@reconcrap/boss-recommend-mcp 1.3.35 → 1.3.36

package/README.md

@@ -239,7 +239,9 @@ node src/cli.js chat run --job "算法工程师" --start-from unread --criteria
 - `pause_boss_chat_run`
 - `resume_boss_chat_run`
 - `cancel_boss_chat_run`
-- vendored `boss-chat` CLI 还支持 `--data-dir <path>` 与 `BOSS_CHAT_HOME`，优先级高于兼容旧行为的 `<cwd>/.boss-chat`
+- vendored `boss-chat` CLI 还支持 `--data-dir <path>` 与 `BOSS_CHAT_HOME`，默认目录为 `~/.boss-recommend-mcp/boss-chat`（若设置 `BOSS_RECOMMEND_HOME`，则默认 `<BOSS_RECOMMEND_HOME>/boss-chat`）
+- 对 `/.boss-chat`、系统目录等危险运行目录会主动拒绝启动并返回 `UNSAFE_DATA_DIR`，避免在 harness 丢参时误写根目录
+- `boss_chat_health_check` 与 chat run 返回结果会包含 `data_dir` 与 `data_dir_source`，便于定位是参数/环境变量/默认路径生效
 
 chat-only 交互建议：
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reconcrap/boss-recommend-mcp",
-  "version": "1.3.35",
+  "version": "1.3.36",
   "description": "Unified MCP pipeline for recommend-page filtering and screening on Boss Zhipin",
   "keywords": [
     "boss",

package/src/boss-chat.js

@@ -97,11 +97,30 @@ function isSafeBossChatLegacyWorkspaceRoot(workspaceRoot) {
   );
 }
 
-export function getBossChatDataDir() {
+function isUnsafeBossChatDataDir(targetPath) {
+  const resolved = path.resolve(String(targetPath || ""));
+  return isRootDirectory(resolved) || isSystemDirectoryWorkspaceRoot(resolved);
+}
+
+function resolveBossChatDataDir() {
   if (process.env.BOSS_CHAT_HOME) {
-    return path.resolve(process.env.BOSS_CHAT_HOME);
+    return {
+      data_dir: path.resolve(process.env.BOSS_CHAT_HOME),
+      data_dir_source: "env:BOSS_CHAT_HOME"
+    };
   }
-  return path.join(getStateHome(), BOSS_CHAT_RUNTIME_SUBDIR);
+  const stateHome = getStateHome();
+  const source = process.env.BOSS_RECOMMEND_HOME
+    ? "default:env:BOSS_RECOMMEND_HOME"
+    : "default:user_home";
+  return {
+    data_dir: path.join(stateHome, BOSS_CHAT_RUNTIME_SUBDIR),
+    data_dir_source: source
+  };
+}
+
+export function getBossChatDataDir() {
+  return resolveBossChatDataDir().data_dir;
 }
 
 export function getLegacyBossChatWorkspaceDataDir(workspaceRoot) {
@@ -110,7 +129,8 @@ export function getLegacyBossChatWorkspaceDataDir(workspaceRoot) {
 }
 
 export function resolveBossChatRuntimeLayout(workspaceRoot) {
-  const dataDir = getBossChatDataDir();
+  const resolvedDataDir = resolveBossChatDataDir();
+  const dataDir = resolvedDataDir.data_dir;
   const legacyWorkspaceDir = getLegacyBossChatWorkspaceDataDir(workspaceRoot);
   const migrationSourceDir =
     legacyWorkspaceDir && pathExists(legacyWorkspaceDir) && !pathExists(dataDir)
@@ -119,6 +139,7 @@ export function resolveBossChatRuntimeLayout(workspaceRoot) {
   return {
     workspace_root: workspaceRoot ? path.resolve(String(workspaceRoot)) : null,
     data_dir: dataDir,
+    data_dir_source: resolvedDataDir.data_dir_source,
     legacy_workspace_dir: legacyWorkspaceDir,
     migration_source_dir: migrationSourceDir,
     migration_pending: Boolean(migrationSourceDir),
@@ -144,6 +165,22 @@ export function ensureBossChatRuntimeReady(workspaceRoot) {
       : ""
   };
 
+  if (isUnsafeBossChatDataDir(runtime.data_dir)) {
+    return {
+      ...runtime,
+      created,
+      existed,
+      failed: [
+        {
+          path: runtime.data_dir,
+          message: `Refusing unsafe boss-chat runtime path: ${runtime.data_dir}. Please use BOSS_CHAT_HOME in a writable user directory.`
+        }
+      ],
+      migration,
+      blocked_reason: "UNSAFE_DATA_DIR"
+    };
+  }
+
   if (runtime.migration_source_dir) {
     try {
       fs.cpSync(runtime.migration_source_dir, runtime.data_dir, {
@@ -698,28 +735,39 @@ function buildBossChatCliArgs(command, input, resolvedConfig, runtimeLayout = nu
   const runId = normalizeBossChatRunId(input);
   args.push("--profile", normalizeText(input.profile) || "default");
   args.push("--run-id", runId);
-  return args;
-}
-
+  return args;
+}
+
+function withRuntimeDiagnostics(payload, runtimeLayout) {
+  if (!payload || typeof payload !== "object") return payload;
+  return {
+    ...payload,
+    data_dir: runtimeLayout?.data_dir || null,
+    data_dir_source: runtimeLayout?.data_dir_source || null
+  };
+}
+
 async function spawnBossChatCli({ workspaceRoot, command, input = {} }) {
+  const runtimeLayout = ensureBossChatRuntimeReady(workspaceRoot);
   const cliPath = resolveBossChatCliPath(workspaceRoot);
   if (!cliPath) {
-    return {
+    return {
       ok: false,
       exitCode: -1,
       stdout: "",
       stderr: "",
-      payload: {
-        status: "FAILED",
-        error: {
-          code: "BOSS_CHAT_CLI_MISSING",
-          message: "未找到 vendored boss-chat CLI。"
-        }
+      payload: {
+        status: "FAILED",
+        error: {
+          code: "BOSS_CHAT_CLI_MISSING",
+          message: "未找到 vendored boss-chat CLI。"
+        },
+        data_dir: runtimeLayout?.data_dir || null,
+        data_dir_source: runtimeLayout?.data_dir_source || null
       }
     };
   }
 
-  const runtimeLayout = ensureBossChatRuntimeReady(workspaceRoot);
   const runtimeInitFailed = runtimeLayout.failed.some((item) => item.path === runtimeLayout.data_dir)
     && !pathExists(runtimeLayout.data_dir);
   if (runtimeInitFailed) {
@@ -738,6 +786,7 @@ async function spawnBossChatCli({ workspaceRoot, command, input = {} }) {
             .join("; ") || "无法初始化 boss-chat runtime 目录。"
         },
         data_dir: runtimeLayout.data_dir,
+        data_dir_source: runtimeLayout.data_dir_source,
         migration: runtimeLayout.migration
       }
     };
@@ -752,12 +801,14 @@ async function spawnBossChatCli({ workspaceRoot, command, input = {} }) {
         exitCode: 1,
         stdout: "",
         stderr: "",
-        payload: {
-          status: "FAILED",
-          error: configResolution.error,
-          config_path: configResolution.config_path,
-          config_dir: configResolution.config_dir
-        }
+        payload: {
+          status: "FAILED",
+          error: configResolution.error,
+          config_path: configResolution.config_path,
+          config_dir: configResolution.config_dir,
+          data_dir: runtimeLayout.data_dir,
+          data_dir_source: runtimeLayout.data_dir_source
+        }
       };
     }
   }
@@ -765,12 +816,15 @@ async function spawnBossChatCli({ workspaceRoot, command, input = {} }) {
   const args = [cliPath, ...buildBossChatCliArgs(command, input, configResolution?.config || {}, runtimeLayout)];
   const cwd = path.resolve(String(workspaceRoot || process.cwd()));
   return new Promise((resolve) => {
-    const child = spawn(process.execPath, args, {
-      cwd,
-      env: process.env,
-      windowsHide: true,
-      stdio: ["ignore", "pipe", "pipe"]
-    });
+    const child = spawn(process.execPath, args, {
+      cwd,
+      env: {
+        ...process.env,
+        BOSS_CHAT_HOME: runtimeLayout.data_dir
+      },
+      windowsHide: true,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
 
     let stdout = "";
     let stderr = "";
@@ -786,48 +840,53 @@ async function spawnBossChatCli({ workspaceRoot, command, input = {} }) {
         exitCode: -1,
         stdout,
         stderr,
-        payload: {
-          status: "FAILED",
-          error: {
-            code: "BOSS_CHAT_CLI_SPAWN_FAILED",
-            message: error?.message || "无法启动 vendored boss-chat CLI。"
-          }
-        }
-      });
-    });
+        payload: {
+          status: "FAILED",
+          error: {
+            code: "BOSS_CHAT_CLI_SPAWN_FAILED",
+            message: error?.message || "无法启动 vendored boss-chat CLI。"
+          },
+          data_dir: runtimeLayout.data_dir,
+          data_dir_source: runtimeLayout.data_dir_source
+        }
+      });
+    });
     child.on("close", (code) => {
       const parsed = parseJsonOutput(stdout) || parseJsonOutput(stderr);
       if (parsed && typeof parsed === "object") {
         resolve({
           ok: Number(code) === 0 && String(parsed.status || "").toUpperCase() !== "FAILED",
-          exitCode: Number.isInteger(code) ? code : 1,
-          stdout,
-          stderr,
-          payload: parsed
-        });
-        return;
-      }
-      resolve({
+          exitCode: Number.isInteger(code) ? code : 1,
+          stdout,
+          stderr,
+          payload: withRuntimeDiagnostics(parsed, runtimeLayout)
+        });
+        return;
+      }
+      resolve({
         ok: Number(code) === 0,
         exitCode: Number.isInteger(code) ? code : 1,
         stdout,
-        stderr,
-        payload: Number(code) === 0
-          ? {
-              status: "OK",
-              message: normalizeText(stdout) || `${command} 执行成功。`
-            }
-          : {
-              status: "FAILED",
-              error: {
-                code: "BOSS_CHAT_CLI_EXECUTION_FAILED",
-                message: normalizeText(stderr || stdout) || `${command} 执行失败。`
-              }
-            }
-      });
-    });
-  });
-}
+        stderr,
+        payload: withRuntimeDiagnostics(
+          Number(code) === 0
+            ? {
+                status: "OK",
+                message: normalizeText(stdout) || `${command} 执行成功。`
+              }
+            : {
+                status: "FAILED",
+                error: {
+                  code: "BOSS_CHAT_CLI_EXECUTION_FAILED",
+                  message: normalizeText(stderr || stdout) || `${command} 执行失败。`
+                }
+              },
+          runtimeLayout
+        )
+      });
+    });
+  });
+}
 
 export function getBossChatHealthCheck(workspaceRoot, input = {}) {
   const cliDir = resolveBossChatCliDir(workspaceRoot);
@@ -844,6 +903,7 @@ export function getBossChatHealthCheck(workspaceRoot, input = {}) {
         message: "未找到 vendored boss-chat CLI。"
       },
       data_dir: runtimeLayout.data_dir,
+      data_dir_source: runtimeLayout.data_dir_source,
       legacy_workspace_dir: runtimeLayout.legacy_workspace_dir,
       migration_pending: runtimeLayout.migration_pending
     };
@@ -857,6 +917,7 @@ export function getBossChatHealthCheck(workspaceRoot, input = {}) {
       cli_dir: cliDir,
       cli_path: cliPath,
       data_dir: runtimeLayout.data_dir,
+      data_dir_source: runtimeLayout.data_dir_source,
       legacy_workspace_dir: runtimeLayout.legacy_workspace_dir,
       migration_pending: runtimeLayout.migration_pending
     };
@@ -870,6 +931,7 @@ export function getBossChatHealthCheck(workspaceRoot, input = {}) {
     debug_port: resolvedPort,
     shared_llm_config: true,
     data_dir: runtimeLayout.data_dir,
+    data_dir_source: runtimeLayout.data_dir_source,
     legacy_workspace_dir: runtimeLayout.legacy_workspace_dir,
     migration_source_dir: runtimeLayout.migration_source_dir,
     migration_pending: runtimeLayout.migration_pending

package/src/test-boss-chat.js

@@ -244,6 +244,7 @@ async function testBossChatAdapterShouldResolveSharedConfigAndInvokeLocalCli() {
     assert.equal(health.status, "OK");
     assert.equal(health.shared_llm_config, true);
     assert.equal(health.debug_port, 9666);
+    assert.equal(health.data_dir_source, "env:BOSS_CHAT_HOME");
     assert.equal(health.data_dir, getTestChatDataDir(workspaceRoot));
     assert.equal(health.legacy_workspace_dir, path.join(workspaceRoot, ".boss-chat"));
     assert.equal(health.migration_pending, false);
@@ -526,18 +527,45 @@ function testVendorBossChatCliShouldResolveExplicitDataDir() {
   const cwd = path.join(path.parse(process.cwd()).root, "workspace");
   const args = vendorCliTestables.parseArgs(["start-run", "--data-dir", "/tmp/boss-chat-data"]);
   assert.equal(args.dataDir, "/tmp/boss-chat-data");
+  const explicitResolved = vendorCliTestables.resolveDataDirDetails(args, { BOSS_CHAT_HOME: "/tmp/ignored" }, cwd);
+  assert.equal(explicitResolved.source, "arg:data-dir");
+  assert.equal(explicitResolved.path, path.resolve("/tmp/boss-chat-data"));
   assert.equal(
     vendorCliTestables.resolveDataDir(args, { BOSS_CHAT_HOME: "/tmp/ignored" }, cwd),
     path.resolve("/tmp/boss-chat-data")
   );
+  const envResolved = vendorCliTestables.resolveDataDirDetails({}, { BOSS_CHAT_HOME: "/tmp/from-env" }, cwd);
+  assert.equal(envResolved.source, "env:BOSS_CHAT_HOME");
+  assert.equal(envResolved.path, path.resolve("/tmp/from-env"));
   assert.equal(
     vendorCliTestables.resolveDataDir({}, { BOSS_CHAT_HOME: "/tmp/from-env" }, cwd),
     path.resolve("/tmp/from-env")
   );
+  const defaultResolved = vendorCliTestables.resolveDataDirDetails({}, {}, cwd);
+  assert.equal(defaultResolved.source, "default:user_home");
+  assert.equal(defaultResolved.path, path.join(os.homedir(), ".boss-recommend-mcp", "boss-chat"));
   assert.equal(
     vendorCliTestables.resolveDataDir({}, {}, cwd),
-    path.join(path.resolve(cwd), ".boss-chat")
+    path.join(os.homedir(), ".boss-recommend-mcp", "boss-chat")
   );
+
+  const unsafeRoot = vendorCliTestables.validateDataDir(path.parse(process.cwd()).root);
+  assert.equal(unsafeRoot.ok, false);
+  assert.equal(unsafeRoot.code, "UNSAFE_DATA_DIR");
+  assert.equal(unsafeRoot.message.includes("Refusing unsafe boss-chat data dir"), true);
+
+  const safePath = vendorCliTestables.validateDataDir(path.join(os.homedir(), ".boss-recommend-mcp", "boss-chat"));
+  assert.equal(safePath.ok, true);
+}
+
+function testVendorBossChatCliShouldUseRecommendHomeForDefaultDataDir() {
+  const resolved = vendorCliTestables.resolveDataDirDetails(
+    {},
+    { BOSS_RECOMMEND_HOME: "/tmp/recommend-home" },
+    path.join(path.parse(process.cwd()).root, "workspace")
+  );
+  assert.equal(resolved.source, "default:env:BOSS_RECOMMEND_HOME");
+  assert.equal(resolved.path, path.resolve("/tmp/recommend-home/boss-chat"));
 }
 
 async function testBossChatPageShouldTreatBlankChatShellAsOnChatPage() {
@@ -3019,6 +3047,7 @@ async function main() {
   await testBossChatMcpToolsShouldValidateAndRoute();
   await testBossChatCliShouldSupportRunAndFollowUpParsing();
   testVendorBossChatCliShouldResolveExplicitDataDir();
+  testVendorBossChatCliShouldUseRecommendHomeForDefaultDataDir();
   await testVendorBossChatCliShouldWaitForHydratedChatShell();
   await testVendorBossChatCliShouldRetryJobListDuringPromptRunProfile();
   testCliShouldPinInstalledPackageVersionInGeneratedMcpConfig();

package/vendor/boss-chat-cli/src/cli.js

@@ -1,8 +1,9 @@
-#!/usr/bin/env node
-import { spawn } from 'node:child_process';
-import { appendFile, mkdir } from 'node:fs/promises';
-import path from 'node:path';
-import process from 'node:process';
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { appendFile, mkdir } from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
 import * as readlineCore from 'node:readline';
 import readline from 'node:readline/promises';
 import util from 'node:util';
@@ -301,12 +302,82 @@ function parseArgs(argv) {
   return args;
 }
 
-function resolveDataDir(args = {}, env = process.env, cwd = process.cwd()) {
+function isRootDirectory(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  const parsed = path.parse(resolved);
+  return resolved.toLowerCase() === String(parsed.root || '').toLowerCase();
+}
+
+function isSystemDirectoryPath(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  const normalized = resolved.replace(/\\/g, '/').toLowerCase();
+  if (process.platform === 'win32') {
+    return (
+      normalized.endsWith('/windows')
+      || normalized.endsWith('/windows/system32')
+      || normalized.endsWith('/windows/syswow64')
+      || normalized.endsWith('/program files')
+      || normalized.endsWith('/program files (x86)')
+    );
+  }
+  return (
+    normalized === '/system'
+    || normalized.startsWith('/system/')
+    || normalized === '/usr'
+    || normalized.startsWith('/usr/')
+    || normalized === '/bin'
+    || normalized.startsWith('/bin/')
+    || normalized === '/sbin'
+    || normalized.startsWith('/sbin/')
+  );
+}
+
+function resolveDefaultDataDir(env = process.env) {
+  const stateHomeRaw = String(env?.BOSS_RECOMMEND_HOME || '').trim();
+  const stateHome = stateHomeRaw
+    ? path.resolve(stateHomeRaw)
+    : path.join(os.homedir(), '.boss-recommend-mcp');
+  const source = stateHomeRaw
+    ? 'default:env:BOSS_RECOMMEND_HOME'
+    : 'default:user_home';
+  return {
+    path: path.join(stateHome, 'boss-chat'),
+    source,
+  };
+}
+
+function resolveDataDirDetails(args = {}, env = process.env, cwd = process.cwd()) {
   const explicit = String(args?.dataDir || '').trim();
-  if (explicit) return path.resolve(explicit);
+  if (explicit) {
+    return {
+      path: path.resolve(explicit),
+      source: 'arg:data-dir',
+    };
+  }
   const fromEnv = String(env?.BOSS_CHAT_HOME || '').trim();
-  if (fromEnv) return path.resolve(fromEnv);
-  return path.join(path.resolve(String(cwd || process.cwd())), '.boss-chat');
+  if (fromEnv) {
+    return {
+      path: path.resolve(fromEnv),
+      source: 'env:BOSS_CHAT_HOME',
+    };
+  }
+  return resolveDefaultDataDir(env);
+}
+
+function resolveDataDir(args = {}, env = process.env, cwd = process.cwd()) {
+  return resolveDataDirDetails(args, env, cwd).path;
+}
+
+function validateDataDir(targetPath) {
+  const resolved = path.resolve(String(targetPath || ''));
+  if (isRootDirectory(resolved) || isSystemDirectoryPath(resolved)) {
+    return {
+      ok: false,
+      code: 'UNSAFE_DATA_DIR',
+      message: `Refusing unsafe boss-chat data dir: ${resolved}. Please use --data-dir or BOSS_CHAT_HOME to a writable user directory.`,
+    };
+  }
+  return { ok: true };
 }
 
 function printUsage() {
@@ -323,7 +394,7 @@ function printUsage() {
   console.log('');
   console.log('Common options:');
   console.log('  --profile <name>                Profile name (default: default)');
-  console.log('  --data-dir <path>               Runtime data dir (default: $BOSS_CHAT_HOME or <cwd>/.boss-chat)');
+  console.log('  --data-dir <path>               Runtime data dir (default: $BOSS_CHAT_HOME or ~/.boss-recommend-mcp/boss-chat)');
   console.log('  --json                          JSON output for agent integration');
   console.log('  --run-id <id>                   Target async run_id (for get/pause/resume/cancel)');
   console.log('');
@@ -1527,7 +1598,27 @@ async function executeRunCommand(args, dataDir) {
 
 async function main() {
   const args = parseArgs(process.argv.slice(2));
-  const dataDir = resolveDataDir(args);
+  const resolvedDataDir = resolveDataDirDetails(args);
+  const dataDir = resolvedDataDir.path;
+  const dataDirValidation = validateDataDir(dataDir);
+  if (!dataDirValidation.ok) {
+    const failedPayload = {
+      status: 'FAILED',
+      error: {
+        code: dataDirValidation.code,
+        message: dataDirValidation.message,
+      },
+      data_dir: dataDir,
+      data_dir_source: resolvedDataDir.source,
+    };
+    if (args.json) {
+      console.log(JSON.stringify(failedPayload));
+    } else {
+      console.error(failedPayload.error.message);
+    }
+    process.exitCode = 1;
+    return;
+  }
   await mkdir(dataDir, { recursive: true });
 
   if (args.command === 'help') {
@@ -1562,19 +1653,28 @@ async function main() {
       break;
     default:
       printUsage();
-      process.exitCode = 1;
-      return;
-  }
-
-  outputCommandResult(args, payload);
-  if (payload?.status === 'FAILED') {
-    process.exitCode = 1;
-  }
-}
+      process.exitCode = 1;
+      return;
+  }
+
+  if (payload && typeof payload === 'object') {
+    payload = {
+      ...payload,
+      data_dir: dataDir,
+      data_dir_source: resolvedDataDir.source,
+    };
+  }
+  outputCommandResult(args, payload);
+  if (payload?.status === 'FAILED') {
+    process.exitCode = 1;
+  }
+}
 
 export const __testables = {
   parseArgs,
+  resolveDataDirDetails,
   resolveDataDir,
+  validateDataDir,
   connectBossChatPage,
   hasHydratedChatShell,
   promptRunProfile,