agentquad 0.3.0

package/src/routes/transcripts.js

@@ -0,0 +1,75 @@
+import express from 'express'
+
+export function createTranscriptsRouter({ service }) {
+  const router = express.Router()
+
+  router.post('/scan', async (_req, res) => {
+    try {
+      const r = await service.scanIncremental()
+      res.json({ ok: true, ...r })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/stats', (_req, res) => {
+    res.json({ ok: true, ...service.getStats() })
+  })
+
+  router.get('/search', (req, res) => {
+    try {
+      const { q, tool, cwd, since, unboundOnly, limit, offset } = req.query
+      const r = service.search({
+        q: q ? String(q) : undefined,
+        tool: tool ? String(tool) : undefined,
+        cwd: cwd ? String(cwd) : undefined,
+        since: since ? Number(since) : undefined,
+        unboundOnly: unboundOnly === '1' || unboundOnly === 'true',
+        limit: limit ? Math.min(Number(limit), 200) : 50,
+        offset: offset ? Number(offset) : 0,
+      })
+      res.json({ ok: true, ...r })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/:fileId', (req, res) => {
+    const f = service.getFile(Number(req.params.fileId))
+    if (!f) return res.status(404).json({ ok: false, error: 'not found' })
+    res.json({ ok: true, file: f })
+  })
+
+  router.get('/:fileId/preview', async (req, res) => {
+    try {
+      const r = await service.preview(Number(req.params.fileId), {
+        offset: req.query.offset ? Number(req.query.offset) : 0,
+        limit: req.query.limit ? Math.min(Number(req.query.limit), 500) : 200,
+      })
+      if (!r) return res.status(404).json({ ok: false, error: 'not found' })
+      res.json({ ok: true, ...r })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.post('/:fileId/bind', (req, res) => {
+    const { todoId, force } = req.body || {}
+    if (!todoId) return res.status(400).json({ ok: false, error: 'todoId required' })
+    const r = service.bind(Number(req.params.fileId), String(todoId), { force: Boolean(force) })
+    if (!r.ok) {
+      if (r.code === 'ALREADY_BOUND') return res.status(409).json({ ok: false, code: r.code, currentTodoId: r.currentTodoId })
+      if (r.code === 'NOT_FOUND') return res.status(404).json({ ok: false, error: 'not found' })
+      return res.status(400).json({ ok: false, code: r.code })
+    }
+    res.json({ ok: true })
+  })
+
+  router.post('/:fileId/unbind', (req, res) => {
+    const r = service.unbind(Number(req.params.fileId))
+    if (!r.ok) return res.status(404).json({ ok: false, error: 'not found' })
+    res.json({ ok: true })
+  })
+
+  return router
+}

package/src/routes/uploads.js

@@ -0,0 +1,107 @@
+/**
+ * Web 端粘贴/拖拽图片上传：
+ *   POST /api/uploads/image
+ *     body: { filename: 'paste.png', mime: 'image/png', dataBase64: '...' }
+ *     返回：{ ok: true, path: '/Users/.../...png', fileSize: number }
+ *
+ * 用 base64 JSON 而不是 multipart：
+ *   - 不引新依赖（multer / busboy）
+ *   - 粘贴图通常 <2MB，base64 33% 开销可忍
+ *   - 大文件 / 多文件场景以后真有需求再换 multipart
+ *
+ * 文件落到 ~/.agentquad/web-uploads/<ts>-<rand>.<ext>，跟 telegram tg-uploads 同模式。
+ */
+import { Router } from 'express'
+import { mkdirSync, writeFileSync, statSync, realpathSync } from 'node:fs'
+import { join, resolve as resolvePath, sep } from 'node:path'
+import { Buffer } from 'node:buffer'
+import { DEFAULT_ROOT_DIR } from '../config.js'
+
+const DEFAULT_UPLOAD_DIR = join(DEFAULT_ROOT_DIR, 'web-uploads')
+const MAX_BYTES = 20 * 1024 * 1024  // 20MB，跟 telegram 一致
+
+const SAFE_EXTS = new Set([
+  'png', 'jpg', 'jpeg', 'gif', 'webp', 'bmp', 'svg', 'heic', 'heif',
+  'pdf', 'txt', 'md', 'json', 'log', 'csv',
+])
+
+function sanitizeExt(filename, mime) {
+  // 优先 filename 后缀；缺失或不安全 → 退到 mime 推断
+  const m = String(filename || '').match(/\.([a-zA-Z0-9]{1,8})$/)
+  let ext = m ? m[1].toLowerCase() : null
+  if (!ext || !SAFE_EXTS.has(ext)) {
+    if (/^image\/(png|jpeg|jpg|gif|webp|bmp|svg)/.test(mime || '')) {
+      ext = mime.split('/')[1].replace('+xml', '').toLowerCase()
+    } else if (/^application\/pdf/.test(mime || '')) {
+      ext = 'pdf'
+    } else {
+      ext = 'bin'
+    }
+  }
+  return ext
+}
+
+export function createUploadsRouter({ uploadDir = DEFAULT_UPLOAD_DIR, logger = console } = {}) {
+  const router = Router()
+
+  router.post('/image', (req, res) => {
+    try {
+      const { filename, mime, dataBase64 } = req.body || {}
+      if (!dataBase64 || typeof dataBase64 !== 'string') {
+        return res.status(400).json({ ok: false, error: 'dataBase64_required' })
+      }
+      // 大致预估 base64 解码后大小：bytes ≈ b64len * 3/4
+      if (dataBase64.length * 3 / 4 > MAX_BYTES) {
+        return res.status(413).json({ ok: false, error: 'file_too_large', limitMB: 20 })
+      }
+      const buf = Buffer.from(dataBase64, 'base64')
+      if (buf.length > MAX_BYTES) {
+        return res.status(413).json({ ok: false, error: 'file_too_large', limitMB: 20 })
+      }
+      mkdirSync(uploadDir, { recursive: true })
+      const ext = sanitizeExt(filename, mime)
+      const localName = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}.${ext}`
+      const localPath = join(uploadDir, localName)
+      writeFileSync(localPath, buf)
+      logger.info?.(`[uploads] saved ${(buf.length / 1024).toFixed(1)}kB → ${localPath}`)
+      res.json({ ok: true, path: localPath, fileSize: buf.length, ext })
+    } catch (e) {
+      logger.warn?.(`[uploads] save failed: ${e.message}`)
+      res.status(500).json({ ok: false, error: e.message || 'upload_failed' })
+    }
+  })
+
+  router.get('/file', (req, res) => {
+    try {
+      const raw = String(req.query.path || '')
+      if (!raw) return res.status(400).json({ ok: false, error: 'path_required' })
+      // Resolve symlinks for both root and file so a symlink inside the upload
+      // dir can't escape the sandbox.
+      let rootAbs
+      try { rootAbs = realpathSync(resolvePath(uploadDir)) + sep } catch {
+        // upload dir doesn't exist yet → nothing inside it can possibly be served
+        return res.status(404).json({ ok: false, error: 'not_found' })
+      }
+      let fileAbs
+      try { fileAbs = realpathSync(resolvePath(raw)) } catch {
+        return res.status(404).json({ ok: false, error: 'not_found' })
+      }
+      if (!(fileAbs + sep).startsWith(rootAbs)) {
+        return res.status(403).json({ ok: false, error: 'forbidden_path' })
+      }
+      const st = statSync(fileAbs)
+      if (!st.isFile()) return res.status(404).json({ ok: false, error: 'not_a_file' })
+      // Defensive headers: prevent SVG/HTML uploads from executing scripts when
+      // served back. Content-Type is still inferred by sendFile from extension.
+      res.set('Content-Disposition', 'inline')
+      res.set('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; sandbox")
+      res.set('X-Content-Type-Options', 'nosniff')
+      return res.sendFile(fileAbs)
+    } catch (e) {
+      logger.warn?.(`[uploads] serve failed: ${e.message}`)
+      res.status(500).json({ ok: false, error: e.message || 'serve_failed' })
+    }
+  })
+
+  return router
+}

package/src/routes/wiki.js

@@ -0,0 +1,142 @@
+import { Router } from 'express'
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join, resolve, relative } from 'node:path'
+
+function walkDir(root, current = root, out = [], maxDepth = 5, depth = 0) {
+  if (depth > maxDepth) return out
+  let entries = []
+  try { entries = readdirSync(current, { withFileTypes: true }) } catch { return out }
+  for (const e of entries) {
+    if (e.name === '.git') continue
+    const abs = join(current, e.name)
+    const rel = relative(root, abs)
+    if (e.isDirectory()) {
+      out.push({ path: rel, type: 'dir' })
+      walkDir(root, abs, out, maxDepth, depth + 1)
+    } else if (e.isFile()) {
+      let size = 0
+      try { size = statSync(abs).size } catch {}
+      out.push({ path: rel, type: 'file', size })
+    }
+  }
+  return out
+}
+
+function isPathSafe(wikiDir, relPath) {
+  if (typeof relPath !== 'string' || !relPath) return false
+  if (relPath.startsWith('/')) return false
+  const abs = resolve(wikiDir, relPath)
+  const wikiResolved = resolve(wikiDir)
+  return abs === wikiResolved || abs.startsWith(wikiResolved + '/')
+}
+
+export function createWikiRouter({ service }) {
+  const router = Router()
+
+  router.get('/status', (_req, res) => {
+    try {
+      res.json({ ok: true, status: service.status() })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/pending', (_req, res) => {
+    try {
+      res.json({ ok: true, list: service.pending() })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/tree', (_req, res) => {
+    try {
+      const s = service.status()
+      if (!existsSync(s.wikiDir)) {
+        res.json({ ok: true, files: [] })
+        return
+      }
+      res.json({ ok: true, files: walkDir(s.wikiDir) })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/file', (req, res) => {
+    try {
+      const s = service.status()
+      const p = typeof req.query.path === 'string' ? req.query.path : ''
+      if (!isPathSafe(s.wikiDir, p)) {
+        res.status(400).json({ ok: false, error: 'invalid_path' })
+        return
+      }
+      const abs = resolve(s.wikiDir, p)
+      if (!existsSync(abs)) {
+        res.status(404).json({ ok: false, error: 'not_found' })
+        return
+      }
+      const st = statSync(abs)
+      if (st.isDirectory()) {
+        res.status(400).json({ ok: false, error: 'is_directory' })
+        return
+      }
+      if (st.size > 2 * 1024 * 1024) {
+        res.status(400).json({ ok: false, error: 'file_too_large' })
+        return
+      }
+      res.json({ ok: true, path: p, content: readFileSync(abs, 'utf8') })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.post('/run', async (req, res) => {
+    try {
+      const { todoIds, dryRun = false } = req.body || {}
+      if (!Array.isArray(todoIds) || todoIds.length === 0) {
+        res.status(400).json({ ok: false, error: 'todoIds must be non-empty array' })
+        return
+      }
+      const result = await service.runOnce({ todoIds, dryRun: !!dryRun })
+      res.json({ ok: true, ...result })
+    } catch (e) {
+      const code = /already running/i.test(e.message) ? 409 : 500
+      res.status(code).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.post('/init', async (_req, res) => {
+    try {
+      const r = await service.init()
+      res.json({ ok: true, ...r })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.post('/open', async (_req, res) => {
+    try {
+      const s = service.status()
+      if (!s.wikiDir || !existsSync(s.wikiDir)) {
+        res.status(404).json({ ok: false, error: 'wiki_dir_missing' })
+        return
+      }
+      const { default: open } = await import('open')
+      await open(s.wikiDir)
+      res.json({ ok: true, wikiDir: s.wikiDir })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  router.get('/runs', (req, res) => {
+    try {
+      const limit = Math.max(1, Math.min(200, Number(req.query.limit) || 20))
+      res.json({ ok: true, list: service.listRuns(limit) })
+    } catch (e) {
+      res.status(500).json({ ok: false, error: e.message })
+    }
+  })
+
+  return router
+}

package/src/search/fts.js

@@ -0,0 +1,209 @@
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs'
+import { join } from 'node:path'
+
+/**
+ * 为 todos / comments / ai_sessions / wiki 建 4 张 FTS5 虚拟表并装同步触发器。
+ *
+ * 设计：
+ *   - todos.id / comments.id 是 TEXT UUID，FTS5 要求 INTEGER rowid，所以我们用
+ *     **standalone FTS5**（不绑 content='<base>'），用 UNINDEXED 的 todo_id / comment_id
+ *     字段把 UUID 存进去，触发器手动同步。
+ *   - ai_sessions 存在 todos.ai_session JSON 列里，用 UPDATE trigger + JSON_EACH 把
+ *     数组展开成多行 index。
+ *   - wiki_fts 没有触发器：由应用层在 wiki run 结束 / 服务启动时用 rebuildWikiFts 刷新。
+ *
+ * 所有表/触发器都是 `IF NOT EXISTS`，重复调用安全。
+ */
+export function initFtsTables(dbHandle) {
+  dbHandle.exec(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS todos_fts USING fts5(
+      todo_id UNINDEXED,
+      title, description,
+      tokenize='unicode61 remove_diacritics 2'
+    );
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS comments_fts USING fts5(
+      comment_id UNINDEXED,
+      todo_id    UNINDEXED,
+      body,
+      tokenize='unicode61 remove_diacritics 2'
+    );
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS ai_sessions_fts USING fts5(
+      todo_id    UNINDEXED,
+      session_id UNINDEXED,
+      label, command, native_session_id,
+      tokenize='unicode61 remove_diacritics 2'
+    );
+
+    CREATE VIRTUAL TABLE IF NOT EXISTS wiki_fts USING fts5(
+      todo_id UNINDEXED,
+      body,
+      tokenize='unicode61 remove_diacritics 2'
+    );
+  `)
+
+  // ── todos_fts 触发器 ──
+  dbHandle.exec(`
+    CREATE TRIGGER IF NOT EXISTS todos_fts_ai AFTER INSERT ON todos BEGIN
+      INSERT INTO todos_fts(todo_id, title, description)
+      VALUES (new.id, COALESCE(new.title, ''), COALESCE(new.description, ''));
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS todos_fts_ad AFTER DELETE ON todos BEGIN
+      DELETE FROM todos_fts WHERE todo_id = old.id;
+      DELETE FROM ai_sessions_fts WHERE todo_id = old.id;
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS todos_fts_au AFTER UPDATE OF title, description ON todos BEGIN
+      DELETE FROM todos_fts WHERE todo_id = old.id;
+      INSERT INTO todos_fts(todo_id, title, description)
+      VALUES (new.id, COALESCE(new.title, ''), COALESCE(new.description, ''));
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS ai_sessions_fts_au AFTER UPDATE OF ai_session ON todos BEGIN
+      DELETE FROM ai_sessions_fts WHERE todo_id = old.id;
+      INSERT INTO ai_sessions_fts(todo_id, session_id, label, command, native_session_id)
+      SELECT old.id,
+             COALESCE(json_extract(value, '$.sessionId'), ''),
+             COALESCE(json_extract(value, '$.label'), ''),
+             COALESCE(json_extract(value, '$.command'), ''),
+             COALESCE(json_extract(value, '$.nativeSessionId'), '')
+      FROM json_each(COALESCE(new.ai_session, '[]'));
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS ai_sessions_fts_ai AFTER INSERT ON todos BEGIN
+      INSERT INTO ai_sessions_fts(todo_id, session_id, label, command, native_session_id)
+      SELECT new.id,
+             COALESCE(json_extract(value, '$.sessionId'), ''),
+             COALESCE(json_extract(value, '$.label'), ''),
+             COALESCE(json_extract(value, '$.command'), ''),
+             COALESCE(json_extract(value, '$.nativeSessionId'), '')
+      FROM json_each(COALESCE(new.ai_session, '[]'));
+    END;
+  `)
+
+  // ── comments_fts 触发器 ──
+  dbHandle.exec(`
+    CREATE TRIGGER IF NOT EXISTS comments_fts_ai AFTER INSERT ON comments BEGIN
+      INSERT INTO comments_fts(comment_id, todo_id, body)
+      VALUES (new.id, new.todo_id, COALESCE(new.content, ''));
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS comments_fts_ad AFTER DELETE ON comments BEGIN
+      DELETE FROM comments_fts WHERE comment_id = old.id;
+    END;
+
+    CREATE TRIGGER IF NOT EXISTS comments_fts_au AFTER UPDATE ON comments BEGIN
+      DELETE FROM comments_fts WHERE comment_id = old.id;
+      INSERT INTO comments_fts(comment_id, todo_id, body)
+      VALUES (new.id, new.todo_id, COALESCE(new.content, ''));
+    END;
+  `)
+}
+
+/**
+ * 全量重建 todos_fts / comments_fts / ai_sessions_fts。
+ * 用于启动一致性自检或手动 reindex。
+ */
+export function rebuildTodosFts(dbHandle) {
+  dbHandle.exec(`DELETE FROM todos_fts`)
+  dbHandle.exec(`
+    INSERT INTO todos_fts(todo_id, title, description)
+    SELECT id, COALESCE(title, ''), COALESCE(description, '') FROM todos
+  `)
+}
+
+export function rebuildCommentsFts(dbHandle) {
+  dbHandle.exec(`DELETE FROM comments_fts`)
+  dbHandle.exec(`
+    INSERT INTO comments_fts(comment_id, todo_id, body)
+    SELECT id, todo_id, COALESCE(content, '') FROM comments
+  `)
+}
+
+export function rebuildAiSessionsFts(dbHandle) {
+  dbHandle.exec(`DELETE FROM ai_sessions_fts`)
+  dbHandle.exec(`
+    INSERT INTO ai_sessions_fts(todo_id, session_id, label, command, native_session_id)
+    SELECT t.id,
+           COALESCE(json_extract(j.value, '$.sessionId'), ''),
+           COALESCE(json_extract(j.value, '$.label'), ''),
+           COALESCE(json_extract(j.value, '$.command'), ''),
+           COALESCE(json_extract(j.value, '$.nativeSessionId'), '')
+    FROM todos t,
+         json_each(COALESCE(t.ai_session, '[]')) j
+  `)
+}
+
+/**
+ * 重新读取 wikiDir 下所有 .md 文件，按文件名里的 todo_id 建索引。
+ * 命名约定：文件名格式 todo-<id>.md（或 wikiService 决定的任何格式）。
+ * 这里用宽松匹配：todo_id = 去掉前缀/后缀之后的部分，若 wiki 还没存在就跳过。
+ *
+ * 如果 wikiDir 不存在 / 读取失败，静默跳过（没有 wiki 不影响搜索其他 scope）。
+ */
+export function rebuildWikiFts(dbHandle, { wikiDir } = {}) {
+  dbHandle.exec(`DELETE FROM wiki_fts`)
+  if (!wikiDir || !existsSync(wikiDir)) return { indexed: 0 }
+  let indexed = 0
+  const stmt = dbHandle.prepare(`INSERT INTO wiki_fts(todo_id, body) VALUES (?, ?)`)
+  const insertMany = dbHandle.transaction((entries) => {
+    for (const { todoId, body } of entries) {
+      stmt.run(todoId, body)
+      indexed += 1
+    }
+  })
+  const entries = []
+  try {
+    for (const entry of readdirSync(wikiDir, { withFileTypes: true })) {
+      if (!entry.isFile()) continue
+      if (!/^(todo-)?(.+)\.md$/i.test(entry.name)) continue
+      const match = entry.name.match(/^(?:todo-)?(.+?)\.md$/i)
+      const todoId = match?.[1]
+      if (!todoId) continue
+      const fullPath = join(wikiDir, entry.name)
+      try {
+        const st = statSync(fullPath)
+        if (!st.isFile()) continue
+        const body = readFileSync(fullPath, 'utf8')
+        if (body.trim()) entries.push({ todoId, body })
+      } catch {
+        // ignore unreadable file
+      }
+    }
+  } catch {
+    return { indexed: 0 }
+  }
+  if (entries.length) insertMany(entries)
+  return { indexed }
+}
+
+/**
+ * 启动时检查 FTS 行数与源表一致（粗略），不一致就全量重建。
+ */
+export function ensureFtsConsistency(dbHandle, { wikiDir } = {}) {
+  const out = { rebuilt: [] }
+  const count = (sql) => dbHandle.prepare(sql).get()?.n ?? 0
+  if (count(`SELECT COUNT(*) AS n FROM todos_fts`) !== count(`SELECT COUNT(*) AS n FROM todos`)) {
+    rebuildTodosFts(dbHandle)
+    out.rebuilt.push('todos_fts')
+  }
+  if (count(`SELECT COUNT(*) AS n FROM comments_fts`) !== count(`SELECT COUNT(*) AS n FROM comments`)) {
+    rebuildCommentsFts(dbHandle)
+    out.rebuilt.push('comments_fts')
+  }
+  // ai_sessions 是 JSON 展开后的条数；如果数量不一致（可能上次没跑到触发器）就重建
+  const aiSessionsExpected = dbHandle.prepare(`
+    SELECT COUNT(*) AS n
+    FROM todos t, json_each(COALESCE(t.ai_session, '[]')) j
+  `).get()?.n ?? 0
+  if (count(`SELECT COUNT(*) AS n FROM ai_sessions_fts`) !== aiSessionsExpected) {
+    rebuildAiSessionsFts(dbHandle)
+    out.rebuilt.push('ai_sessions_fts')
+  }
+  // wiki 每次启动都重建（对比文件数成本高、直接 rebuild 便宜）
+  rebuildWikiFts(dbHandle, { wikiDir })
+  out.rebuilt.push('wiki_fts')
+  return out
+}