@talex-touch/utils 1.0.40 → 1.0.44

package/permission/registry.ts

@@ -0,0 +1,304 @@
+/**
+ * Permission Registry
+ *
+ * Defines all available permissions in the system.
+ */
+
+import type { PermissionDefinition } from './types'
+import { PermissionCategory, PermissionRiskLevel } from './types'
+
+/**
+ * All permission definitions
+ */
+export const PERMISSIONS: PermissionDefinition[] = [
+  // Filesystem permissions
+  {
+    id: 'fs.read',
+    category: PermissionCategory.FILESYSTEM,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.fs.read.name',
+    descKey: 'permission.fs.read.desc',
+    icon: 'FileText',
+  },
+  {
+    id: 'fs.write',
+    category: PermissionCategory.FILESYSTEM,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.fs.write.name',
+    descKey: 'permission.fs.write.desc',
+    icon: 'FilePen',
+  },
+  {
+    id: 'fs.execute',
+    category: PermissionCategory.FILESYSTEM,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.fs.execute.name',
+    descKey: 'permission.fs.execute.desc',
+    icon: 'Terminal',
+  },
+  {
+    id: 'fs.tfile',
+    category: PermissionCategory.FILESYSTEM,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.fs.tfile.name',
+    descKey: 'permission.fs.tfile.desc',
+    icon: 'FileText',
+  },
+
+  // Clipboard permissions
+  {
+    id: 'clipboard.read',
+    category: PermissionCategory.CLIPBOARD,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.clipboard.read.name',
+    descKey: 'permission.clipboard.read.desc',
+    icon: 'ClipboardCopy',
+  },
+  {
+    id: 'clipboard.write',
+    category: PermissionCategory.CLIPBOARD,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.clipboard.write.name',
+    descKey: 'permission.clipboard.write.desc',
+    icon: 'ClipboardPaste',
+  },
+
+  // Network permissions
+  {
+    id: 'network.local',
+    category: PermissionCategory.NETWORK,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.network.local.name',
+    descKey: 'permission.network.local.desc',
+    icon: 'Wifi',
+  },
+  {
+    id: 'network.internet',
+    category: PermissionCategory.NETWORK,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.network.internet.name',
+    descKey: 'permission.network.internet.desc',
+    icon: 'Globe',
+  },
+  {
+    id: 'network.download',
+    category: PermissionCategory.NETWORK,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.network.download.name',
+    descKey: 'permission.network.download.desc',
+    icon: 'Download',
+  },
+
+  // System permissions
+  {
+    id: 'system.shell',
+    category: PermissionCategory.SYSTEM,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.system.shell.name',
+    descKey: 'permission.system.shell.desc',
+    icon: 'Terminal',
+  },
+  {
+    id: 'system.notification',
+    category: PermissionCategory.SYSTEM,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.system.notification.name',
+    descKey: 'permission.system.notification.desc',
+    icon: 'Bell',
+  },
+  {
+    id: 'system.tray',
+    category: PermissionCategory.SYSTEM,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.system.tray.name',
+    descKey: 'permission.system.tray.desc',
+    icon: 'PanelTop',
+  },
+
+  // Intelligence permissions
+  {
+    id: 'intelligence.basic',
+    category: PermissionCategory.INTELLIGENCE,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.intelligence.basic.name',
+    descKey: 'permission.intelligence.basic.desc',
+    icon: 'Bot',
+  },
+  {
+    id: 'intelligence.admin',
+    category: PermissionCategory.INTELLIGENCE,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.intelligence.admin.name',
+    descKey: 'permission.intelligence.admin.desc',
+    icon: 'Shield',
+  },
+  {
+    id: 'intelligence.agents',
+    category: PermissionCategory.INTELLIGENCE,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.intelligence.agents.name',
+    descKey: 'permission.intelligence.agents.desc',
+    icon: 'Users',
+  },
+
+  // Storage permissions
+  {
+    id: 'storage.plugin',
+    category: PermissionCategory.STORAGE,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.storage.plugin.name',
+    descKey: 'permission.storage.plugin.desc',
+    icon: 'Database',
+  },
+  {
+    id: 'storage.shared',
+    category: PermissionCategory.STORAGE,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.storage.shared.name',
+    descKey: 'permission.storage.shared.desc',
+    icon: 'Share2',
+  },
+  {
+    id: 'storage.sqlite',
+    category: PermissionCategory.STORAGE,
+    risk: PermissionRiskLevel.MEDIUM,
+    nameKey: 'permission.storage.sqlite.name',
+    descKey: 'permission.storage.sqlite.desc',
+    icon: 'Database',
+  },
+
+  // Window permissions
+  {
+    id: 'window.create',
+    category: PermissionCategory.WINDOW,
+    risk: PermissionRiskLevel.LOW,
+    nameKey: 'permission.window.create.name',
+    descKey: 'permission.window.create.desc',
+    icon: 'AppWindow',
+  },
+  {
+    id: 'window.capture',
+    category: PermissionCategory.WINDOW,
+    risk: PermissionRiskLevel.HIGH,
+    nameKey: 'permission.window.capture.name',
+    descKey: 'permission.window.capture.desc',
+    icon: 'Camera',
+  },
+]
+
+export function normalizePermissionId(id: string): string {
+  return id
+}
+
+export function getPermissionIdCandidates(id: string): string[] {
+  return [normalizePermissionId(id)]
+}
+
+/**
+ * Permission registry class
+ */
+export class PermissionRegistry {
+  private permissions: Map<string, PermissionDefinition> = new Map()
+
+  constructor() {
+    // Register all built-in permissions
+    PERMISSIONS.forEach((p) => this.permissions.set(normalizePermissionId(p.id), p))
+  }
+
+  /**
+   * Get permission definition by ID
+   */
+  get(id: string): PermissionDefinition | undefined {
+    return this.permissions.get(normalizePermissionId(id))
+  }
+
+  /**
+   * Get all permissions
+   */
+  all(): PermissionDefinition[] {
+    return Array.from(this.permissions.values())
+  }
+
+  /**
+   * Get permissions by category
+   */
+  byCategory(category: PermissionCategory): PermissionDefinition[] {
+    return this.all().filter(p => p.category === category)
+  }
+
+  /**
+   * Get permissions by risk level
+   */
+  byRisk(risk: PermissionRiskLevel): PermissionDefinition[] {
+    return this.all().filter(p => p.risk === risk)
+  }
+
+  /**
+   * Check if permission exists
+   */
+  has(id: string): boolean {
+    return this.permissions.has(normalizePermissionId(id))
+  }
+
+  /**
+   * Register custom permission
+   */
+  register(permission: PermissionDefinition): void {
+    this.permissions.set(normalizePermissionId(permission.id), permission)
+  }
+}
+
+/**
+ * Singleton permission registry
+ */
+export const permissionRegistry = new PermissionRegistry()
+
+/**
+ * Permission ID constants for type safety
+ */
+export const PermissionIds = {
+  // Filesystem
+  FS_READ: 'fs.read',
+  FS_WRITE: 'fs.write',
+  FS_EXECUTE: 'fs.execute',
+  FS_TFILE: 'fs.tfile',
+
+  // Clipboard
+  CLIPBOARD_READ: 'clipboard.read',
+  CLIPBOARD_WRITE: 'clipboard.write',
+
+  // Network
+  NETWORK_LOCAL: 'network.local',
+  NETWORK_INTERNET: 'network.internet',
+  NETWORK_DOWNLOAD: 'network.download',
+
+  // System
+  SYSTEM_SHELL: 'system.shell',
+  SYSTEM_NOTIFICATION: 'system.notification',
+  SYSTEM_TRAY: 'system.tray',
+
+  // Intelligence
+  INTELLIGENCE_BASIC: 'intelligence.basic',
+  INTELLIGENCE_ADMIN: 'intelligence.admin',
+  INTELLIGENCE_AGENTS: 'intelligence.agents',
+
+  // Storage
+  STORAGE_PLUGIN: 'storage.plugin',
+  STORAGE_SHARED: 'storage.shared',
+  STORAGE_SQLITE: 'storage.sqlite',
+
+  // Window
+  WINDOW_CREATE: 'window.create',
+  WINDOW_CAPTURE: 'window.capture',
+} as const
+
+export type PermissionId = (typeof PermissionIds)[keyof typeof PermissionIds]
+
+/**
+ * Default permissions that are auto-granted
+ */
+export const DEFAULT_PERMISSIONS: string[] = [
+  PermissionIds.STORAGE_PLUGIN,
+  PermissionIds.CLIPBOARD_WRITE,
+  PermissionIds.WINDOW_CREATE,
+]

package/permission/types.ts

@@ -0,0 +1,164 @@
+/**
+ * Permission System Types
+ *
+ * Defines the permission model for plugin security.
+ */
+
+/**
+ * Permission category
+ */
+export enum PermissionCategory {
+  FILESYSTEM = 'fs',
+  CLIPBOARD = 'clipboard',
+  NETWORK = 'network',
+  SYSTEM = 'system',
+  INTELLIGENCE = 'intelligence',
+  STORAGE = 'storage',
+  WINDOW = 'window',
+}
+
+/**
+ * Risk level for permissions
+ */
+export enum PermissionRiskLevel {
+  LOW = 'low',
+  MEDIUM = 'medium',
+  HIGH = 'high',
+}
+
+/**
+ * Permission definition
+ */
+export interface PermissionDefinition {
+  /** Permission ID (e.g., 'fs.read') */
+  id: string
+  /** Category */
+  category: PermissionCategory
+  /** Risk level */
+  risk: PermissionRiskLevel
+  /** i18n key for display name */
+  nameKey: string
+  /** i18n key for description */
+  descKey: string
+  /** Icon name (lucide icon) */
+  icon?: string
+}
+
+/**
+ * Permission grant record
+ */
+export interface PermissionGrant {
+  /** Plugin ID */
+  pluginId: string
+  /** Permission ID */
+  permissionId: string
+  /** Grant timestamp */
+  grantedAt: number
+  /** How it was granted */
+  grantedBy: 'user' | 'auto' | 'trust'
+  /** Expiration timestamp (optional) */
+  expiresAt?: number
+}
+
+/**
+ * Permission denial record
+ */
+export interface PermissionDenial {
+  /** Plugin ID */
+  pluginId: string
+  /** Permission ID */
+  permissionId: string
+  /** Denial timestamp */
+  deniedAt: number
+  /** Reason for denial */
+  reason?: string
+}
+
+/**
+ * Permission check result
+ */
+export interface PermissionCheckResult {
+  /** Permission ID */
+  permissionId: string
+  /** Whether permission is granted */
+  granted: boolean
+  /** Grant details if granted */
+  grant?: PermissionGrant
+  /** Whether enforcement is active (sdkapi check) */
+  enforced: boolean
+  /** Warning message if any */
+  warning?: string
+}
+
+/**
+ * Plugin permission status
+ */
+export interface PluginPermissionStatus {
+  /** Plugin ID */
+  pluginId: string
+  /** SDK API version */
+  sdkapi?: number
+  /** Whether permission enforcement is active */
+  enforcePermissions: boolean
+  /** Required permissions from manifest */
+  required: string[]
+  /** Optional permissions from manifest */
+  optional: string[]
+  /** Granted permissions */
+  granted: string[]
+  /** Denied permissions */
+  denied: string[]
+  /** Missing required permissions */
+  missingRequired: string[]
+  /** Compatibility warning */
+  warning?: string
+}
+
+/**
+ * Permission request for UI prompt
+ */
+export interface PermissionRequest {
+  /** Plugin ID */
+  pluginId: string
+  /** Plugin display name */
+  pluginName: string
+  /** Permission ID */
+  permissionId: string
+  /** Reason from manifest */
+  reason?: string
+  /** Context of the request */
+  context?: Record<string, unknown>
+}
+
+/**
+ * Audit log entry
+ */
+export interface PermissionAuditLog {
+  /** Log ID */
+  id: string
+  /** Timestamp */
+  timestamp: number
+  /** Plugin ID */
+  pluginId: string
+  /** Permission ID */
+  permissionId: string
+  /** Action type */
+  action: 'granted' | 'denied' | 'revoked' | 'used' | 'blocked'
+  /** Additional context */
+  context?: Record<string, unknown>
+}
+
+/**
+ * Manifest permission declaration
+ */
+export interface ManifestPermissions {
+  /** Required permissions - plugin won't work without these */
+  required?: string[]
+  /** Optional permissions - can be granted later */
+  optional?: string[]
+}
+
+/**
+ * Permission reasons in manifest
+ */
+export type ManifestPermissionReasons = Record<string, string>

package/plugin/channel.ts

@@ -9,25 +9,45 @@ import {
   ChannelType,
   DataCode,
 } from '../channel'
+import { getLogger } from '../common/logger'
+import { findCloneIssue, isCloneError, summarizeClonePayload } from '../common/utils/clone-diagnostics'
+import { formatPayloadPreview } from '../common/utils/payload-preview'
+import { hasWindow } from '../env'
 
-const CHANNEL_DEFAULT_TIMEOUT = 10_000
+const CHANNEL_DEFAULT_TIMEOUT = 60_000
 
 let cachedIpcRenderer: IpcRenderer | null = null
+const channelLog = getLogger('plugin-channel')
+
+type PluginWindow = Window & {
+  $plugin?: { name?: string }
+  $channel?: ITouchClientChannel
+  electron?: { ipcRenderer?: IpcRenderer }
+}
+
+function getPluginWindow(): PluginWindow | undefined {
+  return hasWindow() ? (window as unknown as PluginWindow) : undefined
+}
 
 // 使用惰性解析避免在打包阶段静态引入 electron
 function resolveIpcRenderer(): IpcRenderer | null {
-  if (typeof window !== 'undefined') {
-    const bridge = (window as any)?.electron
-    if (bridge?.ipcRenderer)
-      return bridge.ipcRenderer as IpcRenderer
-  }
+  const globalWindow = getPluginWindow()
+  if (globalWindow?.electron?.ipcRenderer)
+    return globalWindow.electron.ipcRenderer as IpcRenderer
 
   try {
-    const electron = (globalThis as any)?.electron ?? (eval('require') as any)?.('electron')
-    if (electron?.ipcRenderer)
-      return electron.ipcRenderer as IpcRenderer
+    const electronFromGlobal = (globalThis as any)?.electron
+    if (electronFromGlobal?.ipcRenderer)
+      return electronFromGlobal.ipcRenderer as IpcRenderer
+
+    const requireFromGlobal = (globalThis as any)?.require
+    if (typeof requireFromGlobal === 'function') {
+      const electron = requireFromGlobal('electron')
+      if (electron?.ipcRenderer)
+        return electron.ipcRenderer as IpcRenderer
+    }
   }
-  catch (error) {
+  catch {
     // ignore – will throw below if no ipcRenderer is resolved
   }
 
@@ -46,14 +66,17 @@ function ensureIpcRenderer(): IpcRenderer {
   return cachedIpcRenderer
 }
 
+type ChannelListener = (data: StandardChannelData) => unknown
+type PendingCallback = (data: RawStandardChannelData) => void
+
 /**
  * @deprecated This class is deprecated and will be removed in the future.
  * Due to the new secret system, ipc message transmission should unique Key, and will inject when ui view attached.
  */
 class TouchChannel implements ITouchClientChannel {
-  channelMap: Map<string, Function[]> = new Map()
+  channelMap: Map<string, ChannelListener[]> = new Map()
 
-  pendingMap: Map<string, Function> = new Map()
+  pendingMap: Map<string, PendingCallback> = new Map()
 
   plugin: string
 
@@ -66,7 +89,7 @@ class TouchChannel implements ITouchClientChannel {
   }
 
   __parse_raw_data(e: IpcRendererEvent | undefined, arg: any): RawStandardChannelData | null {
-    console.debug('Raw data: ', arg, e)
+    channelLog.debug('Raw data', { meta: { payload: formatPayloadPreview(arg) } })
     if (arg) {
       const { name, header, code, data, sync } = arg
 
@@ -86,7 +109,7 @@ class TouchChannel implements ITouchClientChannel {
       }
     }
 
-    console.error(e, arg)
+    channelLog.error('Invalid message payload', { error: { event: e, payload: arg } })
     return null
     // throw new Error("Invalid message!");
   }
@@ -154,7 +177,7 @@ class TouchChannel implements ITouchClientChannel {
 
   regChannel(
     eventName: string,
-    callback: Function,
+    callback: ChannelListener,
   ): () => void {
     const listeners = this.channelMap.get(eventName) || []
 
@@ -176,7 +199,7 @@ class TouchChannel implements ITouchClientChannel {
     }
   }
 
-  unRegChannel(eventName: string, callback: Function): boolean {
+  unRegChannel(eventName: string, callback: ChannelListener): boolean {
     const listeners = this.channelMap.get(eventName)
 
     if (!listeners) {
@@ -200,16 +223,7 @@ class TouchChannel implements ITouchClientChannel {
   }
 
   private formatPayloadPreview(payload: unknown): string {
-    if (payload === null || payload === undefined)
-      return String(payload)
-    if (typeof payload === 'string')
-      return payload.length > 200 ? `${payload.slice(0, 200)}…` : payload
-    try {
-      return JSON.stringify(payload)
-    }
-    catch {
-      return '[unserializable]'
-    }
+    return formatPayloadPreview(payload)
   }
 
   send(eventName: string, arg: any): Promise<any> {
@@ -239,13 +253,20 @@ class TouchChannel implements ITouchClientChannel {
       }
       catch (error) {
         const errorMessage = error instanceof Error ? error.message : String(error)
-        console.error(
-          `[PluginChannel] Failed to send "${eventName}": ${errorMessage}`,
-          { payloadPreview: this.formatPayloadPreview(arg) },
-        )
+        const meta: Record<string, unknown> = {
+          payloadPreview: this.formatPayloadPreview(arg)
+        }
+        if (isCloneError(error)) {
+          meta.cloneIssue = findCloneIssue(arg)
+          meta.payloadSummary = summarizeClonePayload(arg)
+        }
+        channelLog.error(`Failed to send \"${eventName}\": ${errorMessage}`, {
+          meta,
+          error,
+        })
         reject(
           Object.assign(
-            new Error(`Failed to send plugin channel message "${eventName}": ${errorMessage}`),
+            new Error(`Failed to send plugin channel message \"${eventName}\": ${errorMessage}`),
             { code: 'plugin_channel_send_failed' },
           ),
         )
@@ -258,10 +279,10 @@ class TouchChannel implements ITouchClientChannel {
           return
         this.pendingMap.delete(uniqueId)
         const timeoutError = Object.assign(
-          new Error(`Plugin channel request "${eventName}" timed out after ${timeoutMs}ms`),
+          new Error(`Plugin channel request \"${eventName}\" timed out after ${timeoutMs}ms`),
           { code: 'plugin_channel_timeout' },
         )
-        console.warn(timeoutError.message)
+        channelLog.warn(timeoutError.message)
         reject(timeoutError)
       }, timeoutMs)
 
@@ -299,12 +320,19 @@ class TouchChannel implements ITouchClientChannel {
     }
     catch (error) {
       const errorMessage = error instanceof Error ? error.message : String(error)
-      console.error('[PluginChannel] Failed to sendSync message', {
+      const meta: Record<string, unknown> = {
         eventName,
-        error: errorMessage,
         payloadPreview: this.formatPayloadPreview(arg),
+      }
+      if (isCloneError(error)) {
+        meta.cloneIssue = findCloneIssue(arg)
+        meta.payloadSummary = summarizeClonePayload(arg)
+      }
+      channelLog.error('Failed to sendSync message', {
+        meta,
+        error,
       })
-      throw new Error(`Failed to sendSync plugin channel message "${eventName}": ${errorMessage}`)
+      throw new Error(`Failed to sendSync plugin channel message \"${eventName}\": ${errorMessage}`)
     }
   }
 }
@@ -313,13 +341,14 @@ let touchChannel: ITouchClientChannel | null = null
 
 export function genChannel(): ITouchClientChannel {
   if (!touchChannel) {
-    if (typeof window === 'undefined' || !(window as any)?.$plugin?.name) {
+    const globalWindow = getPluginWindow()
+    const pluginName = globalWindow?.$plugin?.name
+    if (!globalWindow || !pluginName) {
       throw new Error('TouchChannel cannot be initialized outside plugin renderer context')
     }
 
-    const pluginName = (window as any).$plugin.name as string
     touchChannel = new TouchChannel(pluginName)
-    ;(window as any).$channel = touchChannel
+    globalWindow.$channel = touchChannel
   }
 
   return touchChannel