'string' || !/^[a-f0-9]{32}$/.test(policy.generation)
+        || !Array.isArray(policy.users) || !policy.users.length || policy.users.some((id) => typeof id !== 'string' || !/^[1-9][0-9]*$/.test(id))) {
+        throw new ConfigError('回复授权配置无效，拒绝远程输入');
+    }
+    if (!await replyHooksReady(file, { env }))
+        throw new ConfigError('回复所需 hooks 缺失、异步时序不安全或已禁用；请先重新运行 integration claude-code install 并在 /hooks 确认加载');
+    const config = await loadConfig(file, true, env);
+    if (!ready(config, 'telegram') || botKey(config) !== policy.bot)
+        throw new ConfigError('Telegram Bot 已变更或不可用，请重新运行 reply setup 授权');
+    const users = policy.users.filter((id) => config.telegram.chatIds.includes(id));
+    if (!users.length)
+        throw new ConfigError('回复授权用户不在当前 Telegram 接收名单中，拒绝远程输入');
+    const effective = { ...policy, users };
+    return { file, config, policy: effective, identity: digest(JSON.stringify([policy.bot, policy.generation, users, policy.permissions === true])) };
+}
+export async function stateTransaction(access, work) {
+    const directory = replyDirectory(access.file);
+    return locked(path.join(directory, 'state.lock'), async () => {
+        const policy = await readJson(policyPath(access.file));
+        if (!policy?.enabled || policy.bot !== access.policy.bot || policy.generation !== access.policy.generation
+            || (policy.permissions === true) !== (access.policy.permissions === true))
+            throw new ConfigError('回复授权已撤销或变化，拒绝写入旧状态');
+        let state = await readJson(path.join(directory, 'state.json'));
+        if (!state || state.identity !== access.identity)
+            state = { version: 1, identity: access.identity, offset: 0, sessions: {}, entries: {}, pending: {}, requests: {}, calls: {} };
+        const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+        state.requests ??= {};
+        state.calls ??= {};
+        if (state.version !== 1 || !Number.isSafeInteger(state.offset) || state.offset < 0
+            || ![state.sessions, state.entries, state.pending, state.requests, state.calls].every(record))
+            throw new ConfigError('回复状态结构无效，拒绝远程输入');
+        const now = Date.now();
+        for (const section of [state.sessions, state.entries, state.pending, state.requests, state.calls])
+            for (const [key, value] of Object.entries(section)) {
+                if (!record(value) || typeof value.updated !== 'number' || !Number.isFinite(value.updated)
+                    || value.updated > now + 60000 || now - value.updated > TTL)
+                    delete section[key];
+            }
+        for (const [key, value] of Object.entries(state.sessions)) {
+            if (value.session !== key || !Number.isSafeInteger(value.pid) || value.pid <= 0 || typeof value.birth !== 'string'
+                || typeof value.tty !== 'string' || typeof value.working !== 'boolean')
+                delete state.sessions[key];
+        }
+        for (const [key, value] of Object.entries(state.entries)) {
+            if (typeof value.session !== 'string' || typeof value.epoch !== 'string')
+                delete state.entries[key];
+        }
+        for (const [key, value] of Object.entries(state.pending)) {
+            if (typeof value.epoch !== 'string' || !/^[1-9][0-9]*$/.test(value.chat) || typeof value.id !== 'string'
+                || !['queued', 'submitted', 'unknown'].includes(value.phase))
+                delete state.pending[key];
+        }
+        for (const [key, value] of Object.entries(state.requests)) {
+            if (value.id !== key || !['question', 'permission'].includes(value.kind) || !record(value.input)
+                || !Array.isArray(value.questions) || !record(value.answers) || !Array.isArray(value.selected)
+                || !Number.isFinite(value.expires))
+                delete state.requests[key];
+        }
+        const result = await work(state);
+        await atomicJson(path.join(directory, 'state.json'), state);
+        return result;
+    });
+}
+export async function configureReplies(file, prompts, env = process.env) {
+    if (!await replyHooksReady(file, { env }))
+        throw new ConfigError('请先运行 integration claude-code install 安装绑定此通知配置的本版完整 hooks，再配置回复');
+    const config = await loadConfig(file, true, env);
+    if (!ready(config, 'telegram'))
+        throw new ConfigError('回复 Claude 需要先配置 Telegram Bot 和私聊接收人');
+    const available = config.telegram.chatIds.filter(id => /^[1-9][0-9]*$/.test(id));
+    if (!available.length)
+        throw new ConfigError('远程回复只允许 Telegram 私聊用户，不支持群聊');
+    const before = await readJson(policyPath(file));
+    prompts.out('远程回复等同向本机 Claude Code 终端输入并提交内容；不会自动批准工具权限，但可提交 Claude 命令。只授权可信用户。');
+    prompts.out('飞书按钮跳转 Telegram；不直接接收飞书消息。需要独占 Bot 的 getUpdates：不得与旧 Python 桥接或另一台机器共用同一个 Bot。');
+    prompts.out('Windows 使用系统 PowerShell / 控制台 API；macOS 使用 Ghostty 或 tmux，需要相应系统权限。不依赖 Python。');
+    prompts.out('支持范围不含 VS Code 集成终端、WSL、SSH；不确定目标或会话已切换时拒绝输入。');
+    prompts.out('通知接收人不会自动获得输入权限。当前可选择的私聊 chat_id：' + available.join('、'));
+    const text = await prompts.text('输入本次明确授权的私聊 chat_id（逗号分隔，留空取消）：');
+    if (!text.trim())
+        return false;
+    const users = [...new Set(text.split(',').map(id => id.trim()))];
+    if (users.some(id => !available.includes(id)))
+        throw new ConfigError('只能授权当前通知名单中的明确私聊用户');
+    prompts.out('将授权以下用户远程输入：' + users.join('、'));
+    prompts.out('结构化问题将展示真实选项并允许自定义回答；普通回复只在本轮结束后输入。问题/选项及可选的工具请求参数可能含敏感信息，将发送到授权私聊和已配置的飞书渠道。');
+    const permissions = /^(y|yes)$/i.test(await prompts.text('是否另外允许这些用户逐次点击批准/拒绝工具权限？不修改永久规则。[y/N] '));
+    if (!/^(y|yes)$/i.test(await prompts.text('确认启用远程回复并接受上述权限范围？[y/N] ')))
+        return false;
+    await locked(policyPath(file) + '.lock', async () => {
+        if (JSON.stringify(before) !== JSON.stringify(await readJson(policyPath(file))))
+            throw new ConfigError('回复授权已被其他进程修改，请重试');
+        const effective = await loadConfig(file, true, env);
+        if (botKey(effective) !== botKey(config) || users.some(id => !effective.telegram.chatIds.includes(id)))
+            throw new ConfigError('通知配置在授权期间已变化，请重试');
+        await atomicJson(policyPath(file), { version: 1, enabled: true, bot: botKey(config), users, permissions, generation: randomBytes(16).toString('hex') });
+    });
+    prompts.out('回复授权已保存；旧消息映射不继承。新回复需从启用后的任务完成通知进入。');
+    return true;
+}
+export async function disableReplies(file, prompts) {
+    const before = await readJson(policyPath(file));
+    if (!before?.enabled) {
+        prompts.out('远程回复未启用。');
+        return true;
+    }
+    if (!/^(y|yes)$/i.test(await prompts.text('确认禁用远程回复？通知和凭据保持不变。[y/N] ')))
+        return false;
+    await locked(policyPath(file) + '.lock', async () => {
+        if (JSON.stringify(before) !== JSON.stringify(await readJson(policyPath(file))))
+            throw new ConfigError('回复授权已变化，请重试');
+        await atomicJson(policyPath(file), { ...before, enabled: false });
+    });
+    prompts.out('远程回复已禁用；正在进行中的注入不能撤回，桥接下次检查授权时退出。');
+    return true;
+}

package/dist/reply-telegram.js

@@ -0,0 +1,19 @@
+import { requestJson } from './channels.js';
+import { ConfigError } from './config.js';
+export function telegramApi(token, request = requestJson) {
+    return async (method, payload) => {
+        if (!['sendMessage', 'editMessageReplyMarkup', 'answerCallbackQuery', 'getMe', 'getUpdates', 'getWebhookInfo'].includes(method))
+            throw new ConfigError('不支持的 Telegram 桥接方法');
+        const response = await request(`https://api.telegram.org/bot${token}/${method}`, payload);
+        if (response.ok !== true) {
+            if (response.error_code === 409)
+                throw new ConfigError('Telegram 轮询冲突；检查旧 Python 桥接、其他机器或 webhook，桥接不会抢占或删除 webhook');
+            throw new ConfigError('Telegram 桥接请求失败；不输出服务端正文或秘密');
+        }
+        return response.result;
+    };
+}
+export async function replyHint(api, chat, title, content, replyTo, markup) {
+    return api('sendMessage', { chat_id: chat, text: title + '\n\n' + content,
+        ...(replyTo ? { reply_parameters: { message_id: replyTo } } : {}), ...(markup ? { reply_markup: markup } : {}) });
+}

package/dist/setup.js

@@ -130,7 +130,7 @@ export async function wizard(file, options = {}) {
     const { out } = prompts;
     out(`配置路径：${file}`);
     out('密钥隐藏输入并存入 Windows Credential Manager / macOS Keychain；JSON 只保存引用。');
-    out('不安装 hooks，不启用远程控制；只有额外同意测试时才发送消息。');
+    out('本步骤仅配置渠道；保存后可另行确认启用 Claude Code 通知，不启用远程控制。只有额外同意测试时才发送测试消息。');
     if (before && !yes(await prompts.text('已有配置，继续编辑？[y/N] ')))
         return false;
     const selection = await prompts.text('选择渠道：1 Telegram，2 飞书，3 两者；其他输入取消：');

package/package.json

@@ -1,8 +1,16 @@
 {
   "name": "@quecue/dev-notify",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.0-alpha.3",
   "description": "跨平台开发任务通知工具，支持 Telegram 与飞书",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/QueCue/dev-notify.git"
+  },
+  "homepage": "https://github.com/QueCue/dev-notify#readme",
+  "bugs": {
+    "url": "https://github.com/QueCue/dev-notify/issues"
+  },
   "type": "module",
   "engines": {
     "node": ">=22.0.0"
@@ -14,6 +22,7 @@
     "dist/*.js",
     "README.md",
     "SECURITY.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "scripts": {