aws-runtime-bridge 1.7.6 → 1.7.8

package/dist/routes/git.d.ts

@@ -5,4 +5,11 @@
  */
 export declare const gitRouter: import("express-serve-static-core").Router;
 export declare function assertGitWorkspacePathAccessible(workspacePath: string): Promise<void>;
+type GitDiffFileStatus = 'modified' | 'added' | 'deleted' | 'renamed';
+/**
+ * 判断 Git diff 汇总行是否应该展示在差异树中。
+ * 普通 modified 且文本增删均为 0 通常是 filemode/元数据噪声，避免显示为“无差异内容”。
+ */
+export declare function shouldIncludeGitDiffSummaryFile(status: GitDiffFileStatus, additions: number, deletions: number, isBinaryDiff: boolean): boolean;
+export {};
 //# sourceMappingURL=git.d.ts.map

package/dist/routes/git.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/routes/git.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,eAAO,MAAM,SAAS,4CAAW,CAAC;AAWlC,wBAAsB,gCAAgC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3F"}
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../src/routes/git.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,eAAO,MAAM,SAAS,4CAAW,CAAC;AAWlC,wBAAsB,gCAAgC,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAe3F;AASD,KAAK,iBAAiB,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;AAEtE;;;GAGG;AACH,wBAAgB,+BAA+B,CAC7C,MAAM,EAAE,iBAAiB,EACzB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,OAAO,GACpB,OAAO,CAMT"}

package/dist/routes/git.js

@@ -5,8 +5,8 @@
  */
 import { Router } from 'express';
 import { spawn } from 'node:child_process';
-import path from 'node:path';
 import { promises as fs } from 'node:fs';
+import path from 'node:path';
 import { validateToken } from '../middleware/auth.js';
 export const gitRouter = Router();
 export async function assertGitWorkspacePathAccessible(workspacePath) {
@@ -25,6 +25,16 @@ export async function assertGitWorkspacePathAccessible(workspacePath) {
         throw new Error(`workspace path is not a directory: ${workspacePath}`);
     }
 }
+/**
+ * 判断 Git diff 汇总行是否应该展示在差异树中。
+ * 普通 modified 且文本增删均为 0 通常是 filemode/元数据噪声，避免显示为“无差异内容”。
+ */
+export function shouldIncludeGitDiffSummaryFile(status, additions, deletions, isBinaryDiff) {
+    if (status === 'added' || status === 'deleted' || status === 'renamed') {
+        return true;
+    }
+    return isBinaryDiff || additions > 0 || deletions > 0;
+}
 /**
  * 执行 git 命令并返回输出
  */
@@ -418,10 +428,14 @@ gitRouter.post('/git/diff', validateToken, async (req, res) => {
             const parts = line.split('\t');
             if (parts.length < 3)
                 continue;
+            const isBinaryDiff = parts[0] === '-' || parts[1] === '-';
             const additions = parts[0] === '-' ? 0 : parseInt(parts[0], 10) || 0;
             const deletions = parts[1] === '-' ? 0 : parseInt(parts[1], 10) || 0;
             const filePath = parseRenameDisplayPath(parts.slice(2).join('\t').trim());
             const status = statusMap.get(filePath) || 'modified';
+            if (!filePath || !shouldIncludeGitDiffSummaryFile(status, additions, deletions, isBinaryDiff)) {
+                continue;
+            }
             files.push({ path: filePath, status, additions, deletions });
         }
         res.json({

package/dist/routes/git.test.js

@@ -4,8 +4,8 @@
 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import path from 'node:path';
-import { describe, it, expect } from 'vitest';
-import { assertGitWorkspacePathAccessible } from './git.js';
+import { describe, expect, it } from 'vitest';
+import { assertGitWorkspacePathAccessible, shouldIncludeGitDiffSummaryFile } from './git.js';
 describe('git stash operations', () => {
     function parseStashList(output) {
         const stashes = [];
@@ -98,6 +98,21 @@ describe('git workspace path validation', () => {
         }
     });
 });
+describe('git diff summary visibility', () => {
+    it('filters ordinary modified files without textual changes', () => {
+        expect(shouldIncludeGitDiffSummaryFile('modified', 0, 0, false)).toBe(false);
+    });
+    it('keeps modified files with text or binary changes', () => {
+        expect(shouldIncludeGitDiffSummaryFile('modified', 1, 0, false)).toBe(true);
+        expect(shouldIncludeGitDiffSummaryFile('modified', 0, 1, false)).toBe(true);
+        expect(shouldIncludeGitDiffSummaryFile('modified', 0, 0, true)).toBe(true);
+    });
+    it('keeps structural status changes even when line counts are zero', () => {
+        expect(shouldIncludeGitDiffSummaryFile('added', 0, 0, false)).toBe(true);
+        expect(shouldIncludeGitDiffSummaryFile('deleted', 0, 0, false)).toBe(true);
+        expect(shouldIncludeGitDiffSummaryFile('renamed', 0, 0, false)).toBe(true);
+    });
+});
 describe('error handling', () => {
     it('detects "no local changes" error', () => {
         const isNoChangesError = (stderr) => stderr.includes('No local changes to save');
@@ -111,7 +126,7 @@ describe('error handling', () => {
     });
     it('detects invalid stash reference', () => {
         const isInvalidRef = (stderr) => stderr.includes('is not a valid reference');
-        expect(isInvalidRef("stash@{99} is not a valid reference")).toBe(true);
+        expect(isInvalidRef('stash@{99} is not a valid reference')).toBe(true);
         expect(isInvalidRef('other error')).toBe(false);
     });
 });

package/dist/services/bridge-package-publish-hooks.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Bridge 包发布后通知服务
+ *
+ * 主干流程：读取 GitHub Actions 注入的 webhook URL 与密钥；两者均配置时，
+ * 读取当前包名/版本并发送带 HMAC 签名的 JSON 通知；任一配置缺失时安全跳过。
+ */
+import axios from "axios";
+import { type Logger } from "../utils/logger.js";
+export interface BridgePackageInfo {
+    name: string;
+    version: string;
+}
+export interface BridgePackagePublishPayload {
+    package: string;
+    version: string;
+    repository?: string;
+    ref?: string;
+    sha?: string;
+    runId?: string;
+    runNumber?: string;
+    publishedAt: string;
+}
+interface NotifyOptions {
+    env?: NodeJS.ProcessEnv;
+    logger?: Pick<Logger, "info" | "warn" | "error">;
+    packageInfo?: BridgePackageInfo;
+    now?: () => Date;
+    post?: typeof axios.post;
+}
+/**
+ * 具体功能实现：读取 package.json 中用于通知服务识别包版本的最小信息。
+ */
+export declare function readBridgePackageInfo(): Promise<BridgePackageInfo>;
+/**
+ * 具体功能实现：构造稳定的发布通知负载，附带 GitHub Actions 上下文便于服务端审计。
+ */
+export declare function createBridgePackagePublishPayload(packageInfo: BridgePackageInfo, env?: NodeJS.ProcessEnv, now?: () => Date): BridgePackagePublishPayload;
+/**
+ * 具体功能实现：对实际发送的 JSON 字符串签名，保证服务端验签与请求体完全一致。
+ */
+export declare function createBridgePublishSignature(body: string, secret: string): string;
+/**
+ * 主逻辑：根据环境变量决定跳过或发送发布通知；已配置 webhook 时失败会抛出，
+ * 让 GitHub Actions 明确暴露“包已发布但通知失败”的状态。
+ */
+export declare function notifyBridgePackagePublished(options?: NotifyOptions): Promise<boolean>;
+export {};
+//# sourceMappingURL=bridge-package-publish-hooks.d.ts.map

package/dist/services/bridge-package-publish-hooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-package-publish-hooks.d.ts","sourceRoot":"","sources":["../../src/services/bridge-package-publish-hooks.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQ/D,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;IACjD,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC;CAC1B;AA2BD;;GAEG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAYxE;AAED;;GAEG;AACH,wBAAgB,iCAAiC,CAC/C,WAAW,EAAE,iBAAiB,EAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,GAAG,GAAE,MAAM,IAAuB,GACjC,2BAA2B,CAW7B;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAGjF;AAED;;;GAGG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,OAAO,CAAC,CAwChG"}

package/dist/services/bridge-package-publish-hooks.js

@@ -0,0 +1,115 @@
+/**
+ * Bridge 包发布后通知服务
+ *
+ * 主干流程：读取 GitHub Actions 注入的 webhook URL 与密钥；两者均配置时，
+ * 读取当前包名/版本并发送带 HMAC 签名的 JSON 通知；任一配置缺失时安全跳过。
+ */
+import axios from "axios";
+import { createHmac } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { createLogger } from "../utils/logger.js";
+const HOOK_URL_ENV = "BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL";
+const HOOK_SECRET_ENV = "BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET";
+const DEFAULT_TIMEOUT_MS = 10_000;
+const publishHooksLogger = createLogger("bridge-package-publish-hooks");
+function normalizeOptionalString(value) {
+    if (value == null) {
+        return undefined;
+    }
+    const normalized = String(value).trim();
+    return normalized || undefined;
+}
+/**
+ * 具体功能实现：只暴露 URL 是否已配置，避免 CI 日志泄露 token 型 URL。
+ */
+function describeHookUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return `${parsed.protocol}//${parsed.host}`;
+    }
+    catch {
+        return "configured-url";
+    }
+}
+/**
+ * 具体功能实现：读取 package.json 中用于通知服务识别包版本的最小信息。
+ */
+export async function readBridgePackageInfo() {
+    const packageJsonUrl = new URL("../../package.json", import.meta.url);
+    const rawPackageJson = await readFile(packageJsonUrl, "utf-8");
+    const packageJson = JSON.parse(rawPackageJson);
+    const name = normalizeOptionalString(packageJson.name);
+    const version = normalizeOptionalString(packageJson.version);
+    if (!name || !version) {
+        throw new Error("package.json must contain non-empty name and version fields");
+    }
+    return { name, version };
+}
+/**
+ * 具体功能实现：构造稳定的发布通知负载，附带 GitHub Actions 上下文便于服务端审计。
+ */
+export function createBridgePackagePublishPayload(packageInfo, env = process.env, now = () => new Date()) {
+    return {
+        package: packageInfo.name,
+        version: packageInfo.version,
+        repository: normalizeOptionalString(env.GITHUB_REPOSITORY),
+        ref: normalizeOptionalString(env.GITHUB_REF),
+        sha: normalizeOptionalString(env.GITHUB_SHA),
+        runId: normalizeOptionalString(env.GITHUB_RUN_ID),
+        runNumber: normalizeOptionalString(env.GITHUB_RUN_NUMBER),
+        publishedAt: now().toISOString(),
+    };
+}
+/**
+ * 具体功能实现：对实际发送的 JSON 字符串签名，保证服务端验签与请求体完全一致。
+ */
+export function createBridgePublishSignature(body, secret) {
+    const digest = createHmac("sha256", secret).update(body, "utf-8").digest("hex");
+    return `sha256=${digest}`;
+}
+/**
+ * 主逻辑：根据环境变量决定跳过或发送发布通知；已配置 webhook 时失败会抛出，
+ * 让 GitHub Actions 明确暴露“包已发布但通知失败”的状态。
+ */
+export async function notifyBridgePackagePublished(options = {}) {
+    const env = options.env ?? process.env;
+    const logger = options.logger ?? publishHooksLogger;
+    const hookUrl = normalizeOptionalString(env[HOOK_URL_ENV]);
+    const hookSecret = normalizeOptionalString(env[HOOK_SECRET_ENV]);
+    if (!hookUrl && !hookSecret) {
+        logger.info("Bridge package publish hook is not configured. Skipping notification.");
+        return false;
+    }
+    if (!hookUrl || !hookSecret) {
+        logger.warn(`Bridge package publish hook requires both ${HOOK_URL_ENV} and ${HOOK_SECRET_ENV}. Skipping notification.`);
+        return false;
+    }
+    const packageInfo = options.packageInfo ?? (await readBridgePackageInfo());
+    const payload = createBridgePackagePublishPayload(packageInfo, env, options.now);
+    const body = JSON.stringify(payload);
+    const signature = createBridgePublishSignature(body, hookSecret);
+    const timestamp = String(Math.floor(Date.parse(payload.publishedAt) / 1000));
+    const post = options.post ?? axios.post;
+    logger.info(`Notifying bridge package publish hook for ${packageInfo.name}@${packageInfo.version} (${describeHookUrl(hookUrl)}).`);
+    await post(hookUrl, body, {
+        headers: {
+            "Content-Type": "application/json",
+            "X-Bridge-Signature": signature,
+            "X-Bridge-Timestamp": timestamp,
+        },
+        timeout: DEFAULT_TIMEOUT_MS,
+    });
+    logger.info(`Bridge package publish hook notified for ${packageInfo.name}@${packageInfo.version}.`);
+    return true;
+}
+const isCliEntry = process.argv[1]
+    ? fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+    : false;
+if (isCliEntry) {
+    notifyBridgePackagePublished().catch((error) => {
+        publishHooksLogger.error("Failed to notify bridge package publish hook:", error instanceof Error ? error.message : String(error));
+        process.exitCode = 1;
+    });
+}

package/dist/services/bridge-package-publish-hooks.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bridge-package-publish-hooks.test.d.ts.map

package/dist/services/bridge-package-publish-hooks.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-package-publish-hooks.test.d.ts","sourceRoot":"","sources":["../../src/services/bridge-package-publish-hooks.test.ts"],"names":[],"mappings":""}

package/dist/services/bridge-package-publish-hooks.test.js

@@ -0,0 +1,136 @@
+import { createHmac } from "node:crypto";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { createBridgePackagePublishPayload, createBridgePublishSignature, notifyBridgePackagePublished, readBridgePackageInfo, } from "./bridge-package-publish-hooks.js";
+const originalEnv = { ...process.env };
+function createLoggerMock() {
+    return {
+        info: vi.fn(),
+        warn: vi.fn(),
+        error: vi.fn(),
+    };
+}
+function createPublishEnv(overrides = {}) {
+    return {
+        ...originalEnv,
+        BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL: "",
+        BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET: "",
+        GITHUB_REPOSITORY: "owner/repo",
+        GITHUB_REF: "refs/heads/main",
+        GITHUB_SHA: "abc123",
+        GITHUB_RUN_ID: "456",
+        GITHUB_RUN_NUMBER: "789",
+        ...overrides,
+    };
+}
+const packageInfo = {
+    name: "aws-runtime-bridge",
+    version: "1.7.6",
+};
+afterEach(() => {
+    process.env = { ...originalEnv };
+    vi.clearAllMocks();
+    vi.restoreAllMocks();
+});
+describe("bridge package publish hooks", () => {
+    it("reads the bridge package name and version from package.json", async () => {
+        await expect(readBridgePackageInfo()).resolves.toMatchObject({
+            name: "aws-runtime-bridge",
+            version: expect.stringMatching(/^\d+\.\d+\.\d+/),
+        });
+    });
+    it("creates a publish payload with GitHub Actions metadata", () => {
+        const payload = createBridgePackagePublishPayload(packageInfo, createPublishEnv(), () => new Date("2026-05-23T12:00:00.000Z"));
+        expect(payload).toEqual({
+            package: "aws-runtime-bridge",
+            version: "1.7.6",
+            repository: "owner/repo",
+            ref: "refs/heads/main",
+            sha: "abc123",
+            runId: "456",
+            runNumber: "789",
+            publishedAt: "2026-05-23T12:00:00.000Z",
+        });
+    });
+    it("signs the exact request body with HMAC SHA-256", () => {
+        const body = JSON.stringify({ package: "aws-runtime-bridge", version: "1.7.6" });
+        const secret = "test-secret";
+        const expectedDigest = createHmac("sha256", secret).update(body, "utf-8").digest("hex");
+        expect(createBridgePublishSignature(body, secret)).toBe(`sha256=${expectedDigest}`);
+    });
+    it("skips notification when both hook URL and secret are absent", async () => {
+        const post = vi.fn();
+        const logger = createLoggerMock();
+        await expect(notifyBridgePackagePublished({
+            env: createPublishEnv(),
+            logger,
+            packageInfo,
+            post,
+        })).resolves.toBe(false);
+        expect(post).not.toHaveBeenCalled();
+        expect(logger.info).toHaveBeenCalledWith("Bridge package publish hook is not configured. Skipping notification.");
+        expect(JSON.stringify(logger)).not.toContain("test-secret");
+    });
+    it("skips notification when only one hook setting is configured", async () => {
+        const post = vi.fn();
+        const logger = createLoggerMock();
+        await expect(notifyBridgePackagePublished({
+            env: createPublishEnv({
+                BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL: "https://hooks.example.test/bridge",
+                BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET: "",
+            }),
+            logger,
+            packageInfo,
+            post,
+        })).resolves.toBe(false);
+        expect(post).not.toHaveBeenCalled();
+        expect(logger.warn).toHaveBeenCalledWith("Bridge package publish hook requires both BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL and BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET. Skipping notification.");
+    });
+    it("sends signed publish notification when hook URL and secret are configured", async () => {
+        const post = vi.fn().mockResolvedValue({ data: { success: true } });
+        const logger = createLoggerMock();
+        const secret = "super-secret-value";
+        const env = createPublishEnv({
+            BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL: "https://hooks.example.test/bridge?token=url-token",
+            BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET: secret,
+        });
+        await expect(notifyBridgePackagePublished({
+            env,
+            logger,
+            packageInfo,
+            now: () => new Date("2026-05-23T12:00:00.000Z"),
+            post,
+        })).resolves.toBe(true);
+        expect(post).toHaveBeenCalledTimes(1);
+        const [url, body, config] = post.mock.calls[0] ?? [];
+        expect(url).toBe("https://hooks.example.test/bridge?token=url-token");
+        expect(typeof body).toBe("string");
+        expect(JSON.parse(body)).toMatchObject({
+            package: "aws-runtime-bridge",
+            version: "1.7.6",
+            publishedAt: "2026-05-23T12:00:00.000Z",
+        });
+        expect(config).toMatchObject({
+            headers: {
+                "Content-Type": "application/json",
+                "X-Bridge-Signature": createBridgePublishSignature(body, secret),
+                "X-Bridge-Timestamp": "1779537600",
+            },
+            timeout: 10_000,
+        });
+        expect(logger.info).toHaveBeenCalledWith("Notifying bridge package publish hook for aws-runtime-bridge@1.7.6 (https://hooks.example.test).");
+        expect(JSON.stringify(logger.info.mock.calls)).not.toContain(secret);
+        expect(JSON.stringify(logger.info.mock.calls)).not.toContain("url-token");
+    });
+    it("surfaces notification failures when hook is configured", async () => {
+        const post = vi.fn().mockRejectedValue(new Error("network unavailable"));
+        await expect(notifyBridgePackagePublished({
+            env: createPublishEnv({
+                BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_URL: "https://hooks.example.test/bridge",
+                BRIDGE_PACKAGE_ON_PUBLIC_HOOKS_SECRET: "test-secret",
+            }),
+            logger: createLoggerMock(),
+            packageInfo,
+            post,
+        })).rejects.toThrow("network unavailable");
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aws-runtime-bridge",
-  "version": "1.7.6",
+  "version": "1.7.8",
   "description": "AgentsWorkStudio runtime bridge service for machine-level agent runtime integration",
   "type": "module",
   "main": "dist/index.js",