@ryuu-reinzz/ryuu-cli 0.5.0 → 0.5.2

package/plugins/github/config.js

@@ -0,0 +1,209 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { randomBytes } from 'node:crypto';
+
+import { ConfigError } from '../../src/utils/errors.js';
+import { settingsDir } from '../../src/config/settings.js';
+
+/**
+ * Konfigurasi plugin GitHub di sisi CLI.
+ *
+ * Yang disimpan di sini hanya pengaturan non-rahasia: status aktif, preferensi
+ * perilaku, dan Client ID publik milik GitHub App. Client Secret, Private Key,
+ * Webhook Secret, access token, dan refresh token TIDAK PERNAH ada di CLI —
+ * semuanya dimiliki backend.
+ *
+ * Lokasi mengikuti direktori konfigurasi OS lewat `settingsDir()`:
+ *   <config>/integrations/github/config.json
+ *   <config>/integrations/github/state.json   (cache non-sensitif)
+ *   <config>/integrations/github/credentials.enc
+ *   <config>/.keys/github.key                 (kunci enkripsi CLI token)
+ */
+export const GITHUB_BACKEND_URL = 'https://restapi.ryuu-dev.my.id';
+export const GITHUB_CLIENT_ID = 'Iv23liIt8Xh4waFhX0y1';
+
+export const DEFAULT_GITHUB_CONFIG = Object.freeze({
+  enabled: false,
+  autoRefresh: true,
+  confirmDestructive: true,
+  defaultRepo: null,
+  // Client ID bukan rahasia; dipakai untuk ditampilkan pada /github config.
+  clientId: GITHUB_CLIENT_ID,
+  // Endpoint backend adalah konstanta aplikasi, bukan pengaturan pengguna.
+  backend: GITHUB_BACKEND_URL,
+});
+
+export const EDITABLE_KEYS = Object.freeze(['enabled', 'autoRefresh', 'confirmDestructive', 'defaultRepo']);
+
+const BLOCKED_KEYS = new Set([
+  'clientSecret',
+  'privateKey',
+  'privateKeyPath',
+  'webhookSecret',
+  'backend',
+  'clientId',
+  'accessToken',
+  'refreshToken',
+  'cliToken',
+  'token',
+  'secret',
+  '__proto__',
+  'prototype',
+  'constructor',
+]);
+
+/** Path absolut file milik integrasi GitHub di sisi CLI. */
+export function githubPaths({ env = process.env, home = undefined, platform = undefined } = {}) {
+  const root = path.join(settingsDir({ env, home, platform }), 'integrations', 'github');
+  return {
+    dir: root,
+    configFile: path.join(root, 'config.json'),
+    credentialFile: path.join(root, 'credentials.enc'),
+    stateFile: path.join(root, 'state.json'),
+    keyFile: path.join(settingsDir({ env, home, platform }), '.keys', 'github.key'),
+  };
+}
+
+function boolValue(name, value, issues) {
+  if (typeof value === 'boolean') return value;
+  const text = String(value ?? '').trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on', 'enable', 'enabled', 'aktif'].includes(text)) return true;
+  if (['0', 'false', 'no', 'n', 'off', 'disable', 'disabled', 'nonaktif'].includes(text)) return false;
+  issues.push(`${name} harus berupa boolean (true/false), diterima: ${JSON.stringify(value)}`);
+  return undefined;
+}
+
+/** Validasi satu penulisan `/github config set <key> <value>`. */
+export function validateConfigEntry(key, rawValue) {
+  const name = String(key ?? '').trim();
+  if (BLOCKED_KEYS.has(name)) {
+    throw new ConfigError(
+      `Key "${name}" tidak dapat diubah: Client Secret, Private Key, Webhook Secret, endpoint backend, dan token dikelola backend dan tidak boleh ada di CLI.`,
+    );
+  }
+  if (!EDITABLE_KEYS.includes(name)) {
+    throw new ConfigError(`Key tidak dikenal: "${name}". Key yang didukung: ${EDITABLE_KEYS.join(', ')}.`);
+  }
+  const issues = [];
+  let value;
+  switch (name) {
+    case 'enabled':
+    case 'autoRefresh':
+    case 'confirmDestructive':
+      value = boolValue(name, rawValue, issues);
+      break;
+    case 'defaultRepo': {
+      const text = String(rawValue ?? '').trim();
+      if (!text || ['none', 'null', '-', 'off'].includes(text.toLowerCase())) value = null;
+      else if (!/^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/.test(text)) {
+        issues.push('defaultRepo harus berformat owner/repo, contoh: ryuu-reinzz/ryuu-cli.');
+      } else value = text;
+      break;
+    }
+    default:
+      issues.push(`Key tidak dikenal: ${name}`);
+  }
+  if (issues.length > 0) throw new ConfigError(issues.join(' '), { key: name });
+  return value;
+}
+
+function normalize(data) {
+  const source = data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+  const stored = {};
+  for (const key of Object.keys(DEFAULT_GITHUB_CONFIG)) {
+    if (key in source) stored[key] = source[key];
+  }
+  const merged = { ...DEFAULT_GITHUB_CONFIG, ...stored };
+  // Nilai milik aplikasi selalu kembali ke default.
+  merged.clientId = GITHUB_CLIENT_ID;
+  merged.backend = GITHUB_BACKEND_URL;
+  merged.enabled = Boolean(merged.enabled);
+  merged.autoRefresh = merged.autoRefresh !== false;
+  merged.confirmDestructive = merged.confirmDestructive !== false;
+  merged.defaultRepo =
+    typeof merged.defaultRepo === 'string' && /^[A-Za-z0-9][A-Za-z0-9-]{0,38}\/[A-Za-z0-9._-]{1,100}$/.test(merged.defaultRepo)
+      ? merged.defaultRepo
+      : null;
+  return merged;
+}
+
+/** Baca konfigurasi; file hilang menghasilkan default bawaan. */
+export async function readGitHubConfig({ paths = githubPaths() } = {}) {
+  let text;
+  try {
+    text = await fsp.readFile(paths.configFile, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return normalize({});
+    throw new ConfigError(`Tidak dapat membaca konfigurasi GitHub (${paths.configFile}): ${error.message}`);
+  }
+  try {
+    return normalize(JSON.parse(text));
+  } catch (error) {
+    throw new ConfigError(
+      `Konfigurasi GitHub tidak valid (${paths.configFile}): ${error.message}. File tidak diubah — perbaiki atau hapus file tersebut.`,
+    );
+  }
+}
+
+/** Tulis konfigurasi secara atomik dengan permission 0600. */
+export async function writeGitHubConfig(config, { paths = githubPaths() } = {}) {
+  const data = normalize(config);
+  await fsp.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+  const tmp = path.join(paths.dir, `.config.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+  try {
+    await fsp.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+    await fsp.rename(tmp, paths.configFile);
+    if (process.platform !== 'win32') await fsp.chmod(paths.configFile, 0o600).catch(() => {});
+  } catch (error) {
+    await fsp.rm(tmp, { force: true }).catch(() => {});
+    throw new ConfigError(`Gagal menyimpan konfigurasi GitHub: ${error.message}`);
+  }
+  return data;
+}
+
+/** Read-modify-write satu key agar perubahan lain tidak hilang. */
+export async function updateGitHubConfig(key, value, { paths = githubPaths() } = {}) {
+  const current = await readGitHubConfig({ paths });
+  current[key] = value;
+  return writeGitHubConfig(current, { paths });
+}
+
+/** Cache non-sensitif: kapan terakhir backend diperiksa dan hasilnya. */
+export async function readGitHubState({ paths = githubPaths() } = {}) {
+  try {
+    const parsed = JSON.parse(await fsp.readFile(paths.stateFile, 'utf8'));
+    return parsed && typeof parsed === 'object' ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+export async function writeGitHubState(state, { paths = githubPaths() } = {}) {
+  const data = state && typeof state === 'object' ? state : {};
+  await fsp.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+  const tmp = path.join(paths.dir, `.state.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+  try {
+    await fsp.writeFile(tmp, `${JSON.stringify(data, null, 2)}\n`, { mode: 0o600 });
+    await fsp.rename(tmp, paths.stateFile);
+    if (process.platform !== 'win32') await fsp.chmod(paths.stateFile, 0o600).catch(() => {});
+  } catch {
+    // Cache tidak boleh menggagalkan operasi utama.
+    await fsp.rm(tmp, { force: true }).catch(() => {});
+  }
+  return data;
+}
+
+/** Tampilan konfigurasi non-rahasia untuk `/github config`. */
+export function describeGitHubConfig(config) {
+  return {
+    enabled: config.enabled ? 'true' : 'false',
+    autoRefresh: config.autoRefresh ? 'true' : 'false',
+    confirmDestructive: config.confirmDestructive ? 'true' : 'false',
+    defaultRepo: config.defaultRepo || '(belum diatur)',
+    clientId: config.clientId,
+    backend: config.backend,
+    clientSecret: 'tidak ada di CLI (disimpan di backend)',
+    privateKey: 'tidak ada di CLI (disimpan di backend)',
+    webhookSecret: 'tidak ada di CLI (disimpan di backend)',
+  };
+}

package/plugins/github/credentials.js

@@ -0,0 +1,161 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import crypto from 'node:crypto';
+
+import { GitHubPluginError, GITHUB_CODES } from './errors.js';
+
+/**
+ * Penyimpanan kredensial CLI.
+ *
+ * Yang disimpan HANYA `cliToken` terbitan backend dan cache identitas akun.
+ * Access token/refresh token GitHub tetap di server dan tidak pernah menyentuh
+ * disk CLI. File dienkripsi AES-256-GCM; kunci 32 byte hidup di direktori lain
+ * (`<config>/.keys/github.key`, mode 0600) atau dari `RYUU_GITHUB_KEY`.
+ */
+const KEY_BYTES = 32;
+const MAGIC = 'RYUUGITHB1';
+
+const credentialError = (message, details = null) =>
+  new GitHubPluginError(message, { code: GITHUB_CODES.CREDENTIAL, details });
+
+function decodeEnvKey(raw) {
+  const text = String(raw || '').trim();
+  if (!text) return null;
+  const buffer = /^[0-9a-fA-F]{64}$/.test(text) ? Buffer.from(text, 'hex') : Buffer.from(text, 'base64');
+  if (buffer.length !== KEY_BYTES) {
+    throw credentialError('RYUU_GITHUB_KEY tidak valid: butuh 32 byte (hex 64 karakter atau base64).');
+  }
+  return buffer;
+}
+
+async function readOrCreateKey(keyFile, { env = process.env } = {}) {
+  const fromEnv = decodeEnvKey(env.RYUU_GITHUB_KEY);
+  if (fromEnv) return fromEnv;
+  try {
+    const existing = await fsp.readFile(keyFile);
+    if (existing.length === KEY_BYTES) return existing;
+    throw credentialError(`File kunci GitHub rusak (${keyFile}). Hapus file tersebut lalu jalankan /github login.`);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+  }
+  const key = crypto.randomBytes(KEY_BYTES);
+  await fsp.mkdir(path.dirname(keyFile), { recursive: true, mode: 0o700 });
+  try {
+    await fsp.writeFile(keyFile, key, { mode: 0o600, flag: 'wx' });
+    if (process.platform !== 'win32') await fsp.chmod(keyFile, 0o600).catch(() => {});
+    return key;
+  } catch (error) {
+    if (error.code !== 'EEXIST') throw credentialError(`Gagal menyimpan kunci kredensial GitHub: ${error.message}`);
+    const again = await fsp.readFile(keyFile);
+    if (again.length !== KEY_BYTES) throw credentialError(`File kunci GitHub rusak (${keyFile}).`);
+    return again;
+  }
+}
+
+/** Simpan cliToken + cache akun. Nilai lain dibuang. */
+export async function saveCredentials(
+  { cliToken, ryuuUserId = null, cliTokenExpiresAt = null, account = null, backend = null },
+  { paths, env = process.env } = {},
+) {
+  if (typeof cliToken !== 'string' || !cliToken.startsWith('ghcli_')) {
+    throw credentialError('Token akses CLI tidak valid.');
+  }
+  const payload = {
+    version: 2,
+    cliToken,
+    ryuuUserId: typeof ryuuUserId === 'string' ? ryuuUserId : null,
+    cliTokenExpiresAt: typeof cliTokenExpiresAt === 'string' ? cliTokenExpiresAt : null,
+    backend: typeof backend === 'string' ? backend : null,
+    account: account
+      ? {
+          githubUserId: account.githubUserId || account.id || null,
+          login: account.login || null,
+          name: account.name || null,
+          avatarUrl: account.avatarUrl || null,
+          htmlUrl: account.htmlUrl || null,
+          type: account.type || 'User',
+          scope: account.scope || '',
+        }
+      : null,
+    savedAt: new Date().toISOString(),
+  };
+  const key = await readOrCreateKey(paths.keyFile, { env });
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(JSON.stringify(payload), 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const file = Buffer.concat([Buffer.from(MAGIC, 'utf8'), iv, tag, encrypted]);
+
+  await fsp.mkdir(paths.dir, { recursive: true, mode: 0o700 });
+  const tmp = `${paths.credentialFile}.${process.pid}.${crypto.randomBytes(4).toString('hex')}.tmp`;
+  try {
+    await fsp.writeFile(tmp, file, { mode: 0o600 });
+    await fsp.rename(tmp, paths.credentialFile);
+    if (process.platform !== 'win32') await fsp.chmod(paths.credentialFile, 0o600).catch(() => {});
+  } catch (error) {
+    await fsp.rm(tmp, { force: true }).catch(() => {});
+    throw credentialError(`Gagal menyimpan kredensial GitHub: ${error.message}`);
+  }
+  return { file: paths.credentialFile, savedAt: payload.savedAt };
+}
+
+/** Baca dan dekripsi kredensial; null bila belum login. */
+export async function loadCredentials({ paths, env = process.env } = {}) {
+  let raw;
+  try {
+    raw = await fsp.readFile(paths.credentialFile);
+  } catch (error) {
+    if (error.code === 'ENOENT') return null;
+    if (error.code === 'EACCES' || error.code === 'EPERM') {
+      throw credentialError(`Izin ditolak saat membaca kredensial GitHub (${paths.credentialFile}).`);
+    }
+    throw credentialError(`Gagal membaca kredensial GitHub: ${error.message}`);
+  }
+  if (raw.length < MAGIC.length + 28) throw credentialError('File kredensial GitHub rusak. Jalankan /github login.');
+  if (raw.subarray(0, MAGIC.length).toString('utf8') !== MAGIC) {
+    throw credentialError('Format file kredensial GitHub tidak dikenali. Jalankan /github login.');
+  }
+  let key;
+  try {
+    key = await readOrCreateKey(paths.keyFile, { env });
+  } catch (error) {
+    if (error.code === GITHUB_CODES.CREDENTIAL) throw error;
+    throw credentialError(`Kunci kredensial GitHub tidak tersedia: ${error.message}`);
+  }
+  const iv = raw.subarray(MAGIC.length, MAGIC.length + 12);
+  const tag = raw.subarray(MAGIC.length + 12, MAGIC.length + 28);
+  const body = raw.subarray(MAGIC.length + 28);
+  try {
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    const json = Buffer.concat([decipher.update(body), decipher.final()]).toString('utf8');
+    return JSON.parse(json);
+  } catch {
+    throw credentialError(
+      'Kredensial GitHub tidak dapat didekripsi (kunci berbeda atau file rusak). Jalankan /github login untuk menghubungkan ulang.',
+    );
+  }
+}
+
+/** Hapus kredensial lokal beserta kunci CLI. */
+export async function clearCredentials({ paths, env = process.env } = {}) {
+  await fsp.rm(paths.credentialFile, { force: true });
+  if (!env.RYUU_GITHUB_KEY) await fsp.rm(paths.keyFile, { force: true }).catch(() => {});
+  return true;
+}
+
+/** Metadata aman dicetak: tidak pernah memuat cliToken. */
+export function describeCredentials(stored) {
+  if (!stored) return { connected: false };
+  return {
+    connected: Boolean(stored.cliToken),
+    login: stored.account?.login || null,
+    name: stored.account?.name || null,
+    type: stored.account?.type || null,
+    scope: stored.account?.scope || '',
+    ryuuUserId: stored.ryuuUserId || null,
+    cliTokenExpiresAt: stored.cliTokenExpiresAt || null,
+    backend: stored.backend || null,
+    savedAt: stored.savedAt || null,
+  };
+}

package/plugins/github/errors.js

@@ -0,0 +1,49 @@
+import { RyuuError } from '../../src/utils/errors.js';
+
+/**
+ * Error plugin GitHub.
+ *
+ * Setiap kegagalan membawa `code` yang stabil supaya command bisa memberi
+ * petunjuk yang tepat tanpa memeriksa teks pesan.
+ */
+export class GitHubPluginError extends RyuuError {
+  constructor(message, { code = 'GITHUB_ERROR', status = 0, retryable = false, reconnect = false, details = null } = {}) {
+    super(message, { code, status, retryable, details });
+    this.reconnect = reconnect;
+  }
+}
+
+export const GITHUB_CODES = Object.freeze({
+  DISABLED: 'GITHUB_DISABLED',
+  UNAUTHORIZED: 'GITHUB_UNAUTHORIZED',
+  BUSY: 'GITHUB_BUSY',
+  BACKEND: 'GITHUB_BACKEND',
+  BACKEND_UNREACHABLE: 'GITHUB_BACKEND_UNREACHABLE',
+  SESSION: 'GITHUB_SESSION',
+  LOGIN_TIMEOUT: 'GITHUB_LOGIN_TIMEOUT',
+  CONFIG: 'GITHUB_CONFIG',
+  CREDENTIAL: 'GITHUB_CREDENTIAL',
+  API: 'GITHUB_API',
+  RATE_LIMIT: 'GITHUB_RATE_LIMIT',
+  NOT_FOUND: 'GITHUB_NOT_FOUND',
+  DESTRUCTIVE: 'GITHUB_DESTRUCTIVE_BLOCKED',
+});
+
+/**
+ * Terjemahkan kegagalan backend/GitHub menjadi kalimat Bahasa Indonesia yang
+ * bisa ditindaklanjuti. Tidak pernah menyertakan header, token, atau secret.
+ */
+export function describeFailure(error, { action = 'permintaan' } = {}) {
+  if (!error) return `${action} gagal tanpa keterangan.`;
+  if (error instanceof GitHubPluginError) return error.message;
+  const status = Number(error.status || 0);
+  if (status === 401) return 'Sesi CLI tidak valid atau sudah berakhir. Jalankan /github login lagi.';
+  if (status === 403) return 'Akses ditolak. Periksa permission GitHub App dan instalasinya.';
+  if (status === 404) return 'Data yang diminta tidak ditemukan di GitHub.';
+  if (status === 429) return 'Batas permintaan GitHub tercapai. Coba lagi beberapa saat lagi.';
+  if (status >= 500) return 'Backend atau GitHub sedang bermasalah. Coba lagi nanti.';
+  if (error.code === 'ENOTFOUND' || error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT') {
+    return 'Tidak dapat menghubungi backend integrasi GitHub. Periksa koneksi internet.';
+  }
+  return error.message || `${action} gagal.`;
+}

package/plugins/github/index.js

@@ -0,0 +1,41 @@
+import { createGitHubPlugin } from './manager.js';
+
+export { GitHubPlugin, createGitHubPlugin } from './manager.js';
+export {
+  DEFAULT_GITHUB_CONFIG,
+  EDITABLE_KEYS,
+  GITHUB_BACKEND_URL,
+  GITHUB_CLIENT_ID,
+  describeGitHubConfig,
+  githubPaths,
+  readGitHubConfig,
+  readGitHubState,
+  updateGitHubConfig,
+  validateConfigEntry,
+  writeGitHubConfig,
+} from './config.js';
+export { clearCredentials, describeCredentials, loadCredentials, saveCredentials } from './credentials.js';
+export { GitHubBackendClient } from './backend.js';
+export { GitHubApi } from './api.js';
+export { createGitHubTools } from './tools.js';
+
+/**
+ * Deskriptor plugin untuk host aplikasi.
+ *
+ * Host hanya membutuhkan id/nama, factory, dan `tools`. Tool baru diberikan ke
+ * model setelah plugin enabled DAN authenticated.
+ */
+export const githubPluginDescriptor = Object.freeze({
+  name: 'github',
+  version: '1.0.0',
+  description:
+    'Integrasi GitHub: login akun, repo, issue, pull request, release, dan GitHub Actions lewat backend Ryuu.',
+  command: 'github',
+  dependencies: [],
+});
+
+export function createPlugin(options = {}) {
+  return createGitHubPlugin(options);
+}
+
+export default githubPluginDescriptor;