@tbox.cn/app-sdk-server 0.21.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 tbox.cn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,11 @@
+# @tbox.cn/app-sdk-server
+
+tbox AI Agent 平台 SDK server 轴：agent 引擎（Mastra）、鉴权（统一登录/WS 鉴权/scope 会话）、
+conversation、TTS WS 代理、ASR/上传/反馈哑中继、记忆（BM25 检索层）、技能/工具/出卡管线、
+integrations/provider catalog、dev 平台设施（inspector）。
+
+含 `src/upstream/`：`@tbox-dev-js/sdk` 消费面内化真源（上游冻结，本仓为活真源——行为钉死契约见
+`tests/upstream-fidelity.test.ts` 与 Agent Note 2026-09-20-upstream-internalization）。
+
+公开入口：`.` / `./server` / `./platform`（inspector；bin `tbox-inspector-check` 接线守卫）。
+工具：`npx tbox-inspector-check`（生成应用 platform 接线三态校验）。

package/bin/check-inspector.mjs

@@ -0,0 +1,85 @@
+#!/usr/bin/env node
+/**
+ * tbox-inspector-check — 平台基础设施守卫（随 @tbox.cn/app-sdk-server 分发；code-inspect 面随 @tbox.cn/app-sdk-client）。
+ *
+ * 校验宿主应用的 inspector 接线未被破坏（断言与 src/platform/inspector.ts 头部
+ * 契约声明一一对应；SDK 侧导出/常量自检归 tests/platform-inspector.test.ts）：
+ *   1. apps/server/src/{index,app}.ts 候选任一（同一文件内）从 @tbox.cn/app-sdk-server/platform
+ *      import 并调用 installInspector(app)（候选只增不删：index.ts=单文件布局/存量应用，
+ *      app.ts=入口分离布局——装配主体所在；dev.ts 非候选：有 import 无调用，合取防假阳性）
+ *   2. apps/client/index.html 含 /__vs_inspector__.js 脚本标签
+ *   3. apps/client/vite.config.ts 接入 @tbox.cn/app-sdk-client/platform/code-inspect babel plugin
+ *
+ * 约定：cwd = 应用根（pnpm run 注入保证）。纯 node:fs 实现，零依赖、零 SDK import——
+ * workspace 源态与发布态行为一致。路径断言只增不删（模板布局演进时新旧位置并认）。
+ */
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+
+const appDir = process.cwd();
+const SERVER_ENTRY_CANDIDATES = ['apps/server/src/index.ts', 'apps/server/src/app.ts'];
+const AGENT_HTML = path.join(appDir, 'apps/client/index.html');
+const VITE_CFG = path.join(appDir, 'apps/client/vite.config.ts');
+
+const failures = [];
+
+function checkFile(file, label) {
+  try {
+    return readFileSync(file, 'utf8');
+  } catch {
+    failures.push(`缺失文件 ${label}`);
+    return null;
+  }
+}
+
+// 1. server 入口链：候选任一文件内 import + installInspector(app) 调用合取成立
+// （形态级：调用须为行首语句，防注释文本绕过；合取防 dev.ts 假阳性——有 import 无调用）
+const entrySources = SERVER_ENTRY_CANDIDATES.map((rel) => {
+  const file = path.join(appDir, rel);
+  try {
+    return { content: readFileSync(file, 'utf8') };
+  } catch {
+    return null;
+  }
+});
+if (entrySources.every((s) => s === null)) {
+  failures.push(`缺失文件 ${SERVER_ENTRY_CANDIDATES.join(' | ')}`);
+} else {
+  const wired = entrySources.some(
+    (s) =>
+      s !== null &&
+      /from\s+['"]@tbox\.cn\/(app-sdk-server|app-agent-sdk-server)\/platform['"]/.test(s.content) &&
+      /^\s*installInspector\s*\(\s*app\s*[,)]/m.test(s.content),
+  );
+  if (!wired) {
+    failures.push('server 入口链未接线 installInspector（候选 index.ts/app.ts 均未同时满足 import + 调用）');
+  }
+}
+
+// 2. client 入口页：runtime 脚本标签（RUNTIME_PATH 约定不变；断言标签形态——注释提及不计数）
+const agentHtml = checkFile(AGENT_HTML, 'apps/client/index.html');
+if (agentHtml !== null && !/<script[^>]*src="\/__vs_inspector__\.js"/.test(agentHtml)) {
+  failures.push('apps/client/index.html 缺少 /__vs_inspector__.js 脚本标签');
+}
+
+// 3. vite：code-inspect plugin 接入（断言 import 语句形态，防注释绕过）
+const viteCfg = checkFile(VITE_CFG, 'apps/client/vite.config.ts');
+if (
+  viteCfg !== null &&
+  !/from\s+['"]@tbox\.cn\/(app-sdk-client|app-agent-sdk-client)\/platform\/code-inspect['"]/.test(viteCfg)
+) {
+  failures.push('apps/client/vite.config.ts 未接入 code-inspect plugin');
+}
+
+if (failures.length > 0) {
+  console.error('');
+  console.error('❌ [tbox-inspector-check] 平台基础设施校验失败：');
+  for (const f of failures) console.error(`  - ${f}`);
+  console.error('');
+  console.error('   tbox 平台微调能力（点选元素 → 写入聊天框）是平台基础设施，AI agent 不得删除。');
+  console.error('   接线契约见 @tbox.cn/app-sdk-server/src/platform/inspector.ts 头部声明；模板参考布局（apps/*）。');
+  console.error('');
+  process.exitCode = 1;
+} else {
+  console.log('✅ [tbox-inspector-check] 平台基础设施校验通过');
+}

package/dist/platform/index.d.ts

@@ -0,0 +1,9 @@
+import { Express } from 'express';
+
+declare const RUNTIME_PATH = "/__vs_inspector__.js";
+declare const SCRIPT_TAG = "<script src=\"/__vs_inspector__.js\" defer></script>";
+declare function injectScript(html: string): string;
+declare function isReady(): boolean;
+declare function installInspector(app: Express): void;
+
+export { RUNTIME_PATH, SCRIPT_TAG, injectScript, installInspector, isReady };

package/dist/platform/index.js

@@ -0,0 +1 @@
+var m="https://env-00jx4e7pq1un-static.normal.cloudstatic.cn/asset/codingbox/inspector.umd.js",f="/__vs_inspector__.js",d=`<script src="${f}" defer></script>`,a="",l=!1;async function w(t=3){for(let r=0;r<t;r++)try{let e=await fetch(m);if(!e.ok)throw new Error(`HTTP ${e.status}`);a=await e.text(),l=!0,console.log(`[inspector] runtime loaded (${a.length} bytes)`);return}catch(e){console.warn(`[inspector] fetch failed (attempt ${r+1}/${t}):`,e.message),r<t-1&&await new Promise(c=>setTimeout(c,1e3*(r+1)))}console.error("[inspector] runtime unavailable; inspector script will be skipped")}function x(t){if(t.includes(f))return t;let r=t.search(/<\/head\s*>/i);if(r!==-1)return t.slice(0,r)+d+t.slice(r);let e=t.search(/<body[\s>]/i);return e!==-1?t.slice(0,e)+d+t.slice(e):t}function T(){return l}function _(t){w(),t.get(f,(r,e)=>{if(!a){e.status(503).type("application/javascript").send("// inspector runtime not ready");return}e.type("application/javascript").set("Cache-Control","no-cache").send(a)}),t.use((r,e,c)=>{if(!l)return c();let s=[],R=e.write.bind(e),u=e.end.bind(e),o=!1,g=()=>{let n=String(e.getHeader("content-type")||""),i=String(e.getHeader("content-encoding")||"");return n.includes("text/html")&&!i};e.write=((n,...i)=>(!o&&!s.length&&(o=g()),o&&n?(s.push(Buffer.isBuffer(n)?n:Buffer.from(n)),!0):R(n,...i))),e.end=((n,...i)=>{if(!o&&!s.length&&(o=g()),o){n&&s.push(Buffer.isBuffer(n)?n:Buffer.from(n));try{let p=Buffer.concat(s).toString("utf8"),y=x(p);return e.setHeader("Content-Length",Buffer.byteLength(y)),u(y,...i)}catch(p){return console.warn("[inspector] inject failed, fallback to original:",p.message),u(Buffer.concat(s),...i)}}return u(n,...i)}),c()})}export{f as RUNTIME_PATH,d as SCRIPT_TAG,x as injectScript,_ as installInspector,T as isReady};