@raolin2025/claude-code-node 2.0.0 → 2.2.0

package/src/core/query-engine.js

@@ -43,6 +43,8 @@ export class QueryEngineConfig {
     this.costTracker = options.costTracker || null
     this.tokenBudget = options.tokenBudget || null
     this.initialMessages = options.initialMessages || []
+    this.onConfirmTool = options.onConfirmTool || null  // ask 模式确认回调
+    this.readline = options.readline || null              // 用于 AskUserQuestion 工具
   }
 }
 
@@ -196,39 +198,61 @@ export class QueryEngine {
 
 
   /**
-   * 执行工具调用
+   * 执行工具调用 — 两阶段策略
+   * 阶段1（串行）：安全检查 + ask 模式确认（需要用户交互，必须串行）
+   * 阶段2（并行）：批准后的工具并行执行，互不依赖的工具同时跑
    */
   async _executeToolCalls(toolCalls) {
-    const results = []
+    // 阶段1：串行安全检查
+    const approved = []
     for (const tc of toolCalls) {
-      // 安全检查
       const permResult = await this.permissionChecker.check(tc.name, tc.input)
       if (!permResult.allowed) {
-        results.push(new ToolResult(tc.id, `工具调用被安全策略拒绝: ${tc.name} — ${permResult.reason || ""}`, true))
-        results[results.length - 1].toolName = tc.name
-        continue
+        if (permResult.requiresConfirmation && this.config.onConfirmTool) {
+          const confirmed = await this.config.onConfirmTool(tc.name, tc.input)
+          if (!confirmed) {
+            approved.push({ tc, error: '用户未确认' })
+            continue
+          }
+        } else {
+          approved.push({ tc, error: `安全策略拒绝: ${permResult.reason || ""}` })
+          continue
+        }
       }
 
-      // 查找工具
       const tool = this.config.tools.find(t => t.name === tc.name)
       if (!tool) {
-        results.push(new ToolResult(tc.id, `未找到工具: ${tc.name}`, true))
-        results[results.length - 1].toolName = tc.name
+        approved.push({ tc, error: `未找到工具: ${tc.name}` })
         continue
       }
 
+      approved.push({ tc, tool })
+    }
+
+    // 阶段2：并行执行已批准的工具
+    const execPromises = approved.map(async (item) => {
+      if (item.error) {
+        const r = new ToolResult(item.tc.id, item.error, true)
+        r.toolName = item.tc.name
+        return r
+      }
+      const { tc, tool } = item
+      tc.status = 'running'
       try {
-        tc.status = 'running'
-        const content = await tool.handler(tc.input, { cwd: this.config.cwd, engine: this })
+        const content = await tool.handler(tc.input, { cwd: this.config.cwd, engine: this, readline: this.config.readline })
         tc.status = 'done'
-        results.push(new ToolResult(tc.id, typeof content === 'string' ? content : JSON.stringify(content), false))
-        results[results.length - 1].toolName = tc.name
+        const r = new ToolResult(tc.id, typeof content === 'string' ? content : JSON.stringify(content), false)
+        r.toolName = tc.name
+        return r
       } catch (err) {
         tc.status = 'error'
-        results.push(new ToolResult(tc.id, `工具执行错误: ${err.message}`, true))
-        results[results.length - 1].toolName = tc.name
+        const r = new ToolResult(tc.id, `工具执行错误: ${err.message}`, true)
+        r.toolName = tc.name
+        return r
       }
-    }
+    })
+
+    const results = await Promise.all(execPromises)
     return results
   }
 
@@ -289,6 +313,12 @@ export class QueryEngine {
 
     // 带重试的 fetch
     const maxRetries = 3
+    // Jitter 退避 — 指数退避 + 随机 ±50%，防止惊群效应
+    const retryDelay = (baseMs, attempt) => {
+      const ms = baseMs * Math.pow(2, attempt - 1)
+      const jitter = ms * (0.5 + Math.random() * 0.5) // 50%-100% of base
+      return Math.round(jitter)
+    }
     let lastError = null
     for (let attempt = 1; attempt <= maxRetries; attempt++) {
       try {
@@ -310,7 +340,7 @@ export class QueryEngine {
           const errText = await response.text()
           // 429/503 可重试
           if ((response.status === 429 || response.status === 503) && attempt < maxRetries) {
-            const waitMs = response.status === 429 ? 2000 * attempt : 1000
+            const waitMs = retryDelay(response.status === 429 ? 2000 : 1000, attempt)
             if (this.config.verbose) {
               console.error(`[retry] API ${response.status}, waiting ${waitMs}ms (attempt ${attempt}/${maxRetries})`)
             }
@@ -322,11 +352,17 @@ export class QueryEngine {
 
         // 流式或非流式处理
         if (useStream && response.body) {
-          return await this._handleStreamResponse(response)
+          const result = await this._handleStreamResponse(response)
+          if (result.usage && this.costTracker) {
+            this.costTracker.recordUsage(result.usage)
+          }
+          if (this.tokenBudget && result.usage) {
+            this.tokenBudget.recordUsage(result.usage)
+          }
+          return result
         } else {
           const data = await response.json()
           const result = parseNonStreamResponse(data)
-          // M4: 记录非流式响应费用
           if (result.usage && this.costTracker) {
             this.costTracker.recordUsage(result.usage)
           }
@@ -339,7 +375,7 @@ export class QueryEngine {
         lastError = err
         // 网络错误重试
         if (err.name !== 'AbortError' && attempt < maxRetries && !err.message.startsWith('API 错误')) {
-          const waitMs = 1000 * attempt
+          const waitMs = retryDelay(1000, attempt)
           if (this.config.verbose) {
             console.error(`[retry] Network error: ${err.message}, waiting ${waitMs}ms (attempt ${attempt}/${maxRetries})`)
           }
@@ -394,42 +430,9 @@ export class QueryEngine {
     return result
   }
 
-    /**
-   * 解析 OpenAI 兼容响应
-   */
-  _parseResponse(data) {
-    const result = { content: '', toolCalls: [] }
-    const choice = data.choices?.[0]
-    if (!choice) return result
-
-    const message = choice.message
-    if (message.content) {
-      result.content = message.content
-    }
-
-    for (const tc of (message.tool_calls || [])) {
-      let input = {}
-      try {
-        input = JSON.parse(tc.function.arguments || '{}')
-      } catch {
-        input = { _raw: tc.function.arguments }
-      }
-      result.toolCalls.push(new ToolCall(tc.id, tc.function.name, input))
-    }
-
-    // M4: 记录 API 调用费用
-    if (result.usage && this.costTracker) {
-      this.costTracker.recordUsage(result.usage)
-    }
-    if (this.tokenBudget && result.usage) {
-      this.tokenBudget.recordUsage(result.usage)
-    }
-
-    return result
-  }
-
   /** 格式化内容 */
   _formatContent(content) {
+    if (content == null) return ''
     if (typeof content === 'string') return content
     if (typeof content === 'object') return JSON.stringify(content)
     return String(content)

package/src/core/session.js

@@ -4,6 +4,7 @@
  */
 import { readFile, writeFile, mkdir, readdir, rm, chmod } from 'fs/promises'
 import { resolve, join } from 'path'
+import { randomBytes } from 'crypto'
 
 const DEFAULT_SESSIONS_DIR = '.claude-code/sessions'
 
@@ -21,7 +22,8 @@ export class SessionManager {
   /** 创建新会话 */
   async create(title = '') {
     await this.ensureDir()
-    const id = `session-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`
+    // M4 fix: 使用 crypto.randomBytes 生成不可预测的会话 ID
+    const id = `session-${Date.now()}-${randomBytes(8).toString('hex')}`
     const session = {
       id,
       title: title || `Session ${new Date().toISOString().slice(0, 19)}`,

package/src/git/github-api.js

@@ -0,0 +1,360 @@
+/**
+ * GitHub REST API 封装（零外部依赖）
+ * 使用原生 fetch (Node.js ≥ 18)
+ */
+
+export class GitHubAPI {
+  /**
+   * @param {Object} config
+   * @param {string} config.token - GitHub Personal Access Token
+   * @param {string} config.owner - Repository owner
+   * @param {string} config.repo - Repository name
+   * @param {string} [config.baseUrl] - API base URL (for enterprise)
+   */
+  constructor(config) {
+    this.token = config.token || process.env.GITHUB_TOKEN
+    this.owner = config.owner
+    this.repo = config.repo
+    this.baseUrl = config.baseUrl || 'https://api.github.com'
+    this.apiVersion = '2022-11-28' // GitHub API version
+
+    if (!this.token) {
+      throw new Error('GitHub token required (set GITHUB_TOKEN or pass token param)')
+    }
+    if (!this.owner || !this.repo) {
+      throw new Error('GitHub repository owner and repo required')
+    }
+  }
+
+  /**
+   * 发送请求到 GitHub API
+   */
+  async request(endpoint, options = {}) {
+    const url = `${this.baseUrl}${endpoint}`
+    const headers = {
+      'Authorization': `Bearer ${this.token}`,
+      'Accept': 'application/vnd.github+json',
+      'X-GitHub-Api-Version': this.apiVersion,
+      ...options.headers
+    }
+
+    // 速率限制检查
+    const shouldRetry = this._shouldRetryAfter(options)
+    if (shouldRetry.retry) {
+      await this._delay(shouldRetry.after)
+    }
+
+    const response = await fetch(url, {
+      ...options,
+      headers
+    })
+
+    // 更新速率限制信息
+    this._updateRateLimitInfo(response)
+
+    // 处理错误
+    if (!response.ok) {
+      const error = await this._parseError(response)
+      if (response.status === 403 && this._isRateLimited(response)) {
+        throw new GitHubRateLimitError(error.message, response)
+      }
+      throw new GitHubError(error.message, response.status, error.documentation_url)
+    }
+
+    // 204 No Content
+    if (response.status === 204) {
+      return null
+    }
+
+    return await response.json()
+  }
+
+  /**
+   * GET 请求
+   */
+  async get(endpoint, params = {}) {
+    const fullUrl = `${this.baseUrl}${endpoint}`
+    const queryParts = []
+    Object.keys(params).forEach(key => {
+      if (params[key] !== undefined && params[key] !== null) {
+        queryParts.push(`${encodeURIComponent(key)}=${encodeURIComponent(String(params[key]))}`)
+      }
+    })
+    const queryString = queryParts.length > 0 ? `?${queryParts.join('&')}` : ''
+
+    return this.request(`${endpoint}${queryString}`, { method: 'GET' })
+  }
+
+  /**
+   * POST 请求
+   */
+  async post(endpoint, body) {
+    return this.request(endpoint, {
+      method: 'POST',
+      body: JSON.stringify(body),
+      headers: { 'Content-Type': 'application/json' }
+    })
+  }
+
+  /**
+   * PUT 请求
+   */
+  async put(endpoint, body) {
+    return this.request(endpoint, {
+      method: 'PUT',
+      body: JSON.stringify(body),
+      headers: { 'Content-Type': 'application/json' }
+    })
+  }
+
+  /**
+   * PATCH 请求
+   */
+  async patch(endpoint, body) {
+    return this.request(endpoint, {
+      method: 'PATCH',
+      body: JSON.stringify(body),
+      headers: { 'Content-Type': 'application/json' }
+    })
+  }
+
+  /**
+   * DELETE 请求
+   */
+  async delete(endpoint) {
+    return this.request(endpoint, { method: 'DELETE' })
+  }
+
+  // ============ Pull Requests API ============
+
+  /**
+   * 列出 PRs
+   * GET /repos/{owner}/{repo}/pulls
+   */
+  async listPRs(params = {}) {
+    // 默认只获取 open 状态的 PR
+    const defaultParams = { state: 'open', per_page: 100 }
+    const query = { ...defaultParams, ...params }
+    return this.get(`/repos/${this.owner}/${this.repo}/pulls`, query)
+  }
+
+  /**
+   * 获取单个 PR
+   * GET /repos/{owner}/{repo}/pulls/{pr_number}
+   */
+  async getPR(prNumber) {
+    return this.get(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}`)
+  }
+
+  /**
+   * 获取 PR 的 diff
+   * GET /repos/{owner}/{repo}/pulls/{pr_number}/files
+   */
+  async getPRFiles(prNumber) {
+    return this.get(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/files`)
+  }
+
+  /**
+   * 获取 PR 提交的 diff (未压缩)
+   */
+  async getPRDiff(prNumber) {
+    const endpoint = `/repos/${this.owner}/${this.repo}/pulls/${prNumber}`
+    // 使用统一的 request 方法，但走 diff 类型的 Accept
+    // 单独 fetch diff，因为需要 text() 而非 json()
+    const diffUrl = `${this.baseUrl}/repos/${this.owner}/${this.repo}/pulls/${prNumber}.diff`
+    const diffResponse = await fetch(diffUrl, {
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${this.token}`,
+        'Accept': 'application/vnd.github.v3.diff'
+      }
+    })
+
+    if (!diffResponse.ok) {
+      const errMsg = `Failed to fetch PR diff: ${diffResponse.status} ${diffResponse.statusText}`
+      throw new GitHubError(errMsg, diffResponse.status)
+    }
+
+    return await diffResponse.text()
+  }
+
+  /**
+   * 创建 PR 评论
+   * POST /repos/{owner}/{repo}/pulls/{pr_number}/reviews
+   */
+  async createReview(prNumber, body, event = 'COMMENT', comments = []) {
+    return this.post(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/reviews`, {
+      body,
+      event, // 'COMMENT' | 'APPROVE' | 'REQUEST_CHANGES'
+      comments // [{ path, position, body }]
+    })
+  }
+
+  /**
+   * 在 PR diff 的特定行添加评论
+   * POST /repos/{owner}/{repo}/pulls/{pr_number}/comments
+   */
+  async createComment(prNumber, body, { path, position, commitId }) {
+    return this.post(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/comments`, {
+      body,
+      path,
+      position,
+      commit_id: commitId
+    })
+  }
+
+  /**
+   * 更新 PR 评论（回复）
+   * PATCH /repos/{owner}/{repo}/pulls/comments/{comment_id}
+   */
+  async updateComment(commentId, body) {
+    return this.patch(`/repos/${this.owner}/${this.repo}/pulls/comments/${commentId}`, { body })
+  }
+
+  /**
+   * 删除 PR 评论
+   * DELETE /repos/{owner}/{repo}/pulls/comments/{comment_id}
+   */
+  async deleteComment(commentId) {
+    return this.delete(`/repos/${this.owner}/${this.repo}/pulls/comments/${commentId}`)
+  }
+
+  /**
+   * 获取 PR 的评论线程
+   * GET /repos/{owner}/{repo}/pulls/{pr_number}/comments
+   */
+  async listPRComments(prNumber) {
+    return this.get(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/comments`)
+  }
+
+  /**
+   * Approve PR
+   */
+  async approvePR(prNumber, body) {
+    return this.createReview(prNumber, body || 'Approved', 'APPROVE')
+  }
+
+  /**
+   * Request changes on PR
+   */
+  async requestChanges(prNumber, body) {
+    return this.createReview(prNumber, body || 'Changes requested', 'REQUEST_CHANGES')
+  }
+
+  /**
+   * 合并 PR
+   * POST /repos/{owner}/{repo}/pulls/{pr_number}/merge
+   */
+  async mergePR(prNumber, options = {}) {
+    const { commitTitle, commitMessage, mergeMethod = 'merge' } = options
+    return this.post(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/merge`, {
+      commit_title: commitTitle,
+      commit_message: commitMessage,
+      merge_method: mergeMethod // 'merge' | 'squash' | 'rebase'
+    })
+  }
+
+  /**
+   * 检查 PR 是否可合并
+   * GET /repos/{owner}/{repo}/pulls/{pr_number}/mergeable
+   */
+  async isMergeable(prNumber) {
+    const pr = await this.getPR(prNumber)
+    // GitHub 返回 null 表示还在计算中，不视为不可合并
+    return pr.mergeable !== false
+  }
+
+  /**
+   * 获取 PR 的状态检查（CI checks）
+   * GET /repos/{owner}/{repo}/commits/{commit_sha}/status
+   */
+  /**
+   * 获取 PR 的合并状态（combine status）
+   * GET /repos/{owner}/{repo}/commits/{commit_sha}/status
+   */
+  async getCombinedStatus(commitSha) {
+    if (!commitSha) {
+      throw new Error('commitSha is required for getCombinedStatus')
+    }
+    return this.get(`/repos/${this.owner}/${this.repo}/commits/${commitSha}/status`)
+  }
+
+  /**
+   * 列出 PR 的审查评论（reviews）
+   * GET /repos/{owner}/{repo}/pulls/{pr_number}/reviews
+   */
+  async listReviews(prNumber) {
+    return this.get(`/repos/${this.owner}/${this.repo}/pulls/${prNumber}/reviews`)
+  }
+
+  // ============ 辅助方法 ============
+
+  _updateRateLimitInfo(response) {
+    this.rateLimitRemaining = parseInt(response.headers.get('X-RateLimit-Remaining'), 10)
+    this.rateLimitReset = parseInt(response.headers.get('X-RateLimit-Reset'), 10) // Unix timestamp
+    this.rateLimitLimit = parseInt(response.headers.get('X-RateLimit-Limit'), 10)
+  }
+
+  _isRateLimited(response) {
+    return response.status === 403 && response.headers.get('X-RateLimit-Remaining') === '0'
+  }
+
+  _shouldRetryAfter(options) {
+    if (options._retryCount && options._retryCount > 3) {
+      return { retry: false }
+    }
+    if (this.rateLimitRemaining === 0 && this.rateLimitReset) {
+      const now = Math.floor(Date.now() / 1000)
+      const waitSeconds = Math.max(this.rateLimitReset - now + 1, 1)
+      return { retry: true, after: waitSeconds * 1000 }
+    }
+    return { retry: false }
+  }
+
+  _delay(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms))
+  }
+
+  async _parseError(response) {
+    let message = `${response.status} ${response.statusText}`
+    let documentationUrl = null
+    try {
+      const data = await response.json()
+      message = data.message || message
+      documentationUrl = data.documentation_url || null
+    } catch {
+      // ignore parse error, keep fallback message
+    }
+    return { message, documentation_url: documentationUrl }
+  }
+}
+
+/**
+ * GitHub API 错误
+ */
+export class GitHubError extends Error {
+  constructor(message, status, documentationUrl = null) {
+    super(message)
+    this.name = 'GitHubError'
+    this.status = status
+    this.documentationUrl = documentationUrl
+  }
+}
+
+/**
+ * 速率限制错误
+ */
+export class GitHubRateLimitError extends GitHubError {
+  constructor(message, response) {
+    super(message, response.status)
+    this.name = 'GitHubRateLimitError'
+    this.resetAt = parseInt(response.headers.get('X-RateLimit-Reset'), 10)
+  }
+}
+
+/**
+ * 创建 GitHub API 实例的工厂函数
+ */
+export function createGitHubAPI(options) {
+  return new GitHubAPI(options)
+}

package/src/git/index.js

@@ -0,0 +1,37 @@
+/**
+ * Git 模块统一导出
+ */
+
+export { GitHubAPI, createGitHubAPI, GitHubError, GitHubRateLimitError } from './github-api.js'
+export { PRReviewer } from './pr-reviewer.js'
+export { PRMergePolicy, DEFAULT_MERGE_POLICY, findEligiblePRs, isPRMergeable } from './pr-merge-policy.js'
+
+// Diff 解析工具
+export {
+  parseDiff,
+  splitDiffByFile,
+  getPositionInDiff,
+  buildCommentPayload,
+  getHunksForFileRaw,
+  fileExistsInDiff,
+  countFileChanges,
+  mapLineToPosition,
+  findAddedLines,
+  debugPrintHunks
+} from './utils/diff-parser.js'
+
+// LLM 助手
+export { callLLM, buildPRReviewPrompt } from './llm-assistant.js'
+
+/**
+ * 快速创建 GitTool
+ */
+import { gitTool } from '../tools/git-tool.js'
+
+export function createGitTool(config = {}) {
+  // 这里返回的是一个配置对象，实际 ToolDef 已注册
+  return {
+    config,
+    tool: gitTool
+  }
+}

package/src/git/llm-assistant.js

@@ -0,0 +1,83 @@
+/**
+ * LLM 助手 - 调用 LLM API 进行智能分析
+ * 复用 cc-node 的 LLM 调用模式
+ */
+
+/**
+ * 调用 LLM 分析 PR
+ * @param {string} systemPrompt
+ * @param {string} userPrompt
+ * @param {Object} apiConfig - { apiKey, apiBase, model }
+ */
+export async function callLLM(systemPrompt, userPrompt, apiConfig = {}) {
+  const {
+    apiKey = process.env.LLM_API_KEY || process.env.DEEPSEEK_API_KEY,
+    apiBase = process.env.LLM_API_BASE || 'https://api.deepseek.com/v1',
+    model = process.env.LLM_MODEL || 'deepseek-chat'
+  } = apiConfig
+
+  if (!apiKey) {
+    throw new Error('LLM API key required (set LLM_API_KEY or DEEPSEEK_API_KEY)')
+  }
+
+  const response = await fetch(`${apiBase}/chat/completions`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      'Authorization': `Bearer ${apiKey}`
+    },
+    body: JSON.stringify({
+      model,
+      messages: [
+        { role: 'system', content: systemPrompt },
+        { role: 'user', content: userPrompt }
+      ],
+      temperature: 0.3,
+      max_tokens: 2000
+    })
+  })
+
+  if (!response.ok) {
+    const error = await response.json().catch(() => ({}))
+    throw new Error(`LLM API error: ${response.status} ${error.message || response.statusText}`)
+  }
+
+  const data = await response.json()
+  return data.choices[0].message.content
+}
+
+/**
+ * PR 智能审查 prompt
+ * @param {Object} pr - PR 信息
+ * @param {string} diff - diff 内容
+ * @param {Array} findings - 已发现的规则检查问题
+ */
+export function buildPRReviewPrompt(pr, diff, findings) {
+  const findingsText = findings.map(f => `- ${f.file}:${f.line} [${f.severity}] ${f.message}`).join('\n')
+
+  return `
+You are an experienced code reviewer. Analyze the following PR and provide a concise review summary.
+
+## PR Information
+- Title: ${pr.title}
+- Author: ${pr.user?.login}
+- Files changed: ${pr.changed_files}
+- Additions: ${pr.additions}, Deletions: ${pr.deletions}
+
+## Automated Findings
+${findingsText || 'No issues found by automated checks.'}
+
+## Diff
+${diff.substring(0, 5000)}... (truncated)
+
+## Instructions
+Provide a review summary with:
+1. Overall assessment (POSITIVE / NEEDS_WORK / REJECT)
+2. Key strengths (if any)
+3. Critical issues that must be fixed
+4. Suggestions for improvement
+5. Merging recommendation (YES / NO)
+
+Keep it concise (3-5 bullet points).
+`
+}