ai-helper-agent 1.6.2 → 1.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-helper-agent",
-  "version": "1.6.2",
+  "version": "1.6.3",
   "description": "AI Helper 代理服务 - 为 Chrome 扩展提供本地文件读写和系统命令执行能力",
   "type": "module",
   "main": "./src/server.js",
@@ -15,10 +15,13 @@
   "scripts": {
     "start": "node bin/agent.js start",
     "stop": "node bin/agent.js stop",
-    "status": "node bin/agent.js status"
+    "status": "node bin/agent.js status",
+    "publish": "bash publish.sh"
   },
   "dependencies": {
-    "ws": "^8.18.0"
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "ws": "^8.18.0",
+    "zod": "^4.4.3"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/mcp/client.js

@@ -1,80 +1,44 @@
-// mcp/client.js - MCP Client 核心
-// 管理与单个 MCP Server 的 JSON-RPC 2.0 通信
-import { createStdioTransport } from './transport.js';
+import { Client } from '@modelcontextprotocol/sdk/client';
+import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
 
-let requestIdCounter = 0;
-
-/**
- * MCP Client 类
- * 管理与一个 MCP Server 的完整生命周期
- */
 export class McpClient {
   constructor(serverConfig) {
     this.serverId = serverConfig.id;
     this.serverName = serverConfig.name || serverConfig.id;
     this.serverConfig = serverConfig;
+    this.client = null;
     this.transport = null;
     this.connected = false;
     this.tools = [];
     this.serverInfo = null;
-
-    // JSON-RPC 请求管理
-    this.pendingRequests = new Map(); // id → { resolve, reject, timeoutId }
   }
 
-  /**
-   * 连接到 MCP Server
-   * 流程: 启动子进程 → initialize → tools/list
-   */
   async connect() {
     if (this.connected) return { success: true };
 
     try {
-      // 1. 创建 stdio 传输
-      this.transport = await createStdioTransport(this.serverConfig);
-
-      // 2. 设置响应数据处理器
-      this.transport.onData((line) => this._handleLine(line));
-
-      // 2.5 监听进程崩溃（已连接后）
-      this.transport.onExit((code, signal) => {
-        console.error(`[MCP:${this.serverId}] Server 进程意外退出 (code=${code}, signal=${signal})，标记为断开`);
-        this.connected = false;
-        this.tools = [];
-        // 拒绝所有进行中的请求
-        for (const [id, pending] of this.pendingRequests) {
-          clearTimeout(pending.timeoutId);
-          pending.reject(new Error('MCP Server 进程已退出'));
-        }
-        this.pendingRequests.clear();
+      this.transport = new StdioClientTransport({
+        command: this.serverConfig.command,
+        args: this.serverConfig.args || [],
+        env: { ...(this.serverConfig.env || {}) },
+        cwd: this.serverConfig.cwd,
+        stderr: 'pipe'
       });
 
-      console.log(`[MCP:${this.serverId}] 子进程已启动`);
-
-      // 3. 发送 initialize 请求
-      const initResult = await this._sendRequest('initialize', {
-        protocolVersion: '2024-11-05',
-        capabilities: {
-          tools: {}
-        },
-        clientInfo: {
-          name: 'ai-helper-agent',
-          version: '1.3.4'
-        }
+      this.client = new Client({
+        name: 'ai-helper-agent',
+        version: '1.3.4'
       });
 
-      if (!initResult || initResult.error) {
-        throw new Error(`Initialize 失败: ${initResult?.error?.message || '未知错误'}`);
-      }
-
-      this.serverInfo = initResult;
-      console.log(`[MCP:${this.serverId}] Initialize 成功, server:`, initResult.serverInfo?.name);
+      await this.client.connect(this.transport);
 
-      // 4. 发送 initialized 通知（MCP 协议要求）
-      this._sendNotification('notifications/initialized', {});
+      this.serverInfo = {
+        serverInfo: this.client.getServerVersion(),
+        capabilities: this.client.getServerCapabilities()
+      };
+      console.log(`[MCP:${this.serverId}] Initialize 成功, server:`, this.serverInfo.serverInfo?.name);
 
-      // 5. 发现工具
-      const toolsResult = await this._sendRequest('tools/list', {});
+      const toolsResult = await this.client.listTools({});
       if (toolsResult && toolsResult.tools) {
         this.tools = toolsResult.tools;
         console.log(`[MCP:${this.serverId}] 发现 ${this.tools.length} 个工具:`,
@@ -92,18 +56,13 @@ export class McpClient {
     }
   }
 
-  /**
-   * 调用 MCP 工具
-   * @param {string} toolName
-   * @param {Object} args
-   */
   async callTool(toolName, args) {
     if (!this.connected) {
       return { success: false, error: `MCP Server "${this.serverName}" 未连接` };
     }
 
     try {
-      const result = await this._sendRequest('tools/call', {
+      const result = await this.client.callTool({
         name: toolName,
         arguments: args || {}
       });
@@ -112,7 +71,6 @@ export class McpClient {
         return { success: false, error: result.error.message || '工具调用失败' };
       }
 
-      // MCP tools/call 返回 { content: [{ type: 'text', text: '...' }], isError: false }
       const content = result?.content || [];
       const textContent = content
         .filter(c => c.type === 'text')
@@ -129,31 +87,18 @@ export class McpClient {
     }
   }
 
-  /**
-   * 断开连接
-   */
   disconnect() {
     this.connected = false;
     this.tools = [];
 
-    // 清理所有未完成的请求
-    for (const [id, pending] of this.pendingRequests) {
-      clearTimeout(pending.timeoutId);
-      pending.reject(new Error('连接已断开'));
-    }
-    this.pendingRequests.clear();
-
-    if (this.transport) {
-      try { this.transport.close(); } catch {}
-      this.transport = null;
+    if (this.client) {
+      try { this.client.close(); } catch {}
+      this.client = null;
     }
 
     console.log(`[MCP:${this.serverId}] 已断开连接`);
   }
 
-  /**
-   * 获取状态信息
-   */
   getStatus() {
     return {
       id: this.serverId,
@@ -163,82 +108,4 @@ export class McpClient {
       serverInfo: this.serverInfo?.serverInfo || null
     };
   }
-
-  // ========== 私有方法 ==========
-
-  /**
-   * 处理从 transport 收到的每一行 JSON-RPC 消息
-   */
-  _handleLine(line) {
-    try {
-      const message = JSON.parse(line);
-      const id = message.id;
-
-      if (id !== undefined && id !== null) {
-        // 有 id = 响应
-        const pending = this.pendingRequests.get(id);
-        if (pending) {
-          clearTimeout(pending.timeoutId);
-          this.pendingRequests.delete(id);
-
-          if (message.error) {
-            pending.reject(new Error(message.error.message || 'JSON-RPC Error'));
-          } else {
-            pending.resolve(message.result);
-          }
-        }
-      } else {
-        // 无 id = 通知，仅记录
-        if (message.method) {
-          console.log(`[MCP:${this.serverId}] 通知:`, message.method);
-        }
-      }
-    } catch (err) {
-      // 非 JSON 行，忽略
-    }
-  }
-
-  /**
-   * 发送 JSON-RPC 请求并等待响应
-   */
-  _sendRequest(method, params) {
-    return new Promise((resolve, reject) => {
-      const id = ++requestIdCounter;
-
-      const timeoutId = setTimeout(() => {
-        this.pendingRequests.delete(id);
-        reject(new Error(`MCP 请求超时 (60s): ${method}`));
-      }, 60000);
-
-      this.pendingRequests.set(id, { resolve, reject, timeoutId });
-
-      try {
-        this.transport.send({
-          jsonrpc: '2.0',
-          id,
-          method,
-          params
-        });
-      } catch (err) {
-        clearTimeout(timeoutId);
-        this.pendingRequests.delete(id);
-        reject(err);
-      }
-    });
-  }
-
-  /**
-   * 发送 JSON-RPC 通知（无需响应）
-   */
-  _sendNotification(method, params) {
-    try {
-      this.transport.send({
-        jsonrpc: '2.0',
-        method,
-        params
-      });
-    } catch {
-      // 通知发送失败不抛出
-    }
-  }
-}
+}

package/src/security.js

@@ -1,9 +1,23 @@
 // agent/src/security.js - 安全管控：文件沙箱 + 命令分级
-import { resolve, normalize, sep, isAbsolute, join } from 'path';
+import { resolve, normalize, sep, isAbsolute, join, dirname } from 'path';
 import { realpathSync } from 'fs';
-import { homedir } from 'os';
+import { homedir, platform } from 'os';
 import { loadConfig } from './config.js';
 
+const isWin32 = platform() === 'win32';
+
+function normalizePathFormat(pathStr) {
+  if (!pathStr || typeof pathStr !== 'string') return pathStr;
+
+  if (isWin32) {
+    pathStr = pathStr.replace(/\/([a-zA-Z])\//g, '$1:/');
+    pathStr = pathStr.replace(/\/([a-zA-Z]):/g, '$1:/');
+    pathStr = pathStr.replace(/\//g, '\\');
+  }
+
+  return pathStr;
+}
+
 // ==================== 硬阻止目录（任何情况下都不可访问） ====================
 
 const AGENT_DIR = join(homedir(), '.ai-helper-agent');
@@ -49,8 +63,10 @@ function checkPath(pathStr) {
   try {
     const config = loadConfig();
 
-    // 相对路径基于 config.workdir 解析，而非 process.cwd()
-    const resolved = isAbsolute(pathStr) ? resolve(pathStr) : resolve(config.workdir, pathStr);
+    const normalizedPathStr = normalizePathFormat(pathStr);
+    const normalizedWorkdir = normalizePathFormat(config.workdir);
+
+    const resolved = isAbsolute(normalizedPathStr) ? resolve(normalizedPathStr) : resolve(normalizedWorkdir, normalizedPathStr);
     const normalized = normalize(resolved);
 
     // 0. 硬阻止检查（优先级最高，不可绕过）
@@ -58,13 +74,12 @@ function checkPath(pathStr) {
       return { allowed: false, reason: '禁止访问代理系统文件' };
     }
 
-    const allowedPaths = config.allowedPaths.length > 0 ? config.allowedPaths : [config.workdir];
+    const allowedPaths = config.allowedPaths.length > 0 ? config.allowedPaths.map(p => normalizePathFormat(p)) : [normalizedWorkdir];
 
     // 先做前缀检查（快速路径，兼容 Windows/Unix）
     let prefixMatch = false;
     for (const allowed of allowedPaths) {
       const allowedResolved = resolve(allowed);
-      // 统一使用 OS 分隔符构造前缀
       const prefix = allowedResolved.endsWith(sep) ? allowedResolved : allowedResolved + sep;
       if (normalized.startsWith(prefix) || normalized === allowedResolved) {
         prefixMatch = true;
@@ -81,10 +96,12 @@ function checkPath(pathStr) {
       realPath = realpathSync(resolved);
     } catch (err) {
       if (err.code === 'ENOENT') {
-        // 文件/目录不存在时，向上查找直到找到存在的父目录
         let existing = resolved;
-        while (existing !== sep && existing !== '' && existing !== '/') {
-          const parent = resolve(existing, '..');
+        while (true) {
+          const parent = dirname(existing);
+          if (parent === existing) {
+            break;
+          }
           try {
             realPath = realpathSync(parent) + sep + normalized.slice(resolve(parent).length).replace(/^[/\\]/, '');
             break;

package/src/server.js

@@ -158,6 +158,85 @@ function parseBody(req) {
   });
 }
 
+/**
+ * 解析 multipart/form-data，提取文件数据
+ * @param {http.IncomingMessage} req
+ * @returns {Promise<{fileBuffer: Buffer, fileName: string, mimeType: string}>}
+ */
+function parseMultipartBody(req) {
+  return new Promise((resolve, reject) => {
+    const contentType = req.headers['content-type'] || '';
+    const boundaryMatch = contentType.match(/boundary=(.+)/);
+    if (!boundaryMatch) {
+      reject(new Error('不是有效的 multipart/form-data 请求'));
+      return;
+    }
+    const boundary = boundaryMatch[1].trim();
+    const boundaryBuffer = Buffer.from('--' + boundary);
+
+    const contentLength = parseInt(req.headers['content-length'] || '0', 10);
+    if (contentLength > MAX_BODY_SIZE) {
+      reject(new Error('文件过大，超出限制'));
+      return;
+    }
+
+    const chunks = [];
+    let totalSize = 0;
+
+    req.on('data', (chunk) => {
+      totalSize += chunk.length;
+      if (totalSize > MAX_BODY_SIZE) {
+        reject(new Error('文件过大，超出限制'));
+        req.destroy();
+        return;
+      }
+      chunks.push(chunk);
+    });
+
+    req.on('end', () => {
+      const buffer = Buffer.concat(chunks);
+
+      // 找到文件部分的起始位置
+      const startIdx = buffer.indexOf(boundaryBuffer) + boundaryBuffer.length + 2; // +2 for \r\n
+      if (startIdx < boundaryBuffer.length + 2) {
+        reject(new Error('multipart 数据格式不正确'));
+        return;
+      }
+
+      // 找 headers 结束位置（\r\n\r\n）
+      const headersEnd = buffer.indexOf('\r\n\r\n', startIdx);
+      if (headersEnd === -1) {
+        reject(new Error('multipart headers 格式不正确'));
+        return;
+      }
+
+      // 解析 headers
+      const headersStr = buffer.slice(startIdx, headersEnd).toString();
+      const dispMatch = headersStr.match(/filename="([^"]*)"/);
+      const fileName = dispMatch ? dispMatch[1] : 'file';
+
+      // 找数据结束位置（下一个 boundary）
+      const dataStart = headersEnd + 4; // after \r\n\r\n
+      const dataEnd = buffer.indexOf(boundaryBuffer, dataStart) - 2; // -2 for \r\n before boundary
+
+      if (dataEnd <= dataStart) {
+        reject(new Error('找不到文件数据'));
+        return;
+      }
+
+      const fileBuffer = buffer.slice(dataStart, dataEnd);
+
+      resolve({
+        fileBuffer,
+        fileName,
+        mimeType: headersStr.match(/Content-Type:\s*(.+?)\r?\n/i)?.[1]?.trim() || 'application/octet-stream'
+      });
+    });
+
+    req.on('error', () => reject(new Error('读取文件失败')));
+  });
+}
+
 /**
  * 创建并启动服务器
  */
@@ -271,6 +350,47 @@ export function startServer() {
       });
     }
 
+    // === 文件上传（multipart/form-data，必须在通用 JSON body 解析之前） ===
+    if (req.method === 'POST' && pathname === '/api/files/upload') {
+      try {
+        const { fileBuffer, fileName, mimeType } = await parseMultipartBody(req);
+
+        // 安全检查：过滤文件名中的危险字符
+        const safeName = fileName.replace(/[/\\:*?"<>|]/g, '_');
+        const destPath = join(config.workdir, safeName);
+
+        // 去重：如果文件已存在，添加后缀
+        let finalPath = destPath;
+        if (existsSync(finalPath)) {
+          const ext = safeName.lastIndexOf('.') > 0 ? safeName.substring(safeName.lastIndexOf('.')) : '';
+          const base = safeName.substring(0, safeName.length - ext.length) || safeName;
+          let counter = 1;
+          while (existsSync(finalPath)) {
+            finalPath = join(config.workdir, `${base}_${counter}${ext}`);
+            counter++;
+          }
+        }
+
+        // 确保工作目录存在
+        mkdirSync(config.workdir, { recursive: true });
+
+        // 写入文件
+        writeFileSync(finalPath, fileBuffer);
+
+        logFs('upload', { path: finalPath, size: fileBuffer.length, mimeType });
+
+        return jsonResponse(res, 200, {
+          success: true,
+          path: finalPath,
+          name: safeName,
+          size: fileBuffer.length
+        });
+      } catch (err) {
+        logError('fs', 'upload_error', { error: err.message });
+        return jsonResponse(res, 400, { success: false, error: `文件上传失败: ${err.message}` });
+      }
+    }
+
     if (['POST', 'PUT', 'DELETE'].includes(req.method)) {
       let body;
       try { body = await parseBody(req); }

package/src/skill/skill-creator-seed.js

@@ -106,10 +106,11 @@ enabled: true
    - **Windows (PowerShell)**：\`New-Item -ItemType Directory -Force -Path "$env:USERPROFILE\\.ai-helper-agent\\skills\\<skill-name>"\`
    - 如果 \`mkdir\` 报错，尝试不带参数或使用 \`agent_write_file\` 工具在目标路径写入一个临时文件，让系统自动创建父目录。
 
-5. **写入 SKILL.md**：使用 \`agent_write_file\` 工具将内容写入。
-   - **重要**：\`agent_write_file\` 不会展开 \`~\`，必须使用绝对路径！
-   - **macOS/Linux**：从当前工作目录推断用户主目录（工作目录通常是 \`/Users/<你的用户名>/...\`），完整路径为 \`/Users/<你的用户名>/.ai-helper-agent/skills/<skill-name>/SKILL.md\`
-   - **Windows**：\`C:\\Users\\<你的用户名>\\.ai-helper-agent\\skills\\<skill-name>\\SKILL.md\`
+5. **写入 SKILL.md**：使用 \`agent_write_file\` 工具将内容写入目标文件。
+
+   > ⚠️ **关键限制**：\`agent_write_file\` 不接受 \`~\` 或相对路径，**必须传入绝对路径**。
+
+   **推荐做法**：先用 \`agent_exec_command\` 获取用户主目录的绝对路径，再拼接完整路径。
 
 6. **告知用户**：创建完成后，告知用户技能已就绪，说明触发关键词。建议用户在工具箱页面点击「重新加载」使技能生效。
 

package/src/mcp/transport.js

@@ -1,100 +0,0 @@
-// mcp/transport.js - MCP stdio 传输层
-// MCP 协议使用 JSON-RPC 2.0 over stdin/stdout，每行一个 JSON 消息
-import { spawn } from 'child_process';
-
-/**
- * 创建 MCP 子进程传输
- * MCP 协议中，客户端先发 initialize 请求，服务端才会响应。因此 spawn 后立即 resolve，
- * 由上层 McpClient 负责发送 initialize 和等待响应。
- *
- * @param {Object} serverConfig - { command, args, env }
- * @returns {Promise<{send: Function, close: Function, onData: Function}>}
- */
-export function createStdioTransport(serverConfig) {
-  const { command, args = [], env = {} } = serverConfig;
-
-  return new Promise((resolve, reject) => {
-    let resolved = false;
-    let responseBuffer = '';
-    let dataHandler = null;
-    let exitHandler = null;
-
-    const child = spawn(command, args, {
-      stdio: ['pipe', 'pipe', 'pipe'],
-      env: { ...process.env, ...env },
-      detached: false
-    });
-
-    const cleanup = () => {
-      if (child.stdout) child.stdout.removeAllListeners();
-      if (child.stderr) child.stderr.removeAllListeners();
-      child.removeAllListeners();
-    };
-
-    child.stderr.on('data', (data) => {
-      const text = data.toString();
-      if (text.trim()) {
-        console.log(`[MCP:stderr] [${serverConfig.id || command}] ${text.trim()}`);
-      }
-    });
-
-    child.on('error', (err) => {
-      if (!resolved) {
-        resolved = true;
-        cleanup();
-        reject(new Error(`无法启动 MCP Server "${command}": ${err.message}`));
-      }
-    });
-
-    child.on('exit', (code, signal) => {
-      console.log(`[MCP] Server 进程退出: ${command} (code=${code}, signal=${signal})`);
-      if (!resolved) {
-        resolved = true;
-        cleanup();
-        reject(new Error(`MCP Server 异常退出 (code=${code}, signal=${signal}): ${command}`));
-      } else if (exitHandler) {
-        exitHandler(code, signal);
-      }
-    });
-
-    child.stdout.on('data', (data) => {
-      responseBuffer += data.toString();
-
-      let newlineIdx;
-      while ((newlineIdx = responseBuffer.indexOf('\n')) !== -1) {
-        const line = responseBuffer.slice(0, newlineIdx).trim();
-        responseBuffer = responseBuffer.slice(newlineIdx + 1);
-
-        if (!line) continue;
-
-        if (dataHandler) {
-          try { dataHandler(line); } catch {}
-        }
-      }
-    });
-
-    if (!resolved) {
-      resolved = true;
-      resolve({
-        send: (jsonRpcMessage) => {
-          const msg = JSON.stringify(jsonRpcMessage) + '\n';
-          child.stdin.write(msg);
-        },
-        close: () => {
-          cleanup();
-          dataHandler = null;
-          try { child.stdin.end(); } catch {}
-          setTimeout(() => {
-            try { child.kill('SIGTERM'); } catch {}
-          }, 1000);
-        },
-        onData: (handler) => {
-          dataHandler = handler;
-        },
-        onExit: (handler) => {
-          exitHandler = handler;
-        }
-      });
-    }
-  });
-}