@yep-ai/cli 0.0.0-stage → 1.0.1

package/lib/device/tools.js

@@ -0,0 +1,343 @@
+import fs from "node:fs/promises";
+import { constants as FS } from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
+const MAX_FILE = 10 * 1024 * 1024;
+const MAX_OUTPUT = 64 * 1024;
+function safeRelative(value = "") {
+  if (typeof value !== "string" || value.length > 4096 || /[\\:\0\r\n]/u.test(value) || value.startsWith("/") || value.split("/").some((x) => x === ".." || x === ".")) throw new Error("Unsafe relative path");
+  return value;
+}
+function samePath(a, b) {
+  return process.platform === "win32" ? a.toLowerCase() === b.toLowerCase() : a === b;
+}
+function within(root, candidate) {
+  const rel = path.relative(root, candidate);
+  return rel === "" || !rel.startsWith(".." + path.sep) && rel !== ".." && !path.isAbsolute(rel);
+}
+async function rootDescriptor(id, location, privateDir) {
+  const absolute = path.resolve(location);
+  const stat = await fs.lstat(absolute);
+  if (!stat.isDirectory() || stat.isSymbolicLink() || !samePath(await fs.realpath(absolute), absolute)) throw new Error("Root must be an ordinary directory without links");
+  const privatePath = privateDir && path.resolve(privateDir);
+  if (privatePath && within(privatePath, absolute)) throw new Error("Private CLI directory cannot be shared");
+  return { id, absolute, name: path.basename(absolute) || "文件系统", dev: stat.dev, ino: stat.ino, privateDir: privatePath };
+}
+async function resolveSafe(root, relative = "", kind) {
+  safeRelative(relative);
+  const rootStat = await fs.lstat(root.absolute);
+  if (rootStat.isSymbolicLink() || rootStat.dev !== root.dev || rootStat.ino !== root.ino || !samePath(await fs.realpath(root.absolute), root.absolute)) throw new Error("Authorized directory was replaced");
+  let candidate = root.absolute;
+  for (const segment of relative.split("/").filter(Boolean)) {
+    candidate = path.join(candidate, segment);
+    const st2 = await fs.lstat(candidate);
+    if (st2.isSymbolicLink() || !st2.isDirectory() && !st2.isFile()) throw new Error("Links and special files are forbidden");
+  }
+  const st = await fs.lstat(candidate);
+  const real = await fs.realpath(candidate);
+  if (!samePath(real, candidate) || !within(root.absolute, real) || root.privateDir && within(root.privateDir, real)) throw new Error("Path escapes authorization");
+  if (kind === "file" && !st.isFile() || kind === "directory" && !st.isDirectory()) throw new Error("Unexpected file type");
+  return { absolute: candidate, stat: st };
+}
+async function pinnedOpen(root, relative, directory = false) {
+  const checked = await resolveSafe(root, relative, directory ? "directory" : "file");
+  if (process.platform !== "linux") return fs.open(checked.absolute, FS.O_RDONLY | (FS.O_NOFOLLOW || 0) | (directory ? FS.O_DIRECTORY || 0 : 0));
+  const parts = relative.split("/").filter(Boolean);
+  const held = [];
+  try {
+    let parent = await fs.open(root.absolute, FS.O_RDONLY | FS.O_NOFOLLOW | FS.O_DIRECTORY);
+    held.push(parent);
+    const rootIdentity = await parent.stat();
+    if (rootIdentity.dev !== root.dev || rootIdentity.ino !== root.ino) throw new Error("Authorized directory was replaced");
+    for (let i = 0; i < parts.length; i++) {
+      const isDirectory = i < parts.length - 1 || directory;
+      parent = await fs.open(`/proc/self/fd/${parent.fd}/${parts[i]}`, FS.O_RDONLY | FS.O_NOFOLLOW | (isDirectory ? FS.O_DIRECTORY : 0));
+      held.push(parent);
+      const st = await parent.stat();
+      if (isDirectory ? !st.isDirectory() : !st.isFile()) throw new Error("Links and special files are forbidden");
+    }
+    const result = held.pop();
+    return result;
+  } finally {
+    await Promise.all(held.map((handle) => handle.close()));
+  }
+}
+async function readFile(root, relative, maximum = MAX_FILE) {
+  const resolved = await resolveSafe(root, relative, "file");
+  if (resolved.stat.size > maximum) throw new Error("File exceeds size limit");
+  const fd = await pinnedOpen(root, relative);
+  try {
+    const before = await fd.stat();
+    if (before.ino !== resolved.stat.ino || before.dev !== resolved.stat.dev || !before.isFile()) throw new Error("File changed during authorization");
+    const buffer = Buffer.alloc(Math.min(maximum + 1, before.size + 1));
+    const { bytesRead } = await fd.read(buffer, 0, buffer.length, 0);
+    if (bytesRead > maximum) throw new Error("File exceeds size limit");
+    await resolveSafe(root, relative, "file");
+    return buffer.subarray(0, bytesRead);
+  } finally {
+    await fd.close();
+  }
+}
+async function list(root, relative = "", offset = 0, includeFiles = true) {
+  if (!Number.isSafeInteger(offset) || offset < 0 || offset > 1e4) throw new Error("Invalid offset");
+  const { absolute } = await resolveSafe(root, relative, "directory");
+  let entries;
+  const pinned = await pinnedOpen(root, relative, true);
+  try {
+    entries = await fs.readdir(process.platform === "linux" ? `/proc/self/fd/${pinned.fd}` : absolute, { withFileTypes: true });
+    await resolveSafe(root, relative, "directory");
+  } finally {
+    await pinned.close();
+  }
+  ;
+  if (entries.length > 1e4) throw new Error("Directory exceeds 10000 entries");
+  const filtered = entries.filter((e) => !e.isSymbolicLink() && (e.isDirectory() || includeFiles && e.isFile()) && !/[\\:\0\r\n]/u.test(e.name)).sort((a, b) => a.name.localeCompare(b.name));
+  const page = [];
+  for (const e of filtered.slice(offset, offset + 200)) {
+    const p = [relative, e.name].filter(Boolean).join("/");
+    try {
+      await resolveSafe(root, p);
+      page.push({ name: e.name, kind: e.isDirectory() ? "directory" : "file", path: p });
+    } catch {
+    }
+  }
+  return { folderId: root.id, path: relative, parentPath: relative ? relative.split("/").slice(0, -1).join("/") : null, entries: page, offset, hasMore: offset + 200 < filtered.length };
+}
+function utf8(data) {
+  const text = new TextDecoder("utf-8", { fatal: true }).decode(data);
+  if (text.includes("\0")) throw new Error("File is not UTF-8 text");
+  return text;
+}
+function bounded(text) {
+  const b = Buffer.from(text);
+  return { text: b.subarray(0, MAX_OUTPUT).toString("utf8"), truncated: b.length > MAX_OUTPUT };
+}
+async function fileOperation(root, request) {
+  const op = request.operation;
+  const relative = request.path ?? "";
+  if (op === "list") return list(root, relative, request.offset ?? 0, true);
+  if (op === "read") {
+    const data = await readFile(root, relative);
+    return { name: path.basename(relative), data: data.toString("base64"), size: data.length };
+  }
+  const text = utf8(await readFile(root, relative));
+  const lines = text.split("\n");
+  if (op === "read_lines") {
+    const start = request.startLine ?? 1;
+    const end = request.endLine ?? Math.min(start + 499, lines.length);
+    if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start || end - start >= 500) throw new Error("Invalid line range (maximum 500 lines)");
+    return { name: path.basename(relative), ...bounded(lines.slice(start - 1, end).join("\n")), startLine: start, endLine: Math.min(end, lines.length) };
+  }
+  if (op === "search") {
+    if (typeof request.query !== "string" || !request.query || request.query.length > 1e3) throw new Error("Literal query required");
+    let matches = [];
+    let bytes = 0;
+    for (let i = 0; i < lines.length; i++) {
+      if (lines[i].length > 65536) continue;
+      if (lines[i].includes(request.query)) {
+        const item = { line: i + 1, text: lines[i] };
+        bytes += Buffer.byteLength(item.text);
+        if (matches.length >= 50 || bytes > MAX_OUTPUT) break;
+        matches.push(item);
+      }
+    }
+    return { matches };
+  }
+  throw new Error("Unknown file operation");
+}
+function tokenize(command) {
+  if (typeof command !== "string" || !command.trim() || command.length > 4096 || /[|&;<>$`\n\r\0%!*?()[\]{}]/u.test(command)) throw new Error("Only restricted built-in commands are allowed");
+  const tokens = [];
+  const regex = /"([^"\\]*)"|'([^'\\]*)'|([^\s"']+)/gu;
+  let match;
+  let end = 0;
+  while (match = regex.exec(command)) {
+    if (command.slice(end, match.index).trim()) throw new Error("Invalid command quoting");
+    tokens.push(match[1] ?? match[2] ?? match[3]);
+    end = regex.lastIndex;
+  }
+  if (command.slice(end).trim()) throw new Error("Invalid command quoting");
+  return tokens;
+}
+async function builtin(root, cwd, command) {
+  const [cmd, ...args] = tokenize(command);
+  await resolveSafe(root, cwd, "directory");
+  const relative = (v = "") => [cwd, v].filter(Boolean).join("/");
+  const read = async (v) => utf8(await readFile(root, relative(v)));
+  if (cmd === "pwd" && args.length === 0) return { text: cwd || "." };
+  if (["ls", "dir"].includes(cmd) && args.length <= 1) {
+    const r = await list(root, relative(args[0]), 0, true);
+    return bounded(r.entries.map((e) => e.name + (e.kind === "directory" ? "/" : "")).join("\n"));
+  }
+  if (cmd === "echo") return bounded(args.join(" ") + "\n");
+  if (["cat", "type"].includes(cmd) && args.length === 1) return bounded(await read(args[0]));
+  if (["head", "tail"].includes(cmd)) {
+    let count = 10, file;
+    if (args.length === 1) file = args[0];
+    else if (args.length === 3 && args[0] === "-n" && /^\d+$/u.test(args[1])) {
+      count = Number(args[1]);
+      file = args[2];
+    } else throw new Error("Usage: head/tail [-n count] file");
+    if (count > 500) throw new Error("Maximum 500 lines");
+    const lines = (await read(file)).split("\n");
+    return bounded((cmd === "head" ? lines.slice(0, count) : lines.slice(-count)).join("\n"));
+  }
+  if (["grep", "findstr"].includes(cmd) && args.length === 2) {
+    const lines = (await read(args[1])).split("\n");
+    return bounded(lines.filter((l) => l.includes(args[0])).slice(0, 50).join("\n"));
+  }
+  if (cmd === "wc" && args.length === 2 && args[0] === "-l") return { text: String((await read(args[1])).split("\n").length - 1) + "\n" };
+  throw new Error("Unsupported restricted command");
+}
+function parseTerminalDirectory(command, windows = process.platform === "win32") {
+  if (!/^\s*cd(?:\s|$)/iu.test(command)) return null;
+  if (/[\0\r\n]/u.test(command)) throw new Error("Usage: cd [directory]; run other commands separately");
+  let target = command.trim().slice(2).trim();
+  if (windows && /^\/d(?:\s|$)/iu.test(target)) target = target.slice(2).trim();
+  if (!target) return "";
+  const quote = target[0];
+  if (quote === '"' || quote === "'") {
+    // A directory name is interpreted literally, never as shell source.
+    // Windows backslashes must survive quotation rather than become escapes.
+    if (target.at(-1) !== quote || target.slice(1, -1).includes(quote)) throw new Error("Usage: cd [directory]; run other commands separately");
+    return target.slice(1, -1);
+  }
+  if (/[\s|&;<>$`%!*?()[\]{}"']/u.test(target)) throw new Error("Usage: cd [directory]; run other commands separately");
+  return target;
+}
+async function terminalDirectory(root, cwd, command, restricted) {
+  let target;
+  try {
+    target = parseTerminalDirectory(command);
+  } catch (error) {
+    // Only a standalone literal cd changes the simulated terminal directory.
+    // In system mode, compound commands and shell expressions run normally in
+    // their own shell, whose working directory lasts for that command only.
+    if (!restricted) return null;
+    throw error;
+  }
+  if (target === null) return null;
+  await resolveSafe(root, cwd, "directory");
+  if (!restricted && (target === "~" || target.startsWith("~/"))) {
+    target = path.join(process.env.USERPROFILE || process.env.HOME || root.absolute, target.slice(2));
+  }
+  let relative;
+  if (path.isAbsolute(target)) {
+    if (restricted) throw new Error("Use a relative directory inside the authorized root");
+    relative = path.relative(root.absolute, path.resolve(target)).split(path.sep).join("/");
+  } else {
+    if (process.platform === "win32") target = target.replaceAll("\\", "/");
+    relative = target ? path.posix.normalize([cwd, target].filter(Boolean).join("/")) : "";
+  }
+  if (relative === ".") relative = "";
+  await resolveSafe(root, relative, "directory");
+  return relative;
+}
+// Retain an unfinished secret prefix across chunks so streaming cannot expose a
+// token that happened to cross a stdout/stderr packet boundary.
+function outputRedactor(secrets, emit) {
+  const values = [...new Set(secrets.filter(value => typeof value === "string" && value))].sort((a, b) => b.length - a.length);
+  let pending = "";
+  return (text, final = false, truncated = false) => {
+    pending += text;
+    for (const secret of values) pending = pending.split(secret).join("[REDACTED]");
+    let tail = 0;
+    for (const secret of values) {
+      for (let length = Math.min(secret.length - 1, pending.length); length > tail; length--) {
+        if (pending.endsWith(secret.slice(0, length))) { tail = length; break; }
+      }
+    }
+    if (final) {
+      if (truncated && tail) pending = pending.slice(0, -tail) + "[REDACTED]";
+      if (pending) emit(pending);
+      pending = "";
+    } else {
+      const ready = pending.slice(0, pending.length - tail);
+      pending = pending.slice(pending.length - tail);
+      if (ready) emit(ready);
+    }
+  };
+}
+async function execute(root, request, { restricted = true, signal, secrets = [], onOutput } = {}) {
+  if (signal?.aborted) throw new Error("Operation canceled");
+  if (request.operation !== "exec") return fileOperation(root, request);
+  if (restricted) {
+    const result = await builtin(root, request.path ?? "", request.command);
+    if (signal?.aborted) throw new Error("Operation canceled");
+    let stdout = "";
+    outputRedactor(secrets, text => { stdout += text; onOutput?.("stdout", text); })(result.text, true, result.truncated);
+    return { stdout, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
+  }
+  const { absolute } = await resolveSafe(root, request.path ?? "", "directory");
+  if (typeof request.command !== "string" || request.command.length > 4096 || request.command.includes("\0")) throw new Error("Invalid command");
+  return new Promise((resolve, reject) => {
+    const env = { ...process.env };
+    for (const k of Object.keys(env)) if (/TOKEN|SECRET|PASSWORD|API_KEY|AUTHORIZATION/iu.test(k)) delete env[k];
+    const child = spawn(process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "/bin/sh", process.platform === "win32" ? ["/d", "/s", "/c", request.command] : ["-c", request.command], { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false, streamError;
+    const kill = () => {
+      if (process.platform === "win32") {
+        spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
+      } else {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+          child.kill("SIGKILL");
+        }
+      }
+    };
+    const timer = setTimeout(() => {
+      timedOut = true;
+      kill();
+    }, 3e4);
+    const abort = () => kill();
+    signal?.addEventListener("abort", abort, { once: true });
+    if (signal?.aborted) kill();
+    const decoders = { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") };
+    const redact = Object.fromEntries(["stdout", "stderr"].map(which => [which, outputRedactor(secrets, text => {
+      if (which === "stdout") stdout += text;
+      else stderr += text;
+      if (!signal?.aborted && !streamError) {
+        try { onOutput?.(which, text); } catch (error) { streamError = error; kill(); }
+      }
+    })]));
+    const append = (which, chunk) => {
+      const room = Math.max(0, MAX_OUTPUT - bytes);
+      bytes += chunk.length;
+      if (bytes > MAX_OUTPUT) truncated = true;
+      redact[which](decoders[which].write(chunk.subarray(0, room)));
+    };
+    child.stdout.on("data", (c) => append("stdout", c));
+    child.stderr.on("data", (c) => append("stderr", c));
+    child.once("error", (e) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      reject(e);
+    });
+    child.once("close", (code, sig) => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abort);
+      for (const which of ["stdout", "stderr"]) redact[which](decoders[which].end(), true, truncated);
+      if (signal?.aborted) {
+        const error = new Error("Operation canceled");
+        error.output = { stdout, stderr, exitCode: null, canceled: true, truncated, timedOut };
+        return reject(error);
+      }
+      if (streamError) return reject(streamError);
+      resolve({ stdout, stderr, exitCode: code, signal: sig, truncated, timedOut });
+    });
+  });
+}
+export {
+  MAX_FILE,
+  builtin,
+  execute,
+  fileOperation,
+  list,
+  resolveSafe,
+  rootDescriptor,
+  safeRelative,
+  terminalDirectory,
+  parseTerminalDirectory
+};

package/package.json

@@ -1,6 +1,32 @@
 {
   "name": "@yep-ai/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.1",
+  "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
+  "type": "module",
+  "bin": {
+    "yep": "bin/yep.js"
+  },
+  "files": [
+    "bin/yep.js",
+    "bin/market.js",
+    "bin/clients.js",
+    "lib",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "dependencies": {
+    "ws": "^8.21.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "build": "node bin/yep.js --version",
+    "check": "node --check bin/yep.js && node --check bin/market.js && node --check lib/device/command.js && node --check lib/device/client.js && node --check lib/device/tools.js",
+    "test": "node --test"
+  }
+}