@winspan/claude-forge 8.39.0 → 8.50.6

package/src/skills/tools/skill-list.ts

@@ -0,0 +1,59 @@
+/**
+ * SkillList — 列出所有可用的 Skill
+ *
+ * Agent 可以通过此工具查询可用的 Skill，支持关键词过滤。
+ *
+ * 示例：
+ *   SkillList({ keywords: ["test", "tdd"] })
+ *   → 返回包含 "test" 或 "tdd" 关键词的 Skill 列表
+ */
+
+import type { SkillRegistry } from '../registry.js';
+import { logger } from '../../core/utils/logger.js';
+
+export interface SkillListParams {
+  keywords?: string[]; // 可选的关键词过滤
+}
+
+export interface SkillListResult {
+  skills: Array<{
+    id: string;
+    name: string;
+    description: string;
+    keywords: string[];
+  }>;
+  total: number;
+}
+
+export async function skillList(
+  params: SkillListParams,
+  context: { skillRegistry: SkillRegistry },
+): Promise<SkillListResult> {
+  const { keywords } = params;
+
+  logger.info(`[SkillList] Agent requested skill list${keywords ? ` (keywords: ${keywords.join(', ')})` : ''}`);
+
+  const allSkills = Array.from(context.skillRegistry.getAll());
+
+  // Filter by keywords if provided
+  let filteredSkills = allSkills;
+  if (keywords && keywords.length > 0) {
+    const keywordsLower = keywords.map(k => k.toLowerCase());
+    filteredSkills = allSkills.filter(skill => {
+      const skillKeywords = skill.keywords.map(k => k.toLowerCase());
+      return keywordsLower.some(kw => skillKeywords.some(sk => sk.includes(kw)));
+    });
+  }
+
+  const result = filteredSkills.map(skill => ({
+    id: skill.id,
+    name: skill.name,
+    description: skill.description || '',
+    keywords: skill.keywords,
+  }));
+
+  return {
+    skills: result,
+    total: result.length,
+  };
+}

package/src/templates/go.yaml

@@ -0,0 +1,53 @@
+# Go Project Template
+# 为 Go 项目提供开箱即用的规则配置
+
+name: "Go Project"
+description: "Go 项目的推荐规则配置，包含 goroutine 管理、错误处理、并发安全等"
+version: "1.0.0"
+
+# 启用的规则文件
+conventions:
+  - go-best-practices
+  - basic-security
+  - git-safety
+
+# 项目配置
+config:
+  # 文件扩展名
+  file_extensions:
+    - .go
+
+  # 忽略的目录
+  ignore_paths:
+    - vendor/
+    - bin/
+    - .git/
+    - testdata/
+
+  # 推荐的工具
+  recommended_tools:
+    - golangci-lint
+    - gofmt
+    - go vet
+    - staticcheck
+
+# 初始化脚本
+init_commands:
+  - go mod download
+  - go build ./...
+
+# 推荐的 Makefile targets
+recommended_make_targets:
+  lint: "golangci-lint run"
+  fmt: "gofmt -s -w ."
+  test: "go test -v -race -coverprofile=coverage.out ./..."
+  build: "go build -o bin/app ./cmd/app"
+
+# 文档链接
+documentation:
+  - name: "Go 官方文档"
+    url: "https://go.dev/doc/"
+  - name: "Effective Go"
+    url: "https://go.dev/doc/effective_go"
+  - name: "Go Code Review Comments"
+    url: "https://github.com/golang/go/wiki/CodeReviewComments"

package/src/templates/python.yaml

@@ -0,0 +1,59 @@
+# Python Project Template
+# 为 Python 项目提供开箱即用的规则配置
+
+name: "Python Project"
+description: "Python 项目的推荐规则配置，包含安全检查、代码风格、依赖管理等"
+version: "1.0.0"
+
+# 启用的规则文件
+conventions:
+  - python-best-practices
+  - basic-security
+  - git-safety
+
+# 项目配置
+config:
+  # 文件扩展名
+  file_extensions:
+    - .py
+
+  # 忽略的目录
+  ignore_paths:
+    - __pycache__/
+    - .venv/
+    - venv/
+    - .pytest_cache/
+    - dist/
+    - build/
+    - "*.egg-info/"
+
+  # 推荐的工具
+  recommended_tools:
+    - black
+    - flake8
+    - mypy
+    - pytest
+    - bandit
+
+# 初始化脚本
+init_commands:
+  - python -m venv .venv
+  - source .venv/bin/activate
+  - pip install -r requirements.txt
+
+# 推荐的 Makefile targets
+recommended_make_targets:
+  lint: "flake8 src tests"
+  format: "black src tests"
+  type-check: "mypy src"
+  security: "bandit -r src"
+  test: "pytest tests/ -v --cov=src"
+
+# 文档链接
+documentation:
+  - name: "Python 官方文档"
+    url: "https://docs.python.org/3/"
+  - name: "PEP 8 Style Guide"
+    url: "https://peps.python.org/pep-0008/"
+  - name: "Python Security Best Practices"
+    url: "https://python.readthedocs.io/en/stable/library/security_warnings.html"

package/src/templates/react.yaml

@@ -0,0 +1,55 @@
+# React Project Template
+# 为 React 项目提供开箱即用的规则配置
+
+name: "React Project"
+description: "React 项目的推荐规则配置，包含 XSS 防护、性能优化、Hooks 规范等"
+version: "1.0.0"
+
+# 启用的规则文件
+conventions:
+  - react-best-practices
+  - basic-security
+  - git-safety
+
+# 项目配置
+config:
+  # 文件扩展名
+  file_extensions:
+    - .jsx
+    - .tsx
+    - .js
+    - .ts
+
+  # 忽略的目录
+  ignore_paths:
+    - node_modules/
+    - build/
+    - dist/
+    - .next/
+    - coverage/
+
+  # 推荐的工具
+  recommended_tools:
+    - eslint
+    - prettier
+    - typescript
+    - jest
+
+# 初始化脚本
+init_commands:
+  - npm install
+  - npm run build
+
+# 推荐的 package.json scripts
+recommended_scripts:
+  lint: "eslint src --ext .js,.jsx,.ts,.tsx"
+  format: "prettier --write \"src/**/*.{js,jsx,ts,tsx}\""
+  test: "jest"
+  build: "react-scripts build"
+
+# 文档链接
+documentation:
+  - name: "React 官方文档"
+    url: "https://react.dev"
+  - name: "React Security Best Practices"
+    url: "https://react.dev/learn/security"

package/src/templates/template-manager.ts

@@ -0,0 +1,170 @@
+/**
+ * Template Manager - 管理项目模板
+ *
+ * 提供模板加载、初始化和配置功能
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import yaml from 'js-yaml';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+export interface ProjectTemplate {
+  name: string;
+  description: string;
+  version: string;
+  conventions: string[];
+  config: {
+    file_extensions: string[];
+    ignore_paths: string[];
+    recommended_tools: string[];
+  };
+  init_commands?: string[];
+  recommended_scripts?: Record<string, string>;
+  recommended_make_targets?: Record<string, string>;
+  documentation?: Array<{
+    name: string;
+    url: string;
+  }>;
+}
+
+export class TemplateManager {
+  private templatesDir: string;
+  private templates: Map<string, ProjectTemplate> = new Map();
+
+  constructor(templatesDir?: string) {
+    this.templatesDir = templatesDir ?? path.join(__dirname, '../templates');
+  }
+
+  /**
+   * 加载所有模板
+   */
+  loadAll(): void {
+    if (!fs.existsSync(this.templatesDir)) {
+      throw new Error(`Templates directory not found: ${this.templatesDir}`);
+    }
+
+    const files = fs.readdirSync(this.templatesDir);
+    const yamlFiles = files.filter(f => f.endsWith('.yaml') || f.endsWith('.yml'));
+
+    for (const file of yamlFiles) {
+      const templateId = path.basename(file, path.extname(file));
+      const templatePath = path.join(this.templatesDir, file);
+      const content = fs.readFileSync(templatePath, 'utf-8');
+      const template = yaml.load(content) as ProjectTemplate;
+
+      this.templates.set(templateId, template);
+    }
+  }
+
+  /**
+   * 获取模板
+   */
+  getTemplate(templateId: string): ProjectTemplate | undefined {
+    return this.templates.get(templateId);
+  }
+
+  /**
+   * 列出所有模板
+   */
+  listTemplates(): Array<{ id: string; template: ProjectTemplate }> {
+    return Array.from(this.templates.entries()).map(([id, template]) => ({
+      id,
+      template,
+    }));
+  }
+
+  /**
+   * 初始化项目模板
+   */
+  initProject(templateId: string, projectPath: string): void {
+    const template = this.getTemplate(templateId);
+    if (!template) {
+      throw new Error(`Template not found: ${templateId}`);
+    }
+
+    // 创建 .claude-forge 目录
+    const forgeDir = path.join(projectPath, '.claude-forge');
+    if (!fs.existsSync(forgeDir)) {
+      fs.mkdirSync(forgeDir, { recursive: true });
+    }
+
+    // 创建配置文件
+    const config = {
+      template: templateId,
+      conventions: template.conventions,
+      ignore_paths: template.config.ignore_paths,
+    };
+
+    const configPath = path.join(forgeDir, 'config.yaml');
+    fs.writeFileSync(configPath, yaml.dump(config), 'utf-8');
+
+    // 创建 .gitignore（如果不存在）
+    const gitignorePath = path.join(projectPath, '.gitignore');
+    if (!fs.existsSync(gitignorePath)) {
+      const gitignoreContent = template.config.ignore_paths.join('\n') + '\n';
+      fs.writeFileSync(gitignorePath, gitignoreContent, 'utf-8');
+    }
+
+    console.log(`✓ Initialized ${template.name} template`);
+    console.log(`✓ Created ${configPath}`);
+    console.log(`✓ Enabled conventions: ${template.conventions.join(', ')}`);
+  }
+
+  /**
+   * 生成推荐配置
+   */
+  generateRecommendations(templateId: string): string {
+    const template = this.getTemplate(templateId);
+    if (!template) {
+      throw new Error(`Template not found: ${templateId}`);
+    }
+
+    let output = `# ${template.name} - Recommended Configuration\n\n`;
+
+    // 推荐的工具
+    if (template.config.recommended_tools.length > 0) {
+      output += `## Recommended Tools\n\n`;
+      template.config.recommended_tools.forEach(tool => {
+        output += `- ${tool}\n`;
+      });
+      output += '\n';
+    }
+
+    // 推荐的脚本
+    if (template.recommended_scripts) {
+      output += `## Recommended Scripts (package.json)\n\n`;
+      output += '```json\n';
+      output += '"scripts": {\n';
+      Object.entries(template.recommended_scripts).forEach(([name, cmd], idx, arr) => {
+        const comma = idx < arr.length - 1 ? ',' : '';
+        output += `  "${name}": "${cmd}"${comma}\n`;
+      });
+      output += '}\n';
+      output += '```\n\n';
+    }
+
+    // 推荐的 Makefile targets
+    if (template.recommended_make_targets) {
+      output += `## Recommended Makefile Targets\n\n`;
+      output += '```makefile\n';
+      Object.entries(template.recommended_make_targets).forEach(([name, cmd]) => {
+        output += `${name}:\n\t${cmd}\n\n`;
+      });
+      output += '```\n\n';
+    }
+
+    // 文档链接
+    if (template.documentation && template.documentation.length > 0) {
+      output += `## Documentation\n\n`;
+      template.documentation.forEach(doc => {
+        output += `- [${doc.name}](${doc.url})\n`;
+      });
+      output += '\n';
+    }
+
+    return output;
+  }
+}

package/src/web/auth-middleware.ts

@@ -0,0 +1,55 @@
+/**
+ * Web API Authorization middleware
+ *
+ * 复用 daemon 的 auth token 机制（~/.claude-forge/daemon.token），
+ * 对写操作（POST/PUT/DELETE）强制校验 Authorization: Bearer <token>。
+ *
+ * 设计要点：
+ * - 同源本机场景：token 文件 chmod 600，读到即等价身份确认
+ * - token 缺失（daemon 极早期启动）时放行以免死锁，由 daemon lifecycle 负责尽快写入
+ * - 读操作（GET）不走这里，保留前端轮询的向后兼容
+ */
+
+import fs from 'fs';
+import path from 'path';
+import type { Request, Response, NextFunction } from 'express';
+import { FORGE_PATHS } from '../core/constants.js';
+
+const TOKEN_FILE = path.join(FORGE_PATHS.home(), 'daemon.token');
+
+/** 读取当前 daemon auth token，不存在或读取失败返回 null */
+export function readAuthToken(): string | null {
+  try {
+    if (!fs.existsSync(TOKEN_FILE)) return null;
+    return fs.readFileSync(TOKEN_FILE, 'utf-8').trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Express middleware：强制 Authorization: Bearer <token> 校验
+ *
+ * - token 文件缺失：放行（早期启动保护）
+ * - header 缺失或不匹配：401
+ */
+export function requireAuth(req: Request, res: Response, next: NextFunction): void {
+  const expected = readAuthToken();
+  if (!expected) {
+    // 早期启动保护：daemon 尚未写 token，避免自锁
+    next();
+    return;
+  }
+
+  const auth = req.header('Authorization') ?? '';
+  const match = auth.match(/^Bearer\s+(.+)$/);
+  if (!match || match[1].trim() !== expected) {
+    res.status(401).json({
+      error: 'AUTH_REQUIRED',
+      message:
+        'Include "Authorization: Bearer <token>" header. Token is stored at ~/.claude-forge/daemon.token',
+    });
+    return;
+  }
+  next();
+}

package/src/web/routes/ai.ts

@@ -0,0 +1,204 @@
+import type { Application } from 'express';
+import { ConfigManager } from '../../core/config.js';
+import { logger } from '../../core/utils/logger.js';
+import {
+  validateBaseUrl,
+  extractHostFromBaseUrl,
+  UPSTREAM_TIMEOUT_MS,
+} from '../ssrf-guard.js';
+import type { RouteContext } from './types.js';
+
+/**
+ * /api/ai/* and /api/config/ai — AI provider config + upstream connectivity.
+ *
+ * All outbound calls route through validateBaseUrl + redirect:'manual' so the
+ * daemon cannot be tricked into reaching internal hosts (SSRF guard).
+ */
+export function registerAIRoutes(app: Application, _ctx: RouteContext): void {
+  // GET /api/config/ai — read current AI config
+  app.get('/api/config/ai', (_req, res) => {
+    const configManager = new ConfigManager();
+    const config = configManager.get();
+
+    res.json({
+      api_key: config.ai.api_key || '',
+      base_url: config.ai.base_url || '',
+      model: config.ai.model,
+      provider: config.ai.provider,
+    });
+  });
+
+  // PUT /api/config/ai — update AI config
+  app.put('/api/config/ai', (req, res) => {
+    const { api_key, base_url, model, provider } = req.body ?? {};
+
+    try {
+      const configManager = new ConfigManager();
+      const config = configManager.get();
+
+      if (typeof api_key === 'string') config.ai.api_key = api_key;
+      if (typeof base_url === 'string') {
+        // Normalize http → https for upstream gateways that force HTTPS redirect
+        // (e.g. iflytek one.iflytek.com returns 302 and drops Authorization header)
+        let url = base_url.trim();
+        if (url.startsWith('http://')) url = 'https://' + url.slice('http://'.length);
+        config.ai.base_url = url;
+      }
+      if (typeof model === 'string') config.ai.model = model;
+      if (typeof provider === 'string') config.ai.provider = provider;
+
+      configManager.save();
+      logger.info('[Web] AI config updated');
+      res.json({ success: true });
+    } catch (err) {
+      logger.warn(`[Web] Failed to update AI config: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // GET /api/ai/models — proxy to upstream /v1/models
+  app.get('/api/ai/models', async (req, res) => {
+    try {
+      const configManager = new ConfigManager();
+      const config = configManager.get();
+
+      const queryKey = typeof req.query.api_key === 'string' ? req.query.api_key : '';
+      const queryUrl = typeof req.query.base_url === 'string' ? req.query.base_url : '';
+      const apiKey = queryKey || config.ai.api_key;
+      let baseUrl = queryUrl || config.ai.base_url || 'https://api.anthropic.com';
+      if (baseUrl.startsWith('http://')) baseUrl = 'https://' + baseUrl.slice('http://'.length);
+
+      if (!apiKey) {
+        res.status(400).json({ error: 'API key not configured' });
+        return;
+      }
+
+      const configuredHost = extractHostFromBaseUrl(config.ai.base_url);
+      const validation = validateBaseUrl(baseUrl, configuredHost ? [configuredHost] : []);
+      if (!validation.ok) {
+        res.status(400).json({ error: validation.error });
+        return;
+      }
+
+      const modelsUrl = baseUrl.endsWith('/v1')
+        ? `${baseUrl}/models`
+        : `${baseUrl}/v1/models`;
+
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), UPSTREAM_TIMEOUT_MS);
+      let response: Response;
+      try {
+        response = await fetch(modelsUrl, {
+          redirect: 'manual',
+          signal: controller.signal,
+          headers: {
+            'Authorization': `Bearer ${apiKey}`,
+            'x-api-key': apiKey,
+          },
+        });
+      } finally {
+        clearTimeout(timer);
+      }
+
+      if (response.status >= 300 && response.status < 400) {
+        res.status(400).json({
+          error: `Upstream tried to redirect (status ${response.status}); refusing to follow`,
+        });
+        return;
+      }
+
+      if (!response.ok) {
+        const text = await response.text();
+        logger.warn(`[Web] Upstream /v1/models failed: ${response.status} ${text}`);
+        res.status(response.status).json({ error: text });
+        return;
+      }
+
+      const data = await response.json();
+      res.json(data);
+    } catch (err) {
+      if (err instanceof Error && err.name === 'AbortError') {
+        res.status(504).json({ error: `Upstream timeout (${UPSTREAM_TIMEOUT_MS}ms)` });
+        return;
+      }
+      logger.warn(`[Web] Failed to fetch models: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+
+  // POST /api/ai/test — test AI connection using provided or saved config
+  app.post('/api/ai/test', async (req, res) => {
+    try {
+      const configManager = new ConfigManager();
+      const config = configManager.get();
+
+      const { api_key, base_url, model } = req.body ?? {};
+      const apiKey = (typeof api_key === 'string' && api_key) || config.ai.api_key;
+      let baseUrl = (typeof base_url === 'string' && base_url) || config.ai.base_url || 'https://api.anthropic.com';
+      const useModel = (typeof model === 'string' && model) || config.ai.model;
+      if (baseUrl.startsWith('http://')) baseUrl = 'https://' + baseUrl.slice('http://'.length);
+
+      if (!apiKey) {
+        res.status(400).json({ error: 'API key not configured' });
+        return;
+      }
+
+      const configuredHost = extractHostFromBaseUrl(config.ai.base_url);
+      const validation = validateBaseUrl(baseUrl, configuredHost ? [configuredHost] : []);
+      if (!validation.ok) {
+        res.status(400).json({ error: validation.error });
+        return;
+      }
+
+      const messagesUrl = baseUrl.endsWith('/v1')
+        ? `${baseUrl}/messages`
+        : `${baseUrl}/v1/messages`;
+
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), UPSTREAM_TIMEOUT_MS);
+      let response: Response;
+      try {
+        response = await fetch(messagesUrl, {
+          method: 'POST',
+          redirect: 'manual',
+          signal: controller.signal,
+          headers: {
+            'Content-Type': 'application/json',
+            'x-api-key': apiKey,
+            'anthropic-version': '2023-06-01',
+          },
+          body: JSON.stringify({
+            model: useModel,
+            max_tokens: 10,
+            messages: [{ role: 'user', content: 'ping' }],
+          }),
+        });
+      } finally {
+        clearTimeout(timer);
+      }
+
+      if (response.status >= 300 && response.status < 400) {
+        res.status(400).json({
+          error: `Upstream tried to redirect (status ${response.status}); refusing to follow`,
+        });
+        return;
+      }
+
+      if (!response.ok) {
+        const text = await response.text();
+        res.status(response.status).json({ error: text });
+        return;
+      }
+
+      const data = await response.json() as { model?: string };
+      res.json({ success: true, model: data.model || useModel });
+    } catch (err) {
+      if (err instanceof Error && err.name === 'AbortError') {
+        res.status(504).json({ error: `Upstream timeout (${UPSTREAM_TIMEOUT_MS}ms)` });
+        return;
+      }
+      logger.warn(`[Web] AI connection test failed: ${err}`);
+      res.status(500).json({ error: String(err) });
+    }
+  });
+}

package/src/web/routes/auth.ts

@@ -0,0 +1,22 @@
+import type { Application } from 'express';
+import { readAuthToken } from '../auth-middleware.js';
+import type { RouteContext } from './types.js';
+
+/**
+ * Auth routes — localhost bootstrap endpoint that returns the daemon token.
+ *
+ * This endpoint is intentionally NOT protected by requireAuth: the token file
+ * on disk is chmod 600 (current user only), so anyone who can reach this
+ * endpoint already has access to the file. Protecting it would create a
+ * chicken-and-egg problem for the UI.
+ */
+export function registerAuthRoutes(app: Application, _ctx: RouteContext): void {
+  app.get('/api/auth/token', (_req, res) => {
+    const token = readAuthToken();
+    if (!token) {
+      res.status(404).json({ error: 'TOKEN_NOT_FOUND' });
+      return;
+    }
+    res.json({ token });
+  });
+}