@xmanrui/dsh-im 4.9.0 → 4.10.0

package/src/channels/shared/inbound-file.mjs

@@ -1,11 +1,40 @@
 import { createWriteStream } from 'node:fs';
-import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readdir, realpath, rm, writeFile } from 'node:fs/promises';
 import { isAbsolute, join, relative, resolve } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 
 import { t } from './i18n.mjs';
 
 const FILES_DIRECTORY = join('.dsh-im', 'inbound');
+const RETENTIONS = new Set(['turn', 'persistent']);
+const DIRECTORY_TIMESTAMP_PATTERN = /^(\d{4})(\d{2})(\d{2})-(\d{2})(\d{2})(\d{2})/;
+
+function padded(value) {
+  return String(value).padStart(2, '0');
+}
+
+/** Timestamp prefix (`yyyyMMdd-HHmmss-`) handed to mkdtemp for random suffixes. */
+function inboundDirectoryPrefix(now = new Date()) {
+  return `${now.getFullYear()}${padded(now.getMonth() + 1)}${padded(now.getDate())}`
+    + `-${padded(now.getHours())}${padded(now.getMinutes())}${padded(now.getSeconds())}-`;
+}
+
+/**
+ * Parse the local-time instant encoded in a staged inbound directory name,
+ * returning null for legacy `turn-` names and anything unparseable.
+ */
+export function parseInboundDirectoryName(name) {
+  if (typeof name !== 'string') return null;
+  const match = DIRECTORY_TIMESTAMP_PATTERN.exec(name);
+  if (!match) return null;
+  const [year, month, day, hour, minute, second] = match.slice(1).map(Number);
+  const date = new Date(year, month - 1, day, hour, minute, second);
+  if (date.getFullYear() !== year || date.getMonth() !== month - 1 || date.getDate() !== day
+    || date.getHours() !== hour || date.getMinutes() !== minute || date.getSeconds() !== second) {
+    return null;
+  }
+  return date;
+}
 
 export class InboundFileError extends Error {
   constructor(code, message, userMessage = t('文件接收失败，请重新发送后再试。'), options = {}) {
@@ -97,7 +126,18 @@ export function prefetchInboundFiles(message, { signal } = {}) {
 export async function stageInboundFiles(message, {
   workspace,
   signal,
+  retention = 'turn',
+  onStagedDirectory = null,
 } = {}) {
+  if (!RETENTIONS.has(retention)) {
+    throw new InboundFileError(
+      'inbound-file-retention-invalid',
+      `Unknown inbound file retention: ${String(retention)}`,
+    );
+  }
+  if (onStagedDirectory !== null && typeof onStagedDirectory !== 'function') {
+    throw new TypeError('onStagedDirectory must be a function');
+  }
   const sources = fileSources(message);
   if (sources.length === 0) return null;
   if (typeof workspace !== 'string' || !isAbsolute(workspace)) {
@@ -110,7 +150,10 @@ export async function stageInboundFiles(message, {
   signal?.throwIfAborted();
   const root = resolve(workspace, FILES_DIRECTORY);
   await mkdir(root, { recursive: true, mode: 0o700 });
-  const directory = await mkdtemp(join(root, 'turn-'));
+  const directory = await mkdtemp(join(root, inboundDirectoryPrefix()));
+  // Register the batch before any file is written so a concurrent TTL=0
+  // sweep can never observe the directory as untracked mid-staging.
+  onStagedDirectory?.(directory);
   const files = [];
 
   try {
@@ -177,7 +220,11 @@ export async function stageInboundFiles(message, {
     }
     return Object.freeze({
       files: Object.freeze(files),
+      directory,
+      retention,
       async cleanup() {
+        // Persistent retention leaves the directory to the global TTL sweeper.
+        if (retention !== 'turn') return;
         await rm(directory, { recursive: true, force: true });
       },
     });
@@ -187,6 +234,74 @@ export async function stageInboundFiles(message, {
   }
 }
 
+/**
+ * Delete expired staged inbound directories under one workspace. Only
+ * directories whose names parse as `yyyyMMdd-HHmmss` timestamps are managed;
+ * legacy `turn-` names and anything unparseable stay untouched. Directories
+ * reported as tracked by an in-flight turn are always skipped.
+ */
+export async function sweepInboundAttachments(workspace, ttlHours, {
+  now = () => new Date(),
+  isTracked,
+} = {}) {
+  if (typeof workspace !== 'string' || !workspace) {
+    throw new TypeError('sweepInboundAttachments requires a workspace');
+  }
+  // An unparsable TTL must never widen into unconditional deletion.
+  if (ttlHours !== 0 && !(Number.isInteger(ttlHours) && ttlHours > 0)) {
+    return { deleted: 0 };
+  }
+  const root = resolve(workspace, FILES_DIRECTORY);
+  let canonicalWorkspace;
+  let canonicalRoot;
+  try {
+    [canonicalWorkspace, canonicalRoot] = await Promise.all([
+      realpath(workspace),
+      realpath(root),
+    ]);
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { deleted: 0 };
+    throw error;
+  }
+  const rootInWorkspace = relative(canonicalWorkspace, canonicalRoot);
+  if (!rootInWorkspace || rootInWorkspace.startsWith('..') || isAbsolute(rootInWorkspace)) {
+    throw new InboundFileError(
+      'inbound-file-root-outside-workspace',
+      'The inbound attachment directory does not resolve inside the Harness Session workspace.',
+    );
+  }
+  let entries;
+  try {
+    entries = await readdir(canonicalRoot, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === 'ENOENT') return { deleted: 0 };
+    throw error;
+  }
+  const current = now();
+  let deleted = 0;
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const stagedAt = parseInboundDirectoryName(entry.name);
+    if (stagedAt === null) continue;
+    const directory = join(root, entry.name);
+    const canonicalDirectory = join(canonicalRoot, entry.name);
+    if (typeof isTracked === 'function'
+      && (isTracked(directory) || (directory !== canonicalDirectory && isTracked(canonicalDirectory)))) {
+      continue;
+    }
+    const ageHours = (current - stagedAt) / 3_600_000;
+    if (ttlHours === 0 || ageHours >= ttlHours) {
+      try {
+        await rm(canonicalDirectory, { recursive: true, force: true });
+        deleted += 1;
+      } catch {
+        // One undeletable directory must not abort the remaining sweep.
+      }
+    }
+  }
+  return { deleted };
+}
+
 export function appendInboundFilesToPrompt(prompt, staged) {
   if (!staged?.files?.length) return prompt;
   const manifest = [

package/src/channels/shared/inbound-ttl-store.mjs

@@ -0,0 +1,110 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readdir, readFile, rename, unlink, writeFile } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+
+import { DEFAULT_INBOUND_TTL_HOURS, normalizeInboundTtlHours } from './inbound-ttl.mjs';
+
+const DOCUMENT_VERSION = 1;
+// Fail-safe TTL for documents that exist but cannot be trusted (damage or an
+// unknown future version, e.g. after a rollback). TTL 0 would sweep every
+// untracked directory on the next pass, so keep-forever is the safe fallback.
+const UNREADABLE_DOCUMENT_TTL_HOURS = -1;
+
+function invalidTtlError() {
+  const error = new Error('Invalid inbound attachment TTL hours.');
+  error.code = 'inbound-ttl-invalid';
+  return error;
+}
+
+// Mirrors the atomic settings writes of the bot workspace store and the
+// update service: create a private temporary file, then rename it into place.
+async function writeSettingsDocument(path, document) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${randomUUID()}.tmp`;
+  try {
+    await writeFile(temporary, `${JSON.stringify(document, null, 2)}\n`, {
+      encoding: 'utf8',
+      mode: 0o600,
+      flag: 'wx',
+    });
+    await rename(temporary, path);
+  } finally {
+    await unlink(temporary).catch((error) => {
+      if (error.code !== 'ENOENT') throw error;
+    });
+  }
+}
+
+/** Durable host-side settings for the global inbound attachment TTL. */
+export class InboundTtlStore {
+  #path;
+  #ttlHours = DEFAULT_INBOUND_TTL_HOURS;
+
+  constructor(path) {
+    if (typeof path !== 'string' || !path) throw new TypeError('inbound TTL store path is required');
+    this.#path = path;
+  }
+
+  /**
+   * A missing file means first run (default TTL). A damaged or future
+   * document falls back to keep-forever so an unreadable intent can never
+   * widen into deletion; the value stays visible in the settings UI.
+   */
+  async load() {
+    let raw;
+    try {
+      raw = await readFile(this.#path, 'utf8');
+    } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+      this.#ttlHours = DEFAULT_INBOUND_TTL_HOURS;
+      await this.#removeStaleTemporaries();
+      return this;
+    }
+    this.#ttlHours = this.#readTtlHours(raw) ?? UNREADABLE_DOCUMENT_TTL_HOURS;
+    await this.#removeStaleTemporaries();
+    return this;
+  }
+
+  // Crash leftovers from an interrupted atomic write are unreferenced by
+  // anyone; remove them so the settings directory stays clean.
+  async #removeStaleTemporaries() {
+    const directory = dirname(this.#path);
+    const prefix = `${basename(this.#path)}.`;
+    try {
+      const entries = await readdir(directory);
+      await Promise.all(entries
+        .filter((name) => name.startsWith(prefix) && name.endsWith('.tmp'))
+        .map((name) => unlink(join(directory, name)).catch(() => {})));
+    } catch {
+      // A missing directory or concurrent removal is fine; cleanup is best-effort.
+    }
+  }
+
+  #readTtlHours(raw) {
+    let document;
+    try {
+      document = JSON.parse(raw);
+    } catch {
+      return null;
+    }
+    if (!document || typeof document !== 'object' || Array.isArray(document)) return null;
+    if (document.version !== DOCUMENT_VERSION) return null;
+    if (document.inboundAttachmentTtlHours === undefined) return DEFAULT_INBOUND_TTL_HOURS;
+    return normalizeInboundTtlHours(document.inboundAttachmentTtlHours);
+  }
+
+  getTtlHours() {
+    return this.#ttlHours;
+  }
+
+  async setTtlHours(value) {
+    const ttlHours = normalizeInboundTtlHours(value);
+    if (ttlHours === null) throw invalidTtlError();
+    await writeSettingsDocument(this.#path, {
+      version: DOCUMENT_VERSION,
+      inboundAttachmentTtlHours: ttlHours,
+    });
+    this.#ttlHours = ttlHours;
+    return ttlHours;
+  }
+}

package/src/channels/shared/inbound-ttl.mjs

@@ -0,0 +1,22 @@
+export const DEFAULT_INBOUND_TTL_HOURS = 168;
+export const INBOUND_TTL_MAX_HOURS = 8760;
+
+const INTEGER_STRING = /^[+-]?\d+$/;
+
+/**
+ * Normalize a global inbound attachment TTL. Valid values are -1 (keep
+ * forever), 0 (delete once the owning turn ends), and whole hours 1..8760.
+ * Integer strings are tolerated; every other input returns null.
+ */
+export function normalizeInboundTtlHours(value) {
+  let candidate = value;
+  if (typeof candidate === 'string') {
+    const trimmed = candidate.trim();
+    if (!INTEGER_STRING.test(trimmed)) return null;
+    candidate = Number(trimmed);
+  }
+  if (typeof candidate !== 'number' || !Number.isInteger(candidate)) return null;
+  if (candidate === -1) return -1;
+  if (candidate >= 0 && candidate <= INBOUND_TTL_MAX_HOURS) return candidate;
+  return null;
+}