@tbrandenburg/node-red-agents 0.1.1

package/nodes/gh/gh.js

@@ -0,0 +1,237 @@
+'use strict';
+
+const { spawn } = require('child_process');
+const { parseArgs } = require('./lib/parse-args');
+
+const GH_BINARY = 'gh';
+const DEFAULT_TIMEOUT_MS = 60000;
+
+// Resolves a typed-input style config field (str/msg/flow/global), honoring
+// the Node-RED typedInput convention used elsewhere in this repo (see
+// opencode-run.js's prompt/cwd handling). An empty 'str' path is treated as
+// "not configured" rather than an evaluation error.
+function evalField(RED, node, msg, value, type) {
+    if (type === 'str' && (value === undefined || value === null || value === '')) {
+        return undefined;
+    }
+    return RED.util.evaluateNodeProperty(value, type, node, msg);
+}
+
+// A valid gh top-level command is a single token (e.g. "pr", "issue",
+// "api") -- never the literal "gh" itself and never something containing
+// whitespace (which would indicate a whole command line was pasted in).
+function validateCommand(command) {
+    if (typeof command !== 'string' || command.trim() === '') {
+        return 'no command configured (set the Command field or msg.gh.command)';
+    }
+    const trimmed = command.trim();
+    if (/\s/.test(trimmed)) {
+        return 'Command must be a single gh subcommand (e.g. "pr"), not a full command line: "' + trimmed + '"';
+    }
+    if (trimmed.toLowerCase() === 'gh') {
+        return '"gh" is the executable itself, not a command -- use e.g. "pr" with gh already implied';
+    }
+    return null;
+}
+
+// Resolves an "args" value (from config or msg.gh.args) into a string[].
+// Strings are tokenized (quote-aware, no shell evaluation); arrays are used
+// as-is (each element coerced to a string); anything else is rejected.
+function resolveArgs(value) {
+    if (value === undefined || value === null) return [];
+    if (Array.isArray(value)) return value.map(String);
+    if (typeof value === 'string') return parseArgs(value);
+    throw new Error('args must be a string or an array of strings, got ' + typeof value);
+}
+
+module.exports = function (RED) {
+    function GhNode(config) {
+        RED.nodes.createNode(this, config);
+        const node = this;
+
+        node.command = config.command || '';
+        node.commandType = config.commandType || 'str';
+        node.args = config.args || '';
+        node.argsType = config.argsType || 'str';
+        node.repo = config.repo || '';
+        node.repoType = config.repoType || 'str';
+        node.host = config.host || '';
+        node.timeoutMs = Number(config.timeoutMs) || DEFAULT_TIMEOUT_MS;
+
+        node.on('input', function (msg, send, done) {
+            const ghOverride = (msg.gh && typeof msg.gh === 'object') ? msg.gh : {};
+
+            // --- command ---
+            let command;
+            try {
+                command = Object.prototype.hasOwnProperty.call(ghOverride, 'command')
+                    ? ghOverride.command
+                    : evalField(RED, node, msg, node.command, node.commandType);
+            } catch (err) {
+                node.status({ fill: 'red', shape: 'ring', text: 'bad command config' });
+                done(err);
+                return;
+            }
+
+            const commandError = validateCommand(command);
+            if (commandError) {
+                node.status({ fill: 'red', shape: 'ring', text: 'bad command' });
+                done(new Error('gh: ' + commandError));
+                return;
+            }
+            command = command.trim();
+
+            // --- args ---
+            let rawArgs;
+            try {
+                rawArgs = Object.prototype.hasOwnProperty.call(ghOverride, 'args')
+                    ? ghOverride.args
+                    : evalField(RED, node, msg, node.args, node.argsType);
+            } catch (err) {
+                node.status({ fill: 'red', shape: 'ring', text: 'bad args config' });
+                done(err);
+                return;
+            }
+
+            let args;
+            try {
+                args = resolveArgs(rawArgs);
+            } catch (err) {
+                node.status({ fill: 'red', shape: 'ring', text: 'bad args' });
+                done(new Error('gh: ' + err.message));
+                return;
+            }
+
+            // --- repo ---
+            let repo;
+            try {
+                repo = Object.prototype.hasOwnProperty.call(ghOverride, 'repo')
+                    ? ghOverride.repo
+                    : evalField(RED, node, msg, node.repo, node.repoType);
+            } catch (err) {
+                node.status({ fill: 'red', shape: 'ring', text: 'bad repo config' });
+                done(err);
+                return;
+            }
+            repo = (repo === undefined || repo === null || repo === '') ? undefined : String(repo);
+
+            // --- host (Advanced; simple str field, no typed input) ---
+            const host = ghOverride.host || node.host || undefined;
+
+            node.status({ fill: 'blue', shape: 'dot', text: 'running ' + command });
+
+            const env = Object.assign({}, process.env);
+            if (repo) env.GH_REPO = repo;
+            if (host) env.GH_HOST = host;
+
+            let stdout = '';
+            let stderr = '';
+            let child;
+            try {
+                child = spawn(GH_BINARY, [command, ...args], {
+                    env,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                    shell: false
+                });
+            } catch (err) {
+                node.status({ fill: 'red', shape: 'ring', text: 'spawn failed' });
+                done(err);
+                return;
+            }
+
+            // Own explicit timeout instead of spawn()'s built-in timeout
+            // option: it's simpler to reason about (we control exactly when
+            // the timer is armed/cleared) and sidesteps that option's timer
+            // not always being cleared promptly when the child never
+            // actually starts (e.g. ENOENT).
+            let timedOut = false;
+            const timer = setTimeout(() => {
+                timedOut = true;
+                child.kill('SIGTERM');
+            }, node.timeoutMs);
+            if (typeof timer.unref === 'function') timer.unref();
+
+            child.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
+            child.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
+
+            child.on('error', (err) => {
+                clearTimeout(timer);
+                node.status({ fill: 'red', shape: 'ring', text: 'error' });
+                const message = (err && err.code === 'ENOENT')
+                    ? 'gh executable not found on PATH'
+                    : 'failed to run gh: ' + err.message;
+                const wrapped = new Error('gh: ' + message);
+                wrapped.command = command;
+                wrapped.args = args;
+                done(wrapped);
+            });
+
+            child.on('close', (code, signal) => {
+                clearTimeout(timer);
+                if (signal) {
+                    node.status({ fill: 'red', shape: 'ring', text: timedOut ? 'timeout' : 'killed' });
+                    const err = new Error(
+                        timedOut
+                            ? 'gh: timed out after ' + node.timeoutMs + 'ms and was killed'
+                            : 'gh: process killed by signal ' + signal
+                    );
+                    err.command = command;
+                    err.args = args;
+                    err.signal = signal;
+                    err.timedOut = timedOut;
+                    done(err);
+                    return;
+                }
+
+                if (code !== 0) {
+                    node.status({ fill: 'red', shape: 'dot', text: 'exit ' + code });
+                    const err = new Error(
+                        'gh: command failed (exit ' + code + ')' + (stderr.trim() ? ': ' + stderr.trim() : '')
+                    );
+                    err.command = command;
+                    err.args = args;
+                    err.exitCode = code;
+                    err.stderr = stderr.trim();
+                    done(err);
+                    return;
+                }
+
+                const text = stdout.replace(/\r?\n$/, '');
+                let payload;
+                try {
+                    payload = JSON.parse(text.trim());
+                } catch (e) {
+                    payload = text;
+                }
+
+                msg.payload = payload;
+                msg.gh = {
+                    command,
+                    args,
+                    repo: repo || '',
+                    host: host || '',
+                    exitCode: 0,
+                    stderr: stderr.trim()
+                };
+
+                node.status({ fill: 'green', shape: 'dot', text: 'done' });
+                const clearStatus = setTimeout(() => node.status({}), 2000);
+                if (typeof clearStatus.unref === 'function') clearStatus.unref();
+                send(msg);
+                done();
+            });
+
+            node._child = child;
+        });
+
+        node.on('close', function (done) {
+            if (node._child && !node._child.killed) {
+                node._child.kill();
+            }
+            node.status({});
+            done();
+        });
+    }
+
+    RED.nodes.registerType('gh', GhNode);
+};

package/nodes/gh/icons/gh.svg

@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 40 60">
+  <!--
+    Node-RED custom node icon requirements (docs/creating-nodes/appearance.md):
+    white on transparent background, 2:3 aspect ratio, >= 40x60px (same
+    convention as nodes/agent/icons/agent.svg).
+
+    Artwork is the GitHub "octocat" mark from the Simple Icons project
+    (https://simpleicons.org/, CC0-1.0 license, public domain, free to
+    redistribute), recolored white and centered in the 40x60 canvas.
+    Original 24x24 path source: https://cdn.simpleicons.org/github/ffffff
+  -->
+  <g fill="#ffffff" transform="translate(4,14) scale(1.3333)">
+    <path d="M12 .297c-6.63 0-12 5.373-12 12 0 5.303 3.438 9.8 8.205 11.385.6.113.82-.258.82-.577 0-.285-.01-1.04-.015-2.04-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729 1.205.084 1.838 1.236 1.838 1.236 1.07 1.835 2.809 1.305 3.495.998.108-.776.417-1.305.76-1.605-2.665-.3-5.466-1.332-5.466-5.93 0-1.31.465-2.38 1.235-3.22-.135-.303-.54-1.523.105-3.176 0 0 1.005-.322 3.3 1.23.96-.267 1.98-.399 3-.405 1.02.006 2.04.138 3 .405 2.28-1.552 3.285-1.23 3.285-1.23.645 1.653.24 2.873.12 3.176.765.84 1.23 1.91 1.23 3.22 0 4.61-2.805 5.625-5.475 5.92.42.36.81 1.096.81 2.22 0 1.606-.015 2.896-.015 3.286 0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12"/>
+  </g>
+</svg>

package/nodes/gh/lib/parse-args.js

@@ -0,0 +1,67 @@
+'use strict';
+
+// Splits a string of gh CLI arguments into an argv array without any shell
+// evaluation. Single- and double-quoted spans are kept as one argument
+// (quotes themselves are stripped); everything else -- including shell
+// metacharacters like &&, |, ;, `, $() -- is passed through as literal
+// characters, never interpreted.
+//
+// Examples:
+//   'list --state open'                  -> ['list', '--state', 'open']
+//   'list --label "needs review"'        -> ['list', '--label', 'needs review']
+//   'pr list && rm -rf /'                -> ['pr', 'list', '&&', 'rm', '-rf', '/']
+function parseArgs(str) {
+    if (str === undefined || str === null) return [];
+    if (typeof str !== 'string') {
+        throw new Error('parseArgs: expected a string, got ' + typeof str);
+    }
+
+    const args = [];
+    let current = '';
+    let inArg = false;
+    let quote = null; // '"' or "'" while inside a quoted span
+
+    for (let i = 0; i < str.length; i += 1) {
+        const ch = str[i];
+
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            } else {
+                current += ch;
+            }
+            continue;
+        }
+
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            inArg = true;
+            continue;
+        }
+
+        if (ch === ' ' || ch === '\t' || ch === '\n' || ch === '\r') {
+            if (inArg) {
+                args.push(current);
+                current = '';
+                inArg = false;
+            }
+            continue;
+        }
+
+        current += ch;
+        inArg = true;
+    }
+
+    if (quote) {
+        // Unterminated quote: fail safe by treating the rest of the
+        // string as literal content rather than throwing, since this is
+        // config text a user can fix, not something to crash a flow over.
+        args.push(current);
+    } else if (inArg) {
+        args.push(current);
+    }
+
+    return args;
+}
+
+module.exports = { parseArgs };

package/package.json

@@ -0,0 +1,60 @@
+{
+  "name": "@tbrandenburg/node-red-agents",
+  "version": "0.1.1",
+  "description": "Node-RED nodes for running coding agents (opencode, pi) and GitHub CLI operations from flows.",
+  "keywords": [
+    "node-red",
+    "agent",
+    "ai-agent",
+    "opencode",
+    "pi",
+    "coding-agent",
+    "sandbox",
+    "srt",
+    "ai",
+    "llm",
+    "github",
+    "gh",
+    "github-cli"
+  ],
+  "homepage": "https://github.com/tbrandenburg/node-red-agents#readme",
+  "bugs": {
+    "url": "https://github.com/tbrandenburg/node-red-agents/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tbrandenburg/node-red-agents.git",
+    "directory": "packages/node-red-agents"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "nodes/**/*.js",
+    "nodes/**/*.html",
+    "nodes/**/icons/**",
+    "nodes/**/examples/**",
+    "nodes/gh/README.md",
+    "shared/**/*.js",
+    "!**/test/**",
+    "!**/fixtures/**"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "scripts": {
+    "test": "node --test --experimental-test-coverage=false 'nodes/**/test/**/*.spec.js' 'shared/**/test/**/*.spec.js'"
+  },
+  "node-red": {
+    "version": ">=4.0.0",
+    "nodes": {
+      "agent": "nodes/agent/agent.js",
+      "agent-server": "nodes/agent-server/agent-server.js",
+      "gh": "nodes/gh/gh.js"
+    }
+  },
+  "devDependencies": {
+    "node-red-node-test-helper": "^0.3.6"
+  }
+}

package/shared/srt-settings.js

@@ -0,0 +1,71 @@
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+// Translates the simple "Inline" SRT settings UI (two string lists + one
+// checkbox), used by both the `agent` and `agent-server` nodes, into the
+// JSON shape `srt` itself requires, and writes it to a temp file (srt only
+// accepts a file path via -s, not inline JSON). Kept separate from
+// lib/runtimes/srt.js (agent) and lib/daemon.js (agent-server), which stay
+// completely runtime-source-agnostic -- they only ever see a settingsPath
+// string and don't care whether it came from this module or a hand-authored
+// file (spec: "SRT-specific configuration... implemented by the runtime
+// adapter rather than embedded in the Agent node core").
+//
+// Shared here (not duplicated) because both consumers now live in the same
+// publishable package (packages/node-red-agents) -- see docs/260817_Refactoring.md
+// step 8. Previously this was a verbatim copy in each node's lib/, kept
+// separate only because each node used to be its own standalone npm package.
+//
+// srt requires network.allowedDomains, network.deniedDomains,
+// filesystem.denyRead, and filesystem.denyWrite to all be *present* (even
+// as empty arrays) -- verified empirically: srt refuses to run and prints
+// "<field>: Required" for each one missing. This function always includes
+// all four.
+function buildSettingsJson({ allowedDomains, allowedWriteDirs, strictAllowlist } = {}) {
+    return {
+        network: {
+            allowedDomains: Array.isArray(allowedDomains) ? allowedDomains : [],
+            deniedDomains: [],
+            strictAllowlist: strictAllowlist !== false
+        },
+        filesystem: {
+            allowWrite: Array.isArray(allowedWriteDirs) ? allowedWriteDirs : [],
+            denyRead: [],
+            denyWrite: []
+        }
+    };
+}
+
+// config: { allowedDomains, allowedWriteDirs, strictAllowlist, advancedJson }
+// Returns the JSON string that will be written (and validated as parseable
+// JSON) -- does not touch the filesystem. Kept separate from
+// writeInlineSettingsFile so tests can check the generated content without
+// needing a real filesystem.
+function resolveSettingsJsonString(config = {}) {
+    const raw = config.advancedJson && config.advancedJson.trim() ? config.advancedJson : JSON.stringify(buildSettingsJson(config));
+    // Throws a clear SyntaxError if the (usually hand-edited advanced) JSON
+    // is invalid -- deliberately no deeper validation than "is this valid
+    // JSON"; srt's own runtime error for a structurally-wrong-but-valid-JSON
+    // settings file is already clear and surfaces through the normal
+    // execution/spawn-failure path.
+    JSON.parse(raw);
+    return raw;
+}
+
+// nodeId is used only to make the temp filename recognizable/stable per
+// node instance; process.pid is appended so a fast redeploy sequence can
+// never have two live Node-RED processes racing on the same file.
+// filePrefix distinguishes callers (e.g. 'agent' vs 'agent-server') so two
+// different node types configuring the same nodeId-shaped id can never
+// collide on the same temp file.
+function writeInlineSettingsFile(nodeId, config, filePrefix = 'srt-settings') {
+    const json = resolveSettingsJsonString(config);
+    const filePath = path.join(os.tmpdir(), `${filePrefix}-${nodeId}-${process.pid}.json`);
+    fs.writeFileSync(filePath, json);
+    return filePath;
+}
+
+module.exports = { buildSettingsJson, resolveSettingsJsonString, writeInlineSettingsFile };