@zqagent/core 0.2.20 → 0.3.6

package/dist/tools/git.d.cts

@@ -1,204 +1,4 @@
-import { T as ToolRegistry } from '../ToolRegistry-C3pTFiaJ.cjs';
-
-/** git_log — 提交历史 */
-declare function makeGitLog(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    count?: undefined;
-    commits?: undefined;
-} | {
-    repo: string;
-    count: number;
-    commits: ({
-        hash: string;
-        author: string;
-        date: string;
-        subject: string;
-        raw?: undefined;
-    } | {
-        raw: string;
-        hash?: undefined;
-        author?: undefined;
-        date?: undefined;
-        subject?: undefined;
-    })[];
-    error?: undefined;
-}>;
-/** git_status — 工作区状态 */
-declare function makeGitStatus(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    clean?: undefined;
-    entries?: undefined;
-    count?: undefined;
-} | {
-    repo: string;
-    clean: boolean;
-    entries: {
-        status: string;
-        file: string;
-        index: string;
-        worktree: string;
-    }[];
-    count: number;
-    error?: undefined;
-}>;
-/** git_diff — 差异对比 */
-declare function makeGitDiff(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    staged?: undefined;
-    path?: undefined;
-    diff?: undefined;
-    truncated?: undefined;
-} | {
-    repo: string;
-    staged: boolean;
-    path: string | null;
-    diff: string;
-    truncated: boolean;
-    error?: undefined;
-}>;
-/** 注册 Git 工具 */
-declare function registerGitTools(registry: ToolRegistry, workspace: string): void;
-/** 写操作结果：ok=false 时 error 为可直接展示给用户的原因 */
-interface GitOpResult {
-    ok: boolean;
-    stdout: string;
-    stderr: string;
-    error?: string;
-}
-/** 分支名校验（拒绝空、选项注入与 git 非法字符）；返回 null 表示可用 */
-declare function gitRefProblem(name: string): string | null;
-/** git_branches — 本地分支列表 + 当前分支（detached 时 current 为短 hash） */
-declare function makeGitBranches(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    current?: undefined;
-    detached?: undefined;
-    branches?: undefined;
-} | {
-    repo: string;
-    current: string;
-    detached: boolean;
-    branches: {
-        upstream?: string | undefined;
-        name: string;
-        current: boolean;
-    }[];
-    error?: undefined;
-}>;
-/** 提交标识（hash / ref 名）校验：拒绝空、选项注入与 git 非法字符；返回 null 表示可用 */
-declare function gitObjectProblem(name: string): string | null;
-/**
- * git_refs — 引用列表（控制台 Git 面板）
- *
- * 一次返回本地分支 / 远程分支 / 标签三组，供面板分组展示与切换。
- * 远程分支与标签只有在 `git fetch` 之后才是服务端的最新状态（见 makeGitFetch）。
- */
-declare function makeGitRefs(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    current?: undefined;
-    detached?: undefined;
-    local?: undefined;
-    remote?: undefined;
-    tags?: undefined;
-} | {
-    repo: string;
-    current: string;
-    detached: boolean;
-    local: {
-        name: string;
-        current?: boolean;
-        upstream?: string;
-    }[];
-    remote: {
-        name: string;
-    }[];
-    tags: {
-        name: string;
-        target?: string;
-    }[];
-    error?: undefined;
-}>;
-/**
- * git_show — 单次提交详情（meta + 变更文件 + diff）
- *
- * path 省略时返回整个提交的 diff（截断 50000 字符）；给出 path 时只返回该文件
- * 在此提交中的 diff（相对第一父提交，merge commit 也能给出可读结果）。
- */
-declare function makeGitShow(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    commit?: undefined;
-    files?: undefined;
-    path?: undefined;
-    diff?: undefined;
-    truncated?: undefined;
-} | {
-    repo: string;
-    commit: {
-        hash: string;
-        short: string;
-        author: string;
-        authorEmail: string;
-        date: string;
-        subject: string;
-        body: string;
-    };
-    files: {
-        status: string;
-        file: string;
-    }[];
-    path: string | null;
-    diff: string;
-    truncated: boolean;
-    error?: undefined;
-}>;
-/** git_stage — 暂存文件（paths 为空 = 全部改动） */
-declare function makeGitStage(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_unstage — 取消暂存（paths 为空 = 全部） */
-declare function makeGitUnstage(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_commit — 提交已暂存内容 */
-declare function makeGitCommit(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_checkout — 切换分支（create=true 时新建并切换） */
-declare function makeGitCheckout(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_pull — 拉取当前分支的上游 */
-declare function makeGitPull(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_push — 推送当前分支（无 upstream 且存在 origin 时按首次推送补 -u） */
-declare function makeGitPush(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_fetch — 刷新服务端分支与标签（--all --prune --tags） */
-declare function makeGitFetch(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-interface GitRepoInfo {
-    /** 相对工作区的路径；根仓库为 "" */
-    path: string;
-    /** 目录名（根仓库为工作区目录名） */
-    name: string;
-    /** 当前分支；detached 时为短 hash */
-    branch?: string;
-    detached?: boolean;
-}
-/**
- * 扫描工作区及其子目录中的 git 仓库。
- *
- * 遇到仓库后仍继续向下扫描：子模块与「仓库里嵌套独立仓库」的工程都能被发现。
- * 根仓库排在第一位，其余按相对路径排序。
- */
-declare function scanGitRepos(workspace: string, depth?: number): {
-    repos: GitRepoInfo[];
-    truncated?: boolean;
-};
-/** git_repos — 列出工作区内的所有 git 仓库（控制台 Git 面板的仓库选择器） */
-declare function makeGitRepos(workspace: string): (args: Record<string, unknown>) => Promise<{
-    root: string;
-    repos: never[];
-    error: string;
-} | {
-    repos: GitRepoInfo[];
-    truncated?: boolean;
-    root: string;
-    error?: undefined;
-}>;
-
-export { type GitOpResult, type GitRepoInfo, gitObjectProblem, gitRefProblem, makeGitBranches, makeGitCheckout, makeGitCommit, makeGitDiff, makeGitFetch, makeGitLog, makeGitPull, makeGitPush, makeGitRefs, makeGitRepos, makeGitShow, makeGitStage, makeGitStatus, makeGitUnstage, registerGitTools, scanGitRepos };
+import '../ToolRegistry-DouDvn9E.cjs';
+export { GitOpResult, GitRepoInfo, gitObjectProblem, gitRefProblem, makeGitBranches, makeGitCheckout, makeGitCommit, makeGitDiff, makeGitFetch, makeGitLog, makeGitPull, makeGitPush, makeGitRefs, makeGitRepos, makeGitShow, makeGitStage, makeGitStatus, makeGitUnstage, registerGitTools, scanGitRepos } from '../internal/tools/git.cjs';
+import '../types-BYyXWWPW.cjs';
+import '@zqagent/shared/model-capabilities';

package/dist/tools/git.d.ts

@@ -1,204 +1,4 @@
-import { T as ToolRegistry } from '../ToolRegistry-C3pTFiaJ.js';
-
-/** git_log — 提交历史 */
-declare function makeGitLog(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    count?: undefined;
-    commits?: undefined;
-} | {
-    repo: string;
-    count: number;
-    commits: ({
-        hash: string;
-        author: string;
-        date: string;
-        subject: string;
-        raw?: undefined;
-    } | {
-        raw: string;
-        hash?: undefined;
-        author?: undefined;
-        date?: undefined;
-        subject?: undefined;
-    })[];
-    error?: undefined;
-}>;
-/** git_status — 工作区状态 */
-declare function makeGitStatus(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    clean?: undefined;
-    entries?: undefined;
-    count?: undefined;
-} | {
-    repo: string;
-    clean: boolean;
-    entries: {
-        status: string;
-        file: string;
-        index: string;
-        worktree: string;
-    }[];
-    count: number;
-    error?: undefined;
-}>;
-/** git_diff — 差异对比 */
-declare function makeGitDiff(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    staged?: undefined;
-    path?: undefined;
-    diff?: undefined;
-    truncated?: undefined;
-} | {
-    repo: string;
-    staged: boolean;
-    path: string | null;
-    diff: string;
-    truncated: boolean;
-    error?: undefined;
-}>;
-/** 注册 Git 工具 */
-declare function registerGitTools(registry: ToolRegistry, workspace: string): void;
-/** 写操作结果：ok=false 时 error 为可直接展示给用户的原因 */
-interface GitOpResult {
-    ok: boolean;
-    stdout: string;
-    stderr: string;
-    error?: string;
-}
-/** 分支名校验（拒绝空、选项注入与 git 非法字符）；返回 null 表示可用 */
-declare function gitRefProblem(name: string): string | null;
-/** git_branches — 本地分支列表 + 当前分支（detached 时 current 为短 hash） */
-declare function makeGitBranches(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    current?: undefined;
-    detached?: undefined;
-    branches?: undefined;
-} | {
-    repo: string;
-    current: string;
-    detached: boolean;
-    branches: {
-        upstream?: string | undefined;
-        name: string;
-        current: boolean;
-    }[];
-    error?: undefined;
-}>;
-/** 提交标识（hash / ref 名）校验：拒绝空、选项注入与 git 非法字符；返回 null 表示可用 */
-declare function gitObjectProblem(name: string): string | null;
-/**
- * git_refs — 引用列表（控制台 Git 面板）
- *
- * 一次返回本地分支 / 远程分支 / 标签三组，供面板分组展示与切换。
- * 远程分支与标签只有在 `git fetch` 之后才是服务端的最新状态（见 makeGitFetch）。
- */
-declare function makeGitRefs(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    current?: undefined;
-    detached?: undefined;
-    local?: undefined;
-    remote?: undefined;
-    tags?: undefined;
-} | {
-    repo: string;
-    current: string;
-    detached: boolean;
-    local: {
-        name: string;
-        current?: boolean;
-        upstream?: string;
-    }[];
-    remote: {
-        name: string;
-    }[];
-    tags: {
-        name: string;
-        target?: string;
-    }[];
-    error?: undefined;
-}>;
-/**
- * git_show — 单次提交详情（meta + 变更文件 + diff）
- *
- * path 省略时返回整个提交的 diff（截断 50000 字符）；给出 path 时只返回该文件
- * 在此提交中的 diff（相对第一父提交，merge commit 也能给出可读结果）。
- */
-declare function makeGitShow(workspace: string): (args: Record<string, unknown>) => Promise<{
-    error: string;
-    repo?: undefined;
-    commit?: undefined;
-    files?: undefined;
-    path?: undefined;
-    diff?: undefined;
-    truncated?: undefined;
-} | {
-    repo: string;
-    commit: {
-        hash: string;
-        short: string;
-        author: string;
-        authorEmail: string;
-        date: string;
-        subject: string;
-        body: string;
-    };
-    files: {
-        status: string;
-        file: string;
-    }[];
-    path: string | null;
-    diff: string;
-    truncated: boolean;
-    error?: undefined;
-}>;
-/** git_stage — 暂存文件（paths 为空 = 全部改动） */
-declare function makeGitStage(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_unstage — 取消暂存（paths 为空 = 全部） */
-declare function makeGitUnstage(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_commit — 提交已暂存内容 */
-declare function makeGitCommit(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_checkout — 切换分支（create=true 时新建并切换） */
-declare function makeGitCheckout(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_pull — 拉取当前分支的上游 */
-declare function makeGitPull(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_push — 推送当前分支（无 upstream 且存在 origin 时按首次推送补 -u） */
-declare function makeGitPush(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-/** git_fetch — 刷新服务端分支与标签（--all --prune --tags） */
-declare function makeGitFetch(workspace: string): (args: Record<string, unknown>) => Promise<GitOpResult>;
-interface GitRepoInfo {
-    /** 相对工作区的路径；根仓库为 "" */
-    path: string;
-    /** 目录名（根仓库为工作区目录名） */
-    name: string;
-    /** 当前分支；detached 时为短 hash */
-    branch?: string;
-    detached?: boolean;
-}
-/**
- * 扫描工作区及其子目录中的 git 仓库。
- *
- * 遇到仓库后仍继续向下扫描：子模块与「仓库里嵌套独立仓库」的工程都能被发现。
- * 根仓库排在第一位，其余按相对路径排序。
- */
-declare function scanGitRepos(workspace: string, depth?: number): {
-    repos: GitRepoInfo[];
-    truncated?: boolean;
-};
-/** git_repos — 列出工作区内的所有 git 仓库（控制台 Git 面板的仓库选择器） */
-declare function makeGitRepos(workspace: string): (args: Record<string, unknown>) => Promise<{
-    root: string;
-    repos: never[];
-    error: string;
-} | {
-    repos: GitRepoInfo[];
-    truncated?: boolean;
-    root: string;
-    error?: undefined;
-}>;
-
-export { type GitOpResult, type GitRepoInfo, gitObjectProblem, gitRefProblem, makeGitBranches, makeGitCheckout, makeGitCommit, makeGitDiff, makeGitFetch, makeGitLog, makeGitPull, makeGitPush, makeGitRefs, makeGitRepos, makeGitShow, makeGitStage, makeGitStatus, makeGitUnstage, registerGitTools, scanGitRepos };
+import '../ToolRegistry-Cy0fQxrb.js';
+export { GitOpResult, GitRepoInfo, gitObjectProblem, gitRefProblem, makeGitBranches, makeGitCheckout, makeGitCommit, makeGitDiff, makeGitFetch, makeGitLog, makeGitPull, makeGitPush, makeGitRefs, makeGitRepos, makeGitShow, makeGitStage, makeGitStatus, makeGitUnstage, registerGitTools, scanGitRepos } from '../internal/tools/git.js';
+import '../types-BYyXWWPW.js';
+import '@zqagent/shared/model-capabilities';

package/dist/tools/git.js

@@ -1,6 +1,6 @@
 // src/tools/git.ts
 import * as fs from "fs";
-import * as path from "path";
+import * as path2 from "path";
 
 // src/tools/execAsync.ts
 import { spawn } from "child_process";
@@ -65,12 +65,12 @@ function makeSink(maxBuffer) {
   };
 }
 function execAsync(file, argv, opts = {}) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve3) => {
     const maxBuffer = opts.maxBuffer ?? DEFAULT_MAX_BUFFER;
     const out = makeSink(maxBuffer);
     const err = makeSink(maxBuffer);
     if (opts.signal?.aborted) {
-      resolve2({
+      resolve3({
         status: null,
         stdout: Buffer.alloc(0),
         stderr: Buffer.alloc(0),
@@ -91,7 +91,7 @@ function execAsync(file, argv, opts = {}) {
         windowsHide: true
       });
     } catch (e) {
-      resolve2({
+      resolve3({
         status: null,
         stdout: Buffer.alloc(0),
         stderr: Buffer.alloc(0),
@@ -128,7 +128,7 @@ function execAsync(file, argv, opts = {}) {
       };
       if (aborted) result.aborted = true;
       if (spawnError) result.error = spawnError;
-      resolve2(result);
+      resolve3(result);
     };
     const killAndSettle = () => {
       killTree(child.pid);
@@ -287,6 +287,9 @@ var ShellTaskManager = class {
   }
 };
 
+// src/tools/sandbox.ts
+import { spawnSync as spawnSync2 } from "child_process";
+
 // src/tools/shell.ts
 var MAX_BUFFER = 1024 * 1024 * 5;
 function decodeOutput(buf) {
@@ -305,6 +308,12 @@ function decodeOutput(buf) {
 }
 var shellTasks = new ShellTaskManager();
 
+// src/tools/pathSafety.ts
+import * as path from "path";
+function isInsideRelative(rel) {
+  return !path.isAbsolute(rel) && rel !== ".." && !rel.startsWith(`..${path.sep}`);
+}
+
 // src/tools/git.ts
 async function runGit(repoDir, args, timeout = 15e3) {
   const res = await execAsync("git", ["-c", "core.quotepath=false", ...args], {
@@ -322,9 +331,9 @@ async function runGit(repoDir, args, timeout = 15e3) {
 async function resolveRepoRoot(workspace, pathArg) {
   let dir = workspace;
   if (pathArg) {
-    const abs = path.resolve(workspace, pathArg);
+    const abs = path2.resolve(workspace, pathArg);
     try {
-      dir = fs.statSync(abs).isDirectory() ? abs : path.dirname(abs);
+      dir = fs.statSync(abs).isDirectory() ? abs : path2.dirname(abs);
     } catch {
       dir = abs;
     }
@@ -337,24 +346,24 @@ function repoDirArg(workspace, raw) {
   if (typeof raw !== "string") return void 0;
   const v = raw.trim();
   if (!v) return void 0;
-  const base = path.resolve(workspace);
-  const abs = path.resolve(base, v);
-  const rel = path.relative(base, abs);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) return void 0;
+  const base = path2.resolve(workspace);
+  const abs = path2.resolve(base, v);
+  const rel = path2.relative(base, abs);
+  if (!isInsideRelative(rel)) return void 0;
   return abs;
 }
 function toPathspec(repoRoot, workspace, pathArg) {
   if (!pathArg) return null;
-  const abs = path.resolve(workspace, pathArg);
-  let rel = path.relative(repoRoot, abs);
+  const abs = path2.resolve(workspace, pathArg);
+  let rel = path2.relative(repoRoot, abs);
   if (rel === "") return ".";
-  if (rel.startsWith("..") || path.isAbsolute(rel)) {
+  if (!isInsideRelative(rel)) {
     try {
       const realRepo = fs.realpathSync(repoRoot);
       const realAbs = fs.realpathSync(abs);
-      const rel2 = path.relative(realRepo, realAbs);
+      const rel2 = path2.relative(realRepo, realAbs);
       if (rel2 === "") return ".";
-      if (!rel2.startsWith("..") && !path.isAbsolute(rel2)) return rel2;
+      if (isInsideRelative(rel2)) return rel2;
     } catch {
     }
     return null;
@@ -780,16 +789,16 @@ var SCAN_SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".hg", ".s
 var SCAN_DEFAULT_DEPTH = 3;
 var SCAN_MAX_DIRS = 2e3;
 function readRepoHead(repoDir) {
-  const dotGit = path.join(repoDir, ".git");
+  const dotGit = path2.join(repoDir, ".git");
   try {
     let headFile;
     if (fs.statSync(dotGit).isDirectory()) {
-      headFile = path.join(dotGit, "HEAD");
+      headFile = path2.join(dotGit, "HEAD");
     } else {
       const raw = fs.readFileSync(dotGit, "utf-8");
       const m = /^gitdir:\s*(.+)$/m.exec(raw);
       if (!m) return {};
-      headFile = path.join(path.resolve(repoDir, m[1].trim()), "HEAD");
+      headFile = path2.join(path2.resolve(repoDir, m[1].trim()), "HEAD");
     }
     const head = fs.readFileSync(headFile, "utf-8").trim();
     const prefix = "ref: refs/heads/";
@@ -800,7 +809,7 @@ function readRepoHead(repoDir) {
   return {};
 }
 function scanGitRepos(workspace, depth = SCAN_DEFAULT_DEPTH) {
-  const root = path.resolve(workspace);
+  const root = path2.resolve(workspace);
   const maxDepth = Number.isFinite(depth) ? Math.min(Math.max(Math.floor(depth), 0), 6) : SCAN_DEFAULT_DEPTH;
   const repos = [];
   const stack = [{ dir: root, depth: 0 }];
@@ -813,11 +822,11 @@ function scanGitRepos(workspace, depth = SCAN_DEFAULT_DEPTH) {
       truncated = true;
       break;
     }
-    const rel = path.relative(root, dir).split(path.sep).join("/");
-    if (fs.existsSync(path.join(dir, ".git"))) {
+    const rel = path2.relative(root, dir).split(path2.sep).join("/");
+    if (fs.existsSync(path2.join(dir, ".git"))) {
       repos.push({
         path: rel,
-        name: rel ? path.basename(dir) : path.basename(root),
+        name: rel ? path2.basename(dir) : path2.basename(root),
         ...readRepoHead(dir)
       });
     }
@@ -830,7 +839,7 @@ function scanGitRepos(workspace, depth = SCAN_DEFAULT_DEPTH) {
     }
     for (const e of entries) {
       if (!e.isDirectory() || SCAN_SKIP_DIRS.has(e.name)) continue;
-      stack.push({ dir: path.join(dir, e.name), depth: d + 1 });
+      stack.push({ dir: path2.join(dir, e.name), depth: d + 1 });
     }
   }
   repos.sort(
@@ -840,7 +849,7 @@ function scanGitRepos(workspace, depth = SCAN_DEFAULT_DEPTH) {
 }
 function makeGitRepos(workspace) {
   return async function git_repos(args) {
-    const root = path.resolve(workspace);
+    const root = path2.resolve(workspace);
     try {
       if (!fs.statSync(root).isDirectory()) return { root, repos: [], error: "\u5DE5\u4F5C\u533A\u4E0D\u662F\u76EE\u5F55" };
     } catch {