ai-helper-agent 1.1.0 → 1.2.0

package/src/auth.js

@@ -7,38 +7,10 @@ let currentPairCode = null;
 let pairCodeTimer = null;
 
 /**
- * 生成随机配对码（4位数字）
+ * 生成随机配对码（4位数字，使用密码学安全的随机数）
  */
 function generatePairCode() {
-  return String(Math.floor(1000 + Math.random() * 9000));
-}
-
-/**
- * 生成认证 token（HMAC-SHA256）
- */
-function generateToken(extensionId) {
-  const secret = crypto.randomBytes(32).toString('hex');
-  const pairings = loadPairings();
-  pairings[extensionId] = {
-    token: secret,
-    pairedAt: Date.now()
-  };
-  // 直接用 secret 作为 token
-  return secret;
-}
-
-/**
- * 验证 token 是否有效
- */
-function verifyToken(token) {
-  if (!token) return null;
-  const pairings = loadPairings();
-  for (const [extId, pairing] of Object.entries(pairings)) {
-    if (pairing.token === token) {
-      return extId;
-    }
-  }
-  return null;
+  return String(crypto.randomInt(1000, 10000));
 }
 
 /**
@@ -76,9 +48,23 @@ function stopPairCodeRotation() {
 }
 
 /**
- * 处理配对请求
+ * 验证 token 是否有效
+ */
+function verifyToken(token) {
+  if (!token || typeof token !== 'string') return null;
+  const pairings = loadPairings();
+  for (const [extId, pairing] of Object.entries(pairings)) {
+    if (pairing.token === token) {
+      return extId;
+    }
+  }
+  return null;
+}
+
+/**
+ * 处理配对请求（异步，支持写入锁）
  */
-function handlePairRequest(code, extensionId) {
+async function handlePairRequest(code, extensionId) {
   if (!code || !extensionId) {
     return { success: false, error: '缺少配对码或扩展ID' };
   }
@@ -92,33 +78,18 @@ function handlePairRequest(code, extensionId) {
   }
   // 生成新 token 并保存
   const token = crypto.randomBytes(32).toString('hex');
-  savePairing(extensionId, token);
-  return { success: true, token, message: '配对成功' };
-}
-
-/**
- * Bearer Token 认证中间件（Express）
- */
-function authMiddleware(req, res, next) {
-  const authHeader = req.headers.authorization;
-  if (!authHeader || !authHeader.startsWith('Bearer ')) {
-    return res.status(401).json({ success: false, error: '未提供认证 token' });
+  try {
+    await savePairing(extensionId, token);
+  } catch (err) {
+    return { success: false, error: `配对保存失败: ${err.message}` };
   }
-  const token = authHeader.slice(7);
-  const extId = verifyToken(token);
-  if (!extId) {
-    return res.status(403).json({ success: false, error: '认证 token 无效' });
-  }
-  req.extensionId = extId;
-  next();
+  return { success: true, token, message: '配对成功' };
 }
 
 export {
-  generateToken,
   verifyToken,
   getCurrentPairCode,
   startPairCodeRotation,
   stopPairCodeRotation,
-  handlePairRequest,
-  authMiddleware
+  handlePairRequest
 };

package/src/config.js

@@ -1,4 +1,4 @@
-// agent/src/config.js - 配置管理（带内存缓存）
+// agent/src/config.js - 配置管理（带内存缓存 + 写入互斥锁）
 import { homedir } from 'os';
 import { join } from 'path';
 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from 'fs';
@@ -17,6 +17,8 @@ const DEFAULTS = {
   fileMaxSize: 50 * 1024 * 1024
 };
 
+const VALID_CONFIG_KEYS = Object.keys(DEFAULTS);
+
 // 内存缓存
 let configCache = null;
 let configCacheMtime = 0;
@@ -24,9 +26,24 @@ let configCacheMtime = 0;
 let pairingsCache = null;
 let pairingsCacheMtime = 0;
 
+// 写入互斥锁（防止并发写互相覆盖）
+let writeLock = Promise.resolve();
+
+function withWriteLock(fn) {
+  const prev = writeLock;
+  let release;
+  writeLock = new Promise(resolve => { release = resolve; });
+  return prev.then(() => fn().finally(release));
+}
+
 function ensureAgentDir() {
   if (!existsSync(AGENT_DIR)) {
-    mkdirSync(AGENT_DIR, { recursive: true });
+    try {
+      mkdirSync(AGENT_DIR, { recursive: true });
+    } catch (err) {
+      console.error('[Config] 无法创建 Agent 目录:', err.message);
+      throw err;
+    }
   }
 }
 
@@ -49,7 +66,7 @@ export function loadConfig() {
 
   if (!existsSync(CONFIG_FILE)) {
     const defaults = { ...DEFAULTS, allowedPaths: [DEFAULTS.workdir] };
-    saveConfig(defaults);
+    saveConfigSync(defaults);
     configCache = defaults;
     configCacheMtime = getMtime(CONFIG_FILE);
     return defaults;
@@ -66,7 +83,8 @@ export function loadConfig() {
     configCache = { ...DEFAULTS, ...userConfig };
     configCacheMtime = mtime;
     return configCache;
-  } catch {
+  } catch (err) {
+    console.error('[Config] 配置文件解析失败:', err.message);
     configCache = { ...DEFAULTS, allowedPaths: [DEFAULTS.workdir] };
     configCacheMtime = 0;
     return configCache;
@@ -74,23 +92,48 @@ export function loadConfig() {
 }
 
 /**
- * 保存配置（写入磁盘并更新缓存）
+ * 同步写入磁盘（内部方法，不加锁）
  */
-export function saveConfig(config) {
+function saveConfigSync(config) {
   ensureAgentDir();
-  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), 'utf-8');
-  configCache = config;
-  configCacheMtime = getMtime(CONFIG_FILE);
+  const safe = {};
+  for (const key of VALID_CONFIG_KEYS) {
+    if (config[key] !== undefined) safe[key] = config[key];
+  }
+  writeFileSync(CONFIG_FILE, JSON.stringify(safe, null, 2), 'utf-8');
 }
 
 /**
- * 更新单字段配置
+ * 保存配置（写入磁盘并更新缓存，加写锁防并发覆盖）
  */
-export function updateConfigField(key, value) {
-  const config = loadConfig();
-  config[key] = value;
-  saveConfig(config);
-  return config;
+export async function saveConfig(config) {
+  return withWriteLock(async () => {
+    try {
+      saveConfigSync(config);
+      // 从磁盘重新加载确保缓存与磁盘一致
+      const mtime = getMtime(CONFIG_FILE);
+      const raw = readFileSync(CONFIG_FILE, 'utf-8');
+      configCache = { ...DEFAULTS, ...JSON.parse(raw) };
+      configCacheMtime = mtime;
+    } catch (err) {
+      console.error('[Config] 保存配置失败:', err.message);
+      throw err;
+    }
+  });
+}
+
+/**
+ * 更新单字段配置（加写锁防 TOCTOU）
+ */
+export async function updateConfigField(key, value) {
+  if (!VALID_CONFIG_KEYS.includes(key)) {
+    throw new Error(`无效配置项: ${key}`);
+  }
+  return withWriteLock(async () => {
+    const config = loadConfig();
+    config[key] = value;
+    return saveConfig(config).then(() => config);
+  });
 }
 
 /**
@@ -114,7 +157,8 @@ export function loadPairings() {
     pairingsCache = JSON.parse(readFileSync(PAIRINGS_FILE, 'utf-8'));
     pairingsCacheMtime = mtime;
     return pairingsCache;
-  } catch {
+  } catch (err) {
+    console.error('[Config] 配对文件解析失败:', err.message);
     pairingsCache = {};
     pairingsCacheMtime = 0;
     return {};
@@ -122,15 +166,22 @@ export function loadPairings() {
 }
 
 /**
- * 保存配对（写入磁盘并更新缓存）
+ * 保存配对（加写锁防并发覆盖）
  */
-export function savePairing(extensionId, token) {
-  const pairings = loadPairings();
-  pairings[extensionId] = { token, pairedAt: Date.now() };
-  ensureAgentDir();
-  writeFileSync(PAIRINGS_FILE, JSON.stringify(pairings, null, 2), 'utf-8');
-  pairingsCache = pairings;
-  pairingsCacheMtime = getMtime(PAIRINGS_FILE);
+export async function savePairing(extensionId, token) {
+  return withWriteLock(async () => {
+    const pairings = loadPairings();
+    pairings[extensionId] = { token, pairedAt: Date.now() };
+    ensureAgentDir();
+    try {
+      writeFileSync(PAIRINGS_FILE, JSON.stringify(pairings, null, 2), 'utf-8');
+      pairingsCache = pairings;
+      pairingsCacheMtime = getMtime(PAIRINGS_FILE);
+    } catch (err) {
+      console.error('[Config] 保存配对失败:', err.message);
+      throw err;
+    }
+  });
 }
 
 export { AGENT_DIR, CONFIG_FILE };

package/src/executor.js

@@ -6,6 +6,40 @@ import { loadConfig } from './config.js';
 // 运行中的进程映射：execId → { process, wsClients: Set, timeoutId, forceKillId }
 const runningProcesses = new Map();
 
+// 安全的子进程环境变量白名单（不泄露宿主敏感信息）
+const SAFE_ENV_KEYS = [
+  'PATH', 'HOME', 'USER', 'SHELL', 'TERM', 'LANG', 'LC_ALL', 'LC_CTYPE',
+  'PWD', 'OLDPWD', 'NODE_PATH', 'MANPATH', 'INFOPATH',
+  'XDG_SESSION_TYPE', 'DISPLAY', 'SSH_AUTH_SOCK', 'COLORTERM',
+  'EDITOR', 'VISUAL', 'PAGER', 'BROWSER',
+  'GIT_EDITOR', 'GIT_PAGER', 'GIT_SSH_COMMAND',
+  // 平台相关
+  'TMPDIR', 'TEMPDIR', 'TEMP', 'TMP',
+  // 常用工具
+  'NVM_DIR', 'NVM_BIN', 'JAVA_HOME', 'GOPATH', 'GOROOT', 'CARGO_HOME',
+  'RUSTUP_HOME', 'PYTHONPATH', 'VIRTUAL_ENV', 'CONDA_PREFIX',
+  'ANDROID_HOME', 'ANDROID_SDK_ROOT', 'GRADLE_HOME',
+  'PKG_CONFIG_PATH', 'LD_LIBRARY_PATH', 'DYLD_LIBRARY_PATH',
+  // 颜色/格式化
+  'NO_COLOR', 'CLICOLOR', 'CLICOLOR_FORCE', 'FORCE_COLOR'
+];
+
+/**
+ * 构建安全的子进程环境变量
+ */
+function buildSafeEnv() {
+  const env = {};
+  for (const key of SAFE_ENV_KEYS) {
+    if (process.env[key] !== undefined) {
+      env[key] = process.env[key];
+    }
+  }
+  // 强制覆盖
+  env.TERM = 'dumb';
+  env.FORCE_COLOR = '0';
+  return env;
+}
+
 /**
  * 生成唯一执行 ID
  */
@@ -30,7 +64,7 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
 
   const proc = spawn('sh', ['-c', command], {
     cwd: workdir,
-    env: { ...process.env, TERM: 'dumb', FORCE_COLOR: '0' },
+    env: buildSafeEnv(),
     stdio: ['pipe', 'pipe', 'pipe']
   });
 
@@ -40,12 +74,14 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
   let stdoutCollected = '';
   let stderrCollected = '';
   let killed = false;
-  let forceKillId = null; // 追踪 SIGKILL 的 setTimeout
+  let finished = false; // 防止 close/error 重复处理
 
-  runningProcesses.set(execId, { process: proc, wsClients });
+  // 存储到 entry 中供 clearTimers 读取
+  const entry = { process: proc, wsClients };
+  runningProcesses.set(execId, entry);
 
   // 超时控制
-  const timeoutId = setTimeout(() => {
+  entry.timeoutId = setTimeout(() => {
     killed = true;
     killProcess(execId);
   }, timeout);
@@ -60,6 +96,16 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
     }
   }
 
+  // 清理所有定时器
+  function clearTimers() {
+    clearTimeout(entry.timeoutId);
+    entry.timeoutId = null;
+    if (entry.forceKillId !== null && entry.forceKillId !== undefined) {
+      clearTimeout(entry.forceKillId);
+      entry.forceKillId = null;
+    }
+  }
+
   // stdout 流式输出
   proc.stdout.on('data', (chunk) => {
     const str = chunk.toString();
@@ -74,23 +120,18 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
     broadcast({ type: 'stderr', data: str, execId });
   });
 
-  // 清理超时计时器
-  function clearTimers() {
-    clearTimeout(timeoutId);
-    if (forceKillId !== null) {
-      clearTimeout(forceKillId);
-      forceKillId = null;
-    }
-  }
-
   // 进程结束
   proc.on('close', (exitCode) => {
+    if (finished) return;
+    finished = true;
     clearTimers();
-    broadcast({ type: 'exit', exitCode, execId, killed });
+    broadcast({ type: 'exit', exitCode: typeof exitCode === 'number' ? exitCode : -1, execId, killed });
     runningProcesses.delete(execId);
     if (onComplete) {
       onComplete({
-        execId, exitCode, killed,
+        execId,
+        exitCode: typeof exitCode === 'number' ? exitCode : -1,
+        killed,
         stdout: collectOutput ? stdoutCollected : undefined,
         stderr: collectOutput ? stderrCollected : undefined
       });
@@ -99,6 +140,8 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
 
   // 进程错误
   proc.on('error', (err) => {
+    if (finished) return;
+    finished = true;
     clearTimers();
     broadcast({ type: 'error', error: err.message, execId });
     runningProcesses.delete(execId);
@@ -120,21 +163,23 @@ function executeCommand(command, cwd, wsClient, onComplete, collectOutput = fals
  * @returns {Promise<{execId, exitCode, stdout, stderr, killed, error?}>}
  */
 function executeCommandSync(command, cwd) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve) => {
     const config = loadConfig();
     const timeout = config.commandTimeout || 300000;
 
     let resolved = false;
+    let syncTimeoutId = null;
 
     const execId = executeCommand(command, cwd, null, (result) => {
+      clearTimeout(syncTimeoutId);
       if (!resolved) {
         resolved = true;
         resolve(result);
       }
     }, true);
 
-    // 超时兜底
-    setTimeout(() => {
+    // 超时兜底（超时后额外 5s 用于 kill 完成）
+    syncTimeoutId = setTimeout(() => {
       if (!resolved) {
         resolved = true;
         killProcess(execId);
@@ -161,20 +206,32 @@ function addWsClient(execId, wsClient) {
  */
 function killProcess(execId) {
   const entry = runningProcesses.get(execId);
-  if (entry) {
+  if (!entry) return false;
+
+  if (entry.process.exitCode !== null) return false; // 已退出
+
+  try {
     entry.process.kill('SIGTERM');
-    // 5秒后强制 kill，保存 ID 以便后续清理
-    const forceKillId = setTimeout(() => {
-      try {
-        if (entry.process.exitCode === null) {
-          entry.process.kill('SIGKILL');
-        }
-      } catch {}
-    }, 5000);
-    entry.forceKillId = forceKillId;
-    return true;
+  } catch {}
+
+  // 5秒后强制 kill（绑定到 entry 对象防止闭包引用旧变量）
+  if (entry.timeoutId) {
+    clearTimeout(entry.timeoutId);
+    entry.timeoutId = null;
   }
-  return false;
+  if (entry.forceKillId) {
+    clearTimeout(entry.forceKillId);
+  }
+  entry.forceKillId = setTimeout(() => {
+    try {
+      if (entry.process.exitCode === null) {
+        entry.process.kill('SIGKILL');
+      }
+    } catch {}
+    entry.forceKillId = null;
+  }, 5000);
+
+  return true;
 }
 
 /**

package/src/logger.js

@@ -6,6 +6,43 @@ import { homedir } from 'os';
 const LOG_DIR = join(homedir(), '.ai-helper-agent', 'logs');
 const MAX_LOG_FILES = 30;          // 最多保留 30 个日志文件
 const MAX_LOG_SIZE = 10 * 1024 * 1024; // 单文件最大 10MB
+const CLEAN_INTERVAL_MS = 60_000;  // 清理间隔（60 秒）
+const QUERY_MAX_LIMIT = 1000;      // 单次查询最大条数
+
+// 是否输出到终端 stderr
+let consoleOutput = false;
+
+/**
+ * 设置是否在终端输出日志（前台运行时开启）
+ */
+function setConsoleOutput(enabled) {
+  consoleOutput = enabled;
+}
+
+const CATEGORY_LABELS = {
+  auth: '认证', fs: '文件', exec: '命令', security: '安全', system: '系统'
+};
+
+const LEVEL_LABELS = { info: 'INFO', warn: 'WARN', error: 'ERROR' };
+
+/**
+ * 格式化详情为可读字符串
+ */
+function formatDetails(details) {
+  if (!details || Object.keys(details).length === 0) return '';
+  const parts = [];
+  for (const [key, val] of Object.entries(details)) {
+    if (val !== undefined && val !== null) {
+      const str = typeof val === 'string' ? val : JSON.stringify(val);
+      if (str.length > 120) {
+        parts.push(`${key}=${str.slice(0, 120)}...`);
+      } else {
+        parts.push(`${key}=${str}`);
+      }
+    }
+  }
+  return parts.join(' ');
+}
 
 function ensureLogDir() {
   if (!existsSync(LOG_DIR)) {
@@ -16,17 +53,27 @@ function ensureLogDir() {
 /**
  * 获取当天日志文件路径
  */
-function getLogFile() {
+function getLogFile(date) {
+  if (date) return join(LOG_DIR, `agent-${date}.log`);
   const now = new Date();
-  const date = now.toISOString().slice(0, 10); // YYYY-MM-DD
-  return join(LOG_DIR, `agent-${date}.log`);
+  const dateStr = now.toISOString().slice(0, 10); // YYYY-MM-DD
+  return join(LOG_DIR, `agent-${dateStr}.log`);
 }
 
+// 清理节流：记录上次清理时间
+let lastCleanTime = 0;
+
 /**
- * 清理旧日志文件（保留最近 MAX_LOG_FILES 个，删除超大文件）
+ * 清理旧日志文件（保留最近 MAX_LOG_FILES 个文件 + 删除超大文件）
+ * 节流执行：至少间隔 CLEAN_INTERVAL_MS
  */
 function cleanOldLogs() {
+  const now = Date.now();
+  if (now - lastCleanTime < CLEAN_INTERVAL_MS) return;
+  lastCleanTime = now;
+
   try {
+    ensureLogDir();
     const files = readdirSync(LOG_DIR)
       .filter(f => f.endsWith('.log'))
       .map(f => {
@@ -45,7 +92,7 @@ function cleanOldLogs() {
       }
     }
     if (deleted > 0) {
-      console.log(`[Logger] 清理了 ${deleted} 个旧日志文件`);
+      console.error(`[Logger] 清理了 ${deleted} 个旧日志文件`);
     }
   } catch {}
 }
@@ -58,18 +105,30 @@ function cleanOldLogs() {
  * @param {Object} details - 详细信息
  */
 function log(level, category, action, details = {}) {
+  const entry = {
+    timestamp: new Date().toISOString(),
+    level,
+    category,
+    action,
+    ...details
+  };
+
+  // 输出到终端 stderr（前台运行时可见）
+  if (consoleOutput) {
+    const time = entry.timestamp.slice(11, 19); // HH:MM:SS
+    const levelTag = LEVEL_LABELS[level] || level.toUpperCase();
+    const catTag = CATEGORY_LABELS[category] || category;
+    const detailStr = formatDetails(details);
+    const msg = detailStr
+      ? `[${time}] [${levelTag}] [${catTag}:${action}] ${detailStr}`
+      : `[${time}] [${levelTag}] [${catTag}:${action}]`;
+    process.stderr.write(msg + '\n');
+  }
+
+  // 写入文件
   try {
     ensureLogDir();
-    cleanOldLogs(); // 每次写入时顺便清理（频率不高，影响可忽略）
-
-    const entry = {
-      timestamp: new Date().toISOString(),
-      level,
-      category,
-      action,
-      ...details
-    };
-
+    cleanOldLogs();
     appendFileSync(getLogFile(), JSON.stringify(entry) + '\n', 'utf-8');
   } catch (err) {
     // 日志写入失败不应影响主流程
@@ -96,14 +155,10 @@ function logError(category, action, details) { log('error', category, action, de
  * @returns {{ entries: Array, total: number }}
  */
 function queryLogs(options = {}) {
-  const { date, category, limit = 200, offset = 0 } = options;
+  const { date, category, limit: rawLimit = 200, offset = 0 } = options;
+  const limit = Math.min(rawLimit, QUERY_MAX_LIMIT);
 
-  let filePath;
-  if (date) {
-    filePath = join(LOG_DIR, `agent-${date}.log`);
-  } else {
-    filePath = getLogFile();
-  }
+  const filePath = getLogFile(date);
 
   let entries = [];
   try {
@@ -121,7 +176,7 @@ function queryLogs(options = {}) {
   } catch {}
 
   // 按时间倒序（最新的在前）
-  entries.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+  entries.sort((a, b) => (b.timestamp || '').localeCompare(a.timestamp || ''));
 
   const total = entries.length;
   entries = entries.slice(offset, offset + limit);
@@ -146,4 +201,4 @@ function getLogDates() {
   }
 }
 
-export { log, logAuth, logFs, logExec, logSecurity, logSystem, logError, queryLogs, getLogDates };
+export { setConsoleOutput, log, logAuth, logFs, logExec, logSecurity, logSystem, logError, queryLogs, getLogDates };