@yep-ai/cli 1.0.0 → 1.0.1

package/README.md

@@ -5,15 +5,14 @@
 ## 安装与使用
 
 ```sh
-npm install -g @yep-ai/cli
-yep --help
+npx --yes @yep-ai/cli@latest --help
 ```
 
-也可以无需全局安装直接运行：
+通过 npx 直接运行 npm 最新版，无需全局安装：
 
 ```sh
-npx --yes @yep-ai/cli --help
-npx --yes @yep-ai/cli device start --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest --help
+npx --yes @yep-ai/cli@latest device start --server https://yep.nihao.cool
 ```
 
 本包包含完整实现。`yep-cli` 是计划中的同版本入口包，当前尚未发布本项目版本，请使用 `@yep-ai/cli`。
@@ -26,31 +25,31 @@ npx --yes @yep-ai/cli device start --server https://yep.nihao.cool
 npm install
 npm run yep -- --help
 npm run pack:cli
-npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.0.tgz ./dist/cli/unscoped/yep-cli-1.0.0.tgz
+npm install --prefix ./tmp/yep-install ./dist/cli/scoped/yep-ai-cli-1.0.1.tgz ./dist/cli/unscoped/yep-cli-1.0.1.tgz
 ./tmp/yep-install/node_modules/.bin/yep --version
 ```
 
-完整实现包为 `scoped/yep-ai-cli-1.0.0.tgz`，入口包为 `unscoped/yep-cli-1.0.0.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
+完整实现包为 `scoped/yep-ai-cli-1.0.1.tgz`，入口包为 `unscoped/yep-cli-1.0.1.tgz`。本地验证时可一起指定两份文件，无需从 npm 下载实现包。输出的 `manifest.json` 记录包名、版本、依赖和 SHA-256。
 
 ## 市场与 Git 内容版本
 
 ```sh
-yep login --registry https://yep.nihao.cool
-yep whoami
-yep search assistant
-yep info @creator/demo
-yep client set codex,claude
-yep install @creator/demo --client codex
-yep list
-yep list --remote
-yep list --mine
-yep uninstall @creator/demo --client codex
-yep publish ./my-skill
-yep history @creator/demo
-yep diff @creator/demo --base published
-yep publish ./my-agent --kind agent
-yep submit @creator/demo --kind agent
-yep withdraw @creator/demo --kind agent
+npx --yes @yep-ai/cli@latest login --registry https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest whoami
+npx --yes @yep-ai/cli@latest search assistant
+npx --yes @yep-ai/cli@latest info @creator/demo
+npx --yes @yep-ai/cli@latest client set codex,claude
+npx --yes @yep-ai/cli@latest install @creator/demo --client codex
+npx --yes @yep-ai/cli@latest list
+npx --yes @yep-ai/cli@latest list --remote
+npx --yes @yep-ai/cli@latest list --mine
+npx --yes @yep-ai/cli@latest uninstall @creator/demo --client codex
+npx --yes @yep-ai/cli@latest publish ./my-skill
+npx --yes @yep-ai/cli@latest history @creator/demo
+npx --yes @yep-ai/cli@latest diff @creator/demo --base published
+npx --yes @yep-ai/cli@latest publish ./my-agent --kind agent
+npx --yes @yep-ai/cli@latest submit @creator/demo --kind agent
+npx --yes @yep-ai/cli@latest withdraw @creator/demo --kind agent
 ```
 
 默认资源类型为 `skill`，也支持 `--kind agent|plugin`。Skill 私有保存后从网页申请共享审核；Agent/Plugin 的发布会提交审核。审核通过才进入公开市场。`history` 和 `diff` 访问服务端保留的真实 Git 版本。
@@ -60,14 +59,18 @@ yep withdraw @creator/demo --kind agent
 ## 设备节点
 
 ```sh
-yep device login --server https://yep.nihao.cool
-yep device start "/path/to/documents" --server https://yep.nihao.cool
-yep device status
-yep device logout
+npx --yes @yep-ai/cli@latest device login --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest device start "/path/to/documents" --server https://yep.nihao.cool
+npx --yes @yep-ai/cli@latest device status
+npx --yes @yep-ai/cli@latest device logout
 ```
 
 设备通过 HTTPS 配对和 WSS 出站连接；网页批准设备后，还需在某场咨询中选择目录和权限。目录不会整体上传。最多指定 5 个目录；指定目录时仅提供受限内置命令。不指定目录时，命令拥有当前系统用户的 shell 权限，可访问其他文件和网络。进程退出后节点离线，不安装后台服务。设备授权最长 24 小时，可以从网页或 CLI 撤销。
 
+节点上线后，可在「设备节点」点击「打开终端」，直接选择启动目录并发送命令，无需创建咨询。终端实时展示标准输出、错误输出和退出码，可以停止命令、清屏和重连。`cd 子目录`、`cd ..` 与 `cd` 可切换工作目录；每条命令独立执行，shell 变量不会跨命令保留。CLI 终端不提供交互式输入，`vim`、`top`、口令提示等需要真实终端的程序请使用 SSH 网页终端。单条命令最长运行 30 秒、输出最多 64 KiB；关闭终端、撤销授权或断线会停止正在执行的命令。
+
+指定启动目录时仅支持 `pwd`、`ls` / `dir`、`echo`、`cat` / `type`、`head`、`tail`、`grep` / `findstr`、`wc -l` 与终端内的 `cd`，不能使用管道、重定向或外部程序。已有旧版节点若提示不支持终端，请停止旧进程，将原启动命令中的 `yep` 替换为 `npx --yes @yep-ai/cli@latest`，保留原目录参数与 `--server` 地址。
+
 `--server` 只接受 HTTPS 源站（回环开发地址允许 HTTP），显式指定后记住该源站；令牌按源站隔离。市场登录不等于设备授权。
 
 ## 配置
@@ -86,4 +89,4 @@ yep device logout
 
 市场凭据保存为 `~/.config/yep/config.json`；设备身份和各源站的授权保存在 `~/.config/yep/devices/`。目录权限 `0700`、凭据文件 `0600`；Windows 使用当前用户专属 ACL。市场和设备令牌分别管理。域名改变后需要在新源站重新登录、配对，不会把旧源站令牌发送到新地址。
 
-执行 `yep --help` 或 `yep device --help` 查看全部选项。
+执行 `npx --yes @yep-ai/cli@latest --help` 或 `npx --yes @yep-ai/cli@latest device --help` 查看全部选项。

package/lib/device/client.js

@@ -4,7 +4,7 @@ import os from "node:os";
 import { createHash, randomUUID } from "node:crypto";
 import { spawn } from "node:child_process";
 import WebSocket from "ws";
-import { rootDescriptor, resolveSafe, list, execute } from "./tools.js";
+import { rootDescriptor, resolveSafe, list, execute, terminalDirectory } from "./tools.js";
 const PROTOCOL = 2;
 const DEFAULT_SERVER = "https://yep.nihao.cool";
 function serverOrigin(value) {
@@ -185,16 +185,18 @@ async function systemRoots(privateDir) {
   }));
 }
 class DeviceAgent {
-  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt } = {}) {
+  constructor(roots, { restricted = true, privateDir, token, connectionId, expiresAt, onTerminalOutput } = {}) {
     this.roots = roots;
     this.restricted = restricted;
     this.privateDir = privateDir;
     this.token = token;
     this.connectionId = connectionId;
     this.expiresAt = expiresAt;
+    this.onTerminalOutput = onTerminalOutput;
     this.closed = false;
     this.bindings = /* @__PURE__ */ new Map();
     this.active = /* @__PURE__ */ new Map();
+    this.terminalSessions = new Map();
   }
   publicRoots() {
     return this.roots.map(({ id, name }) => ({ id, name }));
@@ -202,7 +204,7 @@ class DeviceAgent {
   cancel(frame = {}) {
     const waiting = [];
     for (const [id, op] of this.active) {
-      if (!frame.id && !frame.roundId && !frame.bindingId || frame.id === id || frame.roundId === op.roundId || frame.bindingId === op.bindingId) {
+      if (frame.sessionId ? frame.sessionId === op.sessionId && (!frame.id || frame.id === id) : !frame.id && !frame.roundId && !frame.bindingId || frame.id && frame.id === id || frame.roundId && frame.roundId === op.roundId || frame.bindingId && frame.bindingId === op.bindingId) {
         op.abort.abort();
         waiting.push(op.done);
       }
@@ -213,6 +215,62 @@ class DeviceAgent {
     this.closed = true;
     this.cancel();
     this.bindings.clear();
+    for (const session of this.terminalSessions.values()) session.closed = true;
+    this.terminalSessions.clear();
+  }
+  async terminalFrame(frame) {
+    const base = { id: frame.id, sessionId: frame.sessionId };
+    if (typeof frame.sessionId !== "string" || !frame.sessionId || frame.sessionId.length > 200) throw new Error("Invalid terminal session");
+    if (["terminal_cancel", "terminal_close"].includes(frame.type)) {
+      if (frame.type === "terminal_close") {
+        const session = this.terminalSessions.get(frame.sessionId);
+        if (session) session.closed = true;
+        this.terminalSessions.delete(frame.sessionId);
+      }
+      await this.cancel({ sessionId: frame.sessionId, ...(frame.type === "terminal_cancel" && frame.id ? { id: frame.id } : {}) });
+      return null;
+    }
+    if (typeof frame.id !== "string" || !frame.id || frame.id.length > 200 || this.active.has(frame.id) || this.active.size >= 8) throw new Error("Too many or duplicate local operations");
+    if (typeof frame.command !== "string" || !frame.command.trim() || frame.command.length > 4096 || frame.command.includes("\0")) throw new Error("Invalid command");
+    const root = this.roots.find(item => item.id === frame.folderId);
+    if (!root) throw new Error("Unknown terminal root");
+    let session = this.terminalSessions.get(frame.sessionId);
+    if (!session) {
+      if (this.terminalSessions.size >= 8) throw new Error("Too many terminal sessions");
+      this.terminalSessions.set(frame.sessionId, session = { closed: false });
+    }
+    if ([...this.active.values()].some(op => op.sessionId === frame.sessionId)) throw new Error("Terminal command is still running");
+    const abort = new AbortController();
+    let complete;
+    const done = new Promise(resolve => { complete = resolve; });
+    this.active.set(frame.id, { abort, sessionId: frame.sessionId, done });
+    const valid = () => !this.closed && !session.closed && !abort.signal.aborted;
+    try {
+      const cwd = frame.path ?? "";
+      const changed = await terminalDirectory(root, cwd, frame.command, this.restricted);
+      if (!valid()) throw new Error("Operation canceled");
+      const output = changed !== null ? { stdout: "", stderr: "", exitCode: 0 } : await execute(root, { operation: "exec", path: cwd, command: frame.command }, {
+        restricted: this.restricted, signal: abort.signal, secrets: [this.token],
+        onOutput: (stream, data) => {
+          if (!valid()) return;
+          for (let offset = 0; offset < data.length;) {
+            let end = Math.min(data.length, offset + 4096);
+            const last = data.charCodeAt(end - 1);
+            if (end < data.length && last >= 0xd800 && last <= 0xdbff) end--;
+            this.onTerminalOutput?.({ ...base, type: "terminal_output", stream, data: data.slice(offset, end) });
+            offset = end;
+          }
+        },
+      });
+      if (!valid()) throw new Error("Operation canceled");
+      return { ...base, type: "terminal_result", folderId: root.id, path: changed ?? cwd, output };
+    } catch (error) {
+      if (abort.signal.aborted) return { ...base, type: "terminal_result", folderId: root.id, path: frame.path ?? "", output: error.output ?? { stdout: "", stderr: "", exitCode: null, canceled: true } };
+      throw error;
+    } finally {
+      this.active.delete(frame.id);
+      complete();
+    }
   }
   async frame(frame) {
     if (this.closed) throw new Error("Stale device connection");
@@ -220,6 +278,7 @@ class DeviceAgent {
       this.close();
       throw new Error("Device authorization expired");
     }
+    if (["terminal_exec", "terminal_cancel", "terminal_close"].includes(frame.type)) return this.terminalFrame(frame);
     const base = { id: frame.id, consultationId: frame.consultationId, bindingId: frame.bindingId, roundId: frame.roundId };
     if (frame.type === "cancel") {
       await this.cancel(frame);
@@ -303,7 +362,9 @@ async function start(server, config, credential, directories, { name, noOpen, si
       const url = new URL("/api/local-cli/connect", server);
       url.protocol = url.protocol === "https:" ? "wss:" : "ws:";
       const ws = new WebSocket(url, { headers: { Authorization: `Bearer ${credential.token}` }, maxPayload: 15 * 1024 * 1024, handshakeTimeout: 15e3, followRedirects: false });
-      const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt });
+      const agent = new DeviceAgent(roots, { restricted, privateDir: config.directory, token: credential.token, expiresAt: credential.expiresAt,
+        onTerminalOutput: frame => { if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(frame)); },
+      });
       let ready = false;
       let heartbeat;
       const cleanup = () => {
@@ -318,7 +379,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
       };
       signal?.addEventListener("abort", abort, { once: true });
       ws.on("open", () => {
-        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true }));
+        ws.send(JSON.stringify({ type: "hello", protocol: PROTOCOL, consentVersion: "yep-device-v2", directoryMode: restricted ? "restricted" : "system", folders: agent.publicRoots(), commandsEnabled: true, fileSelection: true, capabilities: ["terminal"] }));
       });
       ws.on("unexpected-response", (_req, res) => {
         if ([401, 403].includes(res.statusCode)) {
@@ -336,7 +397,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
             agent.connectionId = frame.connectionId;
             ready = true;
             delay = 1e3;
-            console.log("设备已上线。请在网页选择目录；退出此终端将断开。");
+            console.log("设备已上线。可在网页设备节点中打开终端，或在咨询中选择目录；退出此进程将断开。");
             heartbeat = setInterval(() => {
               if (Date.now() >= Date.parse(credential.expiresAt)) {
                 fatal = new Error("Device authorization expired");
@@ -367,7 +428,7 @@ async function start(server, config, credential, directories, { name, noOpen, si
           if (frame?.id && ws.readyState === WebSocket.OPEN) {
             let error = String(e.message).split(credential.token).join("[REDACTED]").split(config.directory).join("[私有目录]");
             for (const root of [...agent.roots].sort((a, b) => b.absolute.length - a.absolute.length)) error = error.split(root.absolute).join("[授权目录]");
-            ws.send(JSON.stringify({ type: "result", id: frame.id, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
+            ws.send(JSON.stringify({ type: frame.type?.startsWith("terminal_") ? "terminal_error" : "result", id: frame.id, sessionId: frame.sessionId, bindingId: frame.bindingId, consultationId: frame.consultationId, error: error.slice(0, 8192) }));
           } else {
             fatal = e;
             ws.close();

package/lib/device/tools.js

@@ -2,6 +2,7 @@ import fs from "node:fs/promises";
 import { constants as FS } from "node:fs";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 const MAX_FILE = 10 * 1024 * 1024;
 const MAX_OUTPUT = 64 * 1024;
 function safeRelative(value = "") {
@@ -189,19 +190,92 @@ async function builtin(root, cwd, command) {
   if (cmd === "wc" && args.length === 2 && args[0] === "-l") return { text: String((await read(args[1])).split("\n").length - 1) + "\n" };
   throw new Error("Unsupported restricted command");
 }
-async function execute(root, request, { restricted = true, signal, secrets = [] } = {}) {
+function parseTerminalDirectory(command, windows = process.platform === "win32") {
+  if (!/^\s*cd(?:\s|$)/iu.test(command)) return null;
+  if (/[\0\r\n]/u.test(command)) throw new Error("Usage: cd [directory]; run other commands separately");
+  let target = command.trim().slice(2).trim();
+  if (windows && /^\/d(?:\s|$)/iu.test(target)) target = target.slice(2).trim();
+  if (!target) return "";
+  const quote = target[0];
+  if (quote === '"' || quote === "'") {
+    // A directory name is interpreted literally, never as shell source.
+    // Windows backslashes must survive quotation rather than become escapes.
+    if (target.at(-1) !== quote || target.slice(1, -1).includes(quote)) throw new Error("Usage: cd [directory]; run other commands separately");
+    return target.slice(1, -1);
+  }
+  if (/[\s|&;<>$`%!*?()[\]{}"']/u.test(target)) throw new Error("Usage: cd [directory]; run other commands separately");
+  return target;
+}
+async function terminalDirectory(root, cwd, command, restricted) {
+  let target;
+  try {
+    target = parseTerminalDirectory(command);
+  } catch (error) {
+    // Only a standalone literal cd changes the simulated terminal directory.
+    // In system mode, compound commands and shell expressions run normally in
+    // their own shell, whose working directory lasts for that command only.
+    if (!restricted) return null;
+    throw error;
+  }
+  if (target === null) return null;
+  await resolveSafe(root, cwd, "directory");
+  if (!restricted && (target === "~" || target.startsWith("~/"))) {
+    target = path.join(process.env.USERPROFILE || process.env.HOME || root.absolute, target.slice(2));
+  }
+  let relative;
+  if (path.isAbsolute(target)) {
+    if (restricted) throw new Error("Use a relative directory inside the authorized root");
+    relative = path.relative(root.absolute, path.resolve(target)).split(path.sep).join("/");
+  } else {
+    if (process.platform === "win32") target = target.replaceAll("\\", "/");
+    relative = target ? path.posix.normalize([cwd, target].filter(Boolean).join("/")) : "";
+  }
+  if (relative === ".") relative = "";
+  await resolveSafe(root, relative, "directory");
+  return relative;
+}
+// Retain an unfinished secret prefix across chunks so streaming cannot expose a
+// token that happened to cross a stdout/stderr packet boundary.
+function outputRedactor(secrets, emit) {
+  const values = [...new Set(secrets.filter(value => typeof value === "string" && value))].sort((a, b) => b.length - a.length);
+  let pending = "";
+  return (text, final = false, truncated = false) => {
+    pending += text;
+    for (const secret of values) pending = pending.split(secret).join("[REDACTED]");
+    let tail = 0;
+    for (const secret of values) {
+      for (let length = Math.min(secret.length - 1, pending.length); length > tail; length--) {
+        if (pending.endsWith(secret.slice(0, length))) { tail = length; break; }
+      }
+    }
+    if (final) {
+      if (truncated && tail) pending = pending.slice(0, -tail) + "[REDACTED]";
+      if (pending) emit(pending);
+      pending = "";
+    } else {
+      const ready = pending.slice(0, pending.length - tail);
+      pending = pending.slice(pending.length - tail);
+      if (ready) emit(ready);
+    }
+  };
+}
+async function execute(root, request, { restricted = true, signal, secrets = [], onOutput } = {}) {
+  if (signal?.aborted) throw new Error("Operation canceled");
   if (request.operation !== "exec") return fileOperation(root, request);
   if (restricted) {
     const result = await builtin(root, request.path ?? "", request.command);
-    return { stdout: result.text, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
+    if (signal?.aborted) throw new Error("Operation canceled");
+    let stdout = "";
+    outputRedactor(secrets, text => { stdout += text; onOutput?.("stdout", text); })(result.text, true, result.truncated);
+    return { stdout, stderr: "", exitCode: 0, truncated: result.truncated ?? false };
   }
   const { absolute } = await resolveSafe(root, request.path ?? "", "directory");
   if (typeof request.command !== "string" || request.command.length > 4096 || request.command.includes("\0")) throw new Error("Invalid command");
   return new Promise((resolve, reject) => {
     const env = { ...process.env };
     for (const k of Object.keys(env)) if (/TOKEN|SECRET|PASSWORD|API_KEY|AUTHORIZATION/iu.test(k)) delete env[k];
-    const child = spawn(process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "/bin/sh", process.platform === "win32" ? ["/d", "/s", "/c", request.command] : ["-c", request.command], { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true });
-    let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false;
+    const child = spawn(process.platform === "win32" ? process.env.ComSpec || "cmd.exe" : "/bin/sh", process.platform === "win32" ? ["/d", "/s", "/c", request.command] : ["-c", request.command], { cwd: absolute, env, detached: process.platform !== "win32", windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "", stderr = "", bytes = 0, truncated = false, timedOut = false, streamError;
     const kill = () => {
       if (process.platform === "win32") {
         spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], { windowsHide: true, stdio: "ignore" });
@@ -220,13 +294,19 @@ async function execute(root, request, { restricted = true, signal, secrets = []
     const abort = () => kill();
     signal?.addEventListener("abort", abort, { once: true });
     if (signal?.aborted) kill();
+    const decoders = { stdout: new StringDecoder("utf8"), stderr: new StringDecoder("utf8") };
+    const redact = Object.fromEntries(["stdout", "stderr"].map(which => [which, outputRedactor(secrets, text => {
+      if (which === "stdout") stdout += text;
+      else stderr += text;
+      if (!signal?.aborted && !streamError) {
+        try { onOutput?.(which, text); } catch (error) { streamError = error; kill(); }
+      }
+    })]));
     const append = (which, chunk) => {
       const room = Math.max(0, MAX_OUTPUT - bytes);
-      const s = chunk.subarray(0, room).toString("utf8");
       bytes += chunk.length;
       if (bytes > MAX_OUTPUT) truncated = true;
-      if (which === "stdout") stdout += s;
-      else stderr += s;
+      redact[which](decoders[which].write(chunk.subarray(0, room)));
     };
     child.stdout.on("data", (c) => append("stdout", c));
     child.stderr.on("data", (c) => append("stderr", c));
@@ -238,12 +318,13 @@ async function execute(root, request, { restricted = true, signal, secrets = []
     child.once("close", (code, sig) => {
       clearTimeout(timer);
       signal?.removeEventListener("abort", abort);
-      if (signal?.aborted) return reject(new Error("Operation canceled"));
-      for (const secret of secrets) if (secret) {
-        stdout = stdout.split(secret).join("[REDACTED]");
-        stderr = stderr.split(secret).join("[REDACTED]");
+      for (const which of ["stdout", "stderr"]) redact[which](decoders[which].end(), true, truncated);
+      if (signal?.aborted) {
+        const error = new Error("Operation canceled");
+        error.output = { stdout, stderr, exitCode: null, canceled: true, truncated, timedOut };
+        return reject(error);
       }
-      ;
+      if (streamError) return reject(streamError);
       resolve({ stdout, stderr, exitCode: code, signal: sig, truncated, timedOut });
     });
   });
@@ -256,5 +337,7 @@ export {
   list,
   resolveSafe,
   rootDescriptor,
-  safeRelative
+  safeRelative,
+  terminalDirectory,
+  parseTerminalDirectory
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yep-ai/cli",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Yep Marketplace unified CLI: skills, agents, plugins and authorized device nodes.",
   "type": "module",
   "bin": {