botrun-horse 2.30.0 → 2.34.0

package/botrun-c/scripts/github-collaborator-manager.ts

@@ -1,325 +0,0 @@
-#!/usr/bin/env node
-/**
- * GitHub Collaborator 管理工具 (TypeScript 版本)
- *
- * 使用方式:
- *   export GITHUB_TOKEN="ghp_your_token_here"
- *   npx tsx github-collaborator-manager.ts <command> [args...]
- *
- * 或整合到 Node.js 程式:
- *   import { GitHubCollaboratorManager } from './github-collaborator-manager';
- *   const manager = new GitHubCollaboratorManager('ghp_token', 'bohachu');
- *   await manager.addCollaborator('my-repo', 'alice', 'push');
- */
-
-// ==================== 型別定義 ====================
-interface Collaborator {
-  login: string;
-  permissions: {
-    pull: boolean;
-    push: boolean;
-    admin: boolean;
-  };
-}
-
-interface Repository {
-  name: string;
-  private: boolean;
-  html_url: string;
-}
-
-type Permission = 'pull' | 'push' | 'admin';
-
-// ==================== GitHubCollaboratorManager 類別 ====================
-class GitHubCollaboratorManager {
-  private token: string;
-  private owner: string;
-  private apiBase = 'https://api.github.com';
-
-  constructor(token: string, owner: string) {
-    this.token = token;
-    this.owner = owner;
-  }
-
-  // ========== API 呼叫基礎函數 ==========
-  private async apiCall<T>(
-    method: string,
-    endpoint: string,
-    data?: any
-  ): Promise<T> {
-    const url = `${this.apiBase}${endpoint}`;
-    const headers: HeadersInit = {
-      'Authorization': `token ${this.token}`,
-      'Accept': 'application/vnd.github.v3+json',
-      'Content-Type': 'application/json',
-    };
-
-    const options: RequestInit = {
-      method,
-      headers,
-    };
-
-    if (data) {
-      options.body = JSON.stringify(data);
-    }
-
-    const response = await fetch(url, options);
-
-    if (!response.ok) {
-      const error = await response.json().catch(() => ({}));
-      throw new Error(
-        `GitHub API 錯誤 (${response.status}): ${error.message || response.statusText}`
-      );
-    }
-
-    // DELETE 請求可能沒有 body
-    if (method === 'DELETE') {
-      return {} as T;
-    }
-
-    return response.json();
-  }
-
-  // ========== 驗證 Token ==========
-  async verifyToken(): Promise<{ valid: boolean; login?: string }> {
-    try {
-      const user: any = await this.apiCall('GET', '/user');
-      return { valid: true, login: user.login };
-    } catch (error) {
-      return { valid: false };
-    }
-  }
-
-  // ========== 列出所有 Repo ==========
-  async listRepositories(): Promise<Repository[]> {
-    return this.apiCall<Repository[]>(
-      'GET',
-      `/users/${this.owner}/repos?per_page=100`
-    );
-  }
-
-  // ========== 列出 Collaborators ==========
-  async listCollaborators(repo: string): Promise<Collaborator[]> {
-    return this.apiCall<Collaborator[]>(
-      'GET',
-      `/repos/${this.owner}/${repo}/collaborators`
-    );
-  }
-
-  // ========== 新增 Collaborator ==========
-  async addCollaborator(
-    repo: string,
-    username: string,
-    permission: Permission = 'push'
-  ): Promise<void> {
-    await this.apiCall(
-      'PUT',
-      `/repos/${this.owner}/${repo}/collaborators/${username}`,
-      { permission }
-    );
-  }
-
-  // ========== 移除 Collaborator ==========
-  async removeCollaborator(repo: string, username: string): Promise<void> {
-    await this.apiCall(
-      'DELETE',
-      `/repos/${this.owner}/${repo}/collaborators/${username}`
-    );
-  }
-
-  // ========== 批次新增 Collaborator ==========
-  async batchAddCollaborator(
-    username: string,
-    permission: Permission = 'push',
-    repoFilter?: (repo: Repository) => boolean
-  ): Promise<{ success: string[]; failed: string[] }> {
-    const repos = await this.listRepositories();
-    const targetRepos = repoFilter ? repos.filter(repoFilter) : repos;
-
-    const success: string[] = [];
-    const failed: string[] = [];
-
-    for (const repo of targetRepos) {
-      try {
-        await this.addCollaborator(repo.name, username, permission);
-        success.push(repo.name);
-      } catch (error) {
-        failed.push(repo.name);
-      }
-    }
-
-    return { success, failed };
-  }
-
-  // ========== 生成報告 ==========
-  async generateReport(): Promise<string> {
-    const repos = await this.listRepositories();
-    let report = '='.repeat(50) + '\n';
-    report += `GitHub Collaborator 報告\n`;
-    report += `Owner: ${this.owner}\n`;
-    report += `時間: ${new Date().toLocaleString('zh-TW')}\n`;
-    report += '='.repeat(50) + '\n\n';
-
-    for (const repo of repos) {
-      report += `🔹 ${repo.name} (${repo.private ? 'private' : 'public'})\n`;
-      try {
-        const collaborators = await this.listCollaborators(repo.name);
-        for (const collab of collaborators) {
-          const perms = Object.entries(collab.permissions)
-            .filter(([_, v]) => v)
-            .map(([k, _]) => k)
-            .join(', ');
-          report += `    - ${collab.login} (${perms})\n`;
-        }
-      } catch (error) {
-        report += `    ⚠️  無法存取\n`;
-      }
-      report += '\n';
-    }
-
-    return report;
-  }
-}
-
-// ==================== CLI 介面 ====================
-async function main() {
-  const token = process.env.GITHUB_TOKEN;
-  if (!token) {
-    console.error('❌ 請設定 GITHUB_TOKEN 環境變數');
-    console.error('範例: export GITHUB_TOKEN="ghp_your_token_here"');
-    process.exit(1);
-  }
-
-  const owner = process.env.GITHUB_OWNER || 'bohachu';  // ⚠️ 修改預設值
-  const manager = new GitHubCollaboratorManager(token, owner);
-
-  const [, , command, ...args] = process.argv;
-
-  try {
-    switch (command) {
-      case 'verify': {
-        const result = await manager.verifyToken();
-        if (result.valid) {
-          console.log(`✅ Token 有效！目前登入為: ${result.login}`);
-        } else {
-          console.error('❌ Token 無效或已過期');
-          process.exit(1);
-        }
-        break;
-      }
-
-      case 'list-repos': {
-        const repos = await manager.listRepositories();
-        console.log(`📚 ${owner} 的所有 repo (${repos.length} 個):\n`);
-        repos.forEach(repo => {
-          console.log(`  - ${repo.name} (${repo.private ? 'private' : 'public'})`);
-        });
-        break;
-      }
-
-      case 'list': {
-        const [repo] = args;
-        if (!repo) {
-          console.error('❌ 請指定 repo 名稱');
-          process.exit(1);
-        }
-        const collaborators = await manager.listCollaborators(repo);
-        console.log(`📋 ${owner}/${repo} 的 collaborators:\n`);
-        collaborators.forEach(collab => {
-          const perms = Object.entries(collab.permissions)
-            .filter(([_, v]) => v)
-            .map(([k, _]) => k)
-            .join(', ');
-          console.log(`  - ${collab.login} (${perms})`);
-        });
-        break;
-      }
-
-      case 'add': {
-        const [repo, username, permission = 'push'] = args;
-        if (!repo || !username) {
-          console.error('❌ 使用方式: add <repo> <username> [permission]');
-          process.exit(1);
-        }
-        await manager.addCollaborator(repo, username, permission as Permission);
-        console.log(`✅ 成功邀請 ${username} 到 ${repo} (權限: ${permission})`);
-        break;
-      }
-
-      case 'remove': {
-        const [repo, username] = args;
-        if (!repo || !username) {
-          console.error('❌ 使用方式: remove <repo> <username>');
-          process.exit(1);
-        }
-        await manager.removeCollaborator(repo, username);
-        console.log(`✅ 成功移除 ${username} 從 ${repo}`);
-        break;
-      }
-
-      case 'batch-add': {
-        const [username, permission = 'push'] = args;
-        if (!username) {
-          console.error('❌ 使用方式: batch-add <username> [permission]');
-          process.exit(1);
-        }
-        console.log(`⏳ 批次新增 ${username} 到所有 repo...`);
-        const result = await manager.batchAddCollaborator(
-          username,
-          permission as Permission
-        );
-        console.log(`\n✅ 成功: ${result.success.length} 個`);
-        if (result.failed.length > 0) {
-          console.log(`❌ 失敗: ${result.failed.length} 個`);
-          console.log(`失敗的 repo: ${result.failed.join(', ')}`);
-        }
-        break;
-      }
-
-      case 'report': {
-        console.log('⏳ 生成報告中...\n');
-        const report = await manager.generateReport();
-        console.log(report);
-        break;
-      }
-
-      default: {
-        console.log(`
-📚 GitHub Collaborator 管理工具 (TypeScript 版本)
-
-使用方式:
-  export GITHUB_TOKEN="ghp_your_token_here"
-  npx tsx github-collaborator-manager.ts <command> [args...]
-
-命令:
-  verify                              驗證 Token 是否有效
-  list-repos                          列出所有 repo
-  list <repo>                         列出某個 repo 的 collaborator
-  add <repo> <username> [permission]  新增 collaborator
-  remove <repo> <username>            移除 collaborator
-  batch-add <username> [permission]   批次新增到所有 repo
-  report                              生成完整報告
-
-範例:
-  npx tsx github-collaborator-manager.ts verify
-  npx tsx github-collaborator-manager.ts list my-repo
-  npx tsx github-collaborator-manager.ts add my-repo alice push
-  npx tsx github-collaborator-manager.ts remove my-repo bob
-  npx tsx github-collaborator-manager.ts batch-add charlie admin
-  npx tsx github-collaborator-manager.ts report
-        `);
-        break;
-      }
-    }
-  } catch (error) {
-    console.error(`❌ 錯誤: ${(error as Error).message}`);
-    process.exit(1);
-  }
-}
-
-// ==================== 執行 CLI 或匯出類別 ====================
-if (require.main === module) {
-  main();
-}
-
-export { GitHubCollaboratorManager, Collaborator, Repository, Permission };

package/botrun-c/scripts/manage-collaborators.sh

@@ -1,91 +0,0 @@
-#!/bin/bash
-# GitHub Collaborator 管理工具
-# 使用方式: ./manage-collaborators.sh <action> <repo> <username>
-
-set -e
-
-GITHUB_TOKEN="${GITHUB_TOKEN:-}"
-OWNER="bohachu"  # 修改為你的 GitHub 帳號
-
-if [ -z "$GITHUB_TOKEN" ]; then
-  echo "❌ 錯誤: 請設定 GITHUB_TOKEN 環境變數"
-  echo "範例: export GITHUB_TOKEN='ghp_your_token_here'"
-  exit 1
-fi
-
-show_usage() {
-  cat << EOF
-📚 使用方式:
-  ./manage-collaborators.sh list <repo>
-  ./manage-collaborators.sh add <repo> <username> [permission]
-  ./manage-collaborators.sh remove <repo> <username>
-  ./manage-collaborators.sh list-all
-
-參數:
-  permission: pull (唯讀), push (讀寫), admin (管理員)，預設 push
-
-範例:
-  ./manage-collaborators.sh list botrun-claude-agent-jp-doctor-日本醫生mcp
-  ./manage-collaborators.sh add my-repo alice push
-  ./manage-collaborators.sh remove my-repo bob
-  ./manage-collaborators.sh list-all
-EOF
-}
-
-cmd_list() {
-  local repo="$1"
-  echo "📋 Collaborators in $OWNER/$repo:"
-  gh api "/repos/$OWNER/$repo/collaborators" --jq '.[] | "  - \(.login) (\(.permissions | to_entries[] | select(.value == true) | .key | gsub("push"; "write")))"'
-}
-
-cmd_add() {
-  local repo="$1"
-  local username="$2"
-  local permission="${3:-push}"
-
-  echo "➕ 新增 $username 到 $OWNER/$repo (權限: $permission)..."
-  gh api -X PUT "/repos/$OWNER/$repo/collaborators/$username" \
-    -f permission="$permission"
-  echo "✅ 成功！"
-}
-
-cmd_remove() {
-  local repo="$1"
-  local username="$2"
-
-  echo "➖ 移除 $username 從 $OWNER/$repo..."
-  gh api -X DELETE "/repos/$OWNER/$repo/collaborators/$username"
-  echo "✅ 成功！"
-}
-
-cmd_list_all() {
-  echo "📚 列出所有 repo 的 collaborators..."
-  for repo in $(gh repo list "$OWNER" --limit 1000 --json name -q '.[].name'); do
-    echo ""
-    echo "🔹 $repo"
-    cmd_list "$repo" || echo "  ⚠️  無法存取"
-  done
-}
-
-# Main
-case "${1:-}" in
-  list)
-    [ -z "$2" ] && { show_usage; exit 1; }
-    cmd_list "$2"
-    ;;
-  add)
-    [ -z "$2" ] || [ -z "$3" ] && { show_usage; exit 1; }
-    cmd_add "$2" "$3" "${4:-push}"
-    ;;
-  remove)
-    [ -z "$2" ] || [ -z "$3" ] && { show_usage; exit 1; }
-    cmd_remove "$2" "$3"
-    ;;
-  list-all)
-    cmd_list_all
-    ;;
-  *)
-    show_usage
-    exit 1
-    ;;
-esac

package/botrun-c/scripts/setup-secrets.sh

@@ -1,202 +0,0 @@
-#!/bin/bash
-# ==============================================================================
-# Google Secret Manager 設定腳本
-# 用途：將所有敏感環境變數遷移到 Google Secret Manager
-# ==============================================================================
-
-set -e  # 遇到錯誤立即停止
-
-# 顏色定義
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-echo -e "${GREEN}======================================${NC}"
-echo -e "${GREEN}Google Secret Manager 設定${NC}"
-echo -e "${GREEN}======================================${NC}"
-echo ""
-
-# ==============================================================================
-# 1. 檢查必要工具
-# ==============================================================================
-echo -e "${YELLOW}[1/6] 檢查必要工具...${NC}"
-
-if ! command -v gcloud &> /dev/null; then
-    echo -e "${RED}錯誤: 找不到 gcloud CLI${NC}"
-    echo "請安裝 Google Cloud SDK: https://cloud.google.com/sdk/docs/install"
-    exit 1
-fi
-
-if ! command -v jq &> /dev/null; then
-    echo -e "${RED}錯誤: 找不到 jq${NC}"
-    echo "請安裝 jq: brew install jq"
-    exit 1
-fi
-
-echo -e "${GREEN}✓ 工具檢查完成${NC}"
-echo ""
-
-# ==============================================================================
-# 2. 設定 GCP 專案
-# ==============================================================================
-echo -e "${YELLOW}[2/6] 設定 GCP 專案...${NC}"
-
-# 從 .env 讀取專案 ID
-if [ -f .env ]; then
-    export $(grep -v '^#' .env | grep GOOGLE_CLOUD_PROJECT | xargs)
-fi
-
-# 如果沒有設定，詢問使用者
-if [ -z "$GOOGLE_CLOUD_PROJECT" ]; then
-    echo -e "${YELLOW}請輸入 GCP 專案 ID:${NC}"
-    read -r GOOGLE_CLOUD_PROJECT
-fi
-
-echo "使用專案: $GOOGLE_CLOUD_PROJECT"
-gcloud config set project "$GOOGLE_CLOUD_PROJECT"
-
-echo -e "${GREEN}✓ 專案設定完成${NC}"
-echo ""
-
-# ==============================================================================
-# 3. 啟用 Secret Manager API
-# ==============================================================================
-echo -e "${YELLOW}[3/6] 啟用 Secret Manager API...${NC}"
-
-gcloud services enable secretmanager.googleapis.com
-
-echo -e "${GREEN}✓ API 已啟用${NC}"
-echo ""
-
-# ==============================================================================
-# 4. 建立 secrets（從 .env 讀取）
-# ==============================================================================
-echo -e "${YELLOW}[4/6] 遷移敏感環境變數到 Secret Manager...${NC}"
-
-# 定義需要遷移的 secrets（極高敏感度）
-CRITICAL_SECRETS=(
-    "ANTHROPIC_API_KEY"
-)
-
-# 定義需要遷移的 service account JSON 檔案
-SERVICE_ACCOUNT_FILES=(
-    "keys/agentic-botrun-gcs-service-account-key.json:GCS_SERVICE_ACCOUNT_JSON"
-    "keys/firebase-admin-key.json:FIREBASE_SERVICE_ACCOUNT_JSON"
-)
-
-# 從 .env 讀取環境變數
-if [ -f .env ]; then
-    export $(grep -v '^#' .env | xargs)
-fi
-
-# 遷移環境變數
-for SECRET_NAME in "${CRITICAL_SECRETS[@]}"; do
-    echo -e "${YELLOW}處理: $SECRET_NAME${NC}"
-
-    # 取得環境變數的值
-    SECRET_VALUE="${!SECRET_NAME}"
-
-    if [ -z "$SECRET_VALUE" ]; then
-        echo -e "${RED}警告: $SECRET_NAME 未設定，跳過${NC}"
-        continue
-    fi
-
-    # 檢查 secret 是否已存在
-    if gcloud secrets describe "$SECRET_NAME" &> /dev/null; then
-        echo "Secret $SECRET_NAME 已存在，新增新版本..."
-        echo -n "$SECRET_VALUE" | gcloud secrets versions add "$SECRET_NAME" --data-file=-
-    else
-        echo "建立新 secret: $SECRET_NAME"
-        echo -n "$SECRET_VALUE" | gcloud secrets create "$SECRET_NAME" \
-            --data-file=- \
-            --replication-policy="automatic"
-    fi
-
-    echo -e "${GREEN}✓ $SECRET_NAME 已遷移${NC}"
-    echo ""
-done
-
-# 遷移 service account JSON 檔案
-for FILE_MAPPING in "${SERVICE_ACCOUNT_FILES[@]}"; do
-    FILE_PATH="${FILE_MAPPING%%:*}"
-    SECRET_NAME="${FILE_MAPPING##*:}"
-
-    echo -e "${YELLOW}處理: $SECRET_NAME (from $FILE_PATH)${NC}"
-
-    if [ ! -f "$FILE_PATH" ]; then
-        echo -e "${RED}警告: 找不到檔案 $FILE_PATH，跳過${NC}"
-        continue
-    fi
-
-    # 檢查 secret 是否已存在
-    if gcloud secrets describe "$SECRET_NAME" &> /dev/null; then
-        echo "Secret $SECRET_NAME 已存在，新增新版本..."
-        gcloud secrets versions add "$SECRET_NAME" --data-file="$FILE_PATH"
-    else
-        echo "建立新 secret: $SECRET_NAME"
-        gcloud secrets create "$SECRET_NAME" \
-            --data-file="$FILE_PATH" \
-            --replication-policy="automatic"
-    fi
-
-    echo -e "${GREEN}✓ $SECRET_NAME 已遷移${NC}"
-    echo ""
-done
-
-echo -e "${GREEN}✓ 所有 secrets 遷移完成${NC}"
-echo ""
-
-# ==============================================================================
-# 5. 設定 Cloud Run 服務帳戶權限
-# ==============================================================================
-echo -e "${YELLOW}[5/6] 設定服務帳戶權限...${NC}"
-
-# 取得專案編號
-PROJECT_NUMBER=$(gcloud projects describe "$GOOGLE_CLOUD_PROJECT" --format="value(projectNumber)")
-
-# Cloud Run 預設服務帳戶
-SERVICE_ACCOUNT="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"
-
-echo "授予 Secret Manager 存取權限給: $SERVICE_ACCOUNT"
-
-# 為每個 secret 授予存取權限
-ALL_SECRETS=("${CRITICAL_SECRETS[@]}")
-for FILE_MAPPING in "${SERVICE_ACCOUNT_FILES[@]}"; do
-    SECRET_NAME="${FILE_MAPPING##*:}"
-    ALL_SECRETS+=("$SECRET_NAME")
-done
-
-for SECRET_NAME in "${ALL_SECRETS[@]}"; do
-    echo "授權 $SECRET_NAME..."
-    gcloud secrets add-iam-policy-binding "$SECRET_NAME" \
-        --member="serviceAccount:$SERVICE_ACCOUNT" \
-        --role="roles/secretmanager.secretAccessor" \
-        &> /dev/null || true
-done
-
-echo -e "${GREEN}✓ 權限設定完成${NC}"
-echo ""
-
-# ==============================================================================
-# 6. 產生摘要報告
-# ==============================================================================
-echo -e "${YELLOW}[6/6] 產生摘要報告...${NC}"
-echo ""
-echo -e "${GREEN}======================================${NC}"
-echo -e "${GREEN}設定完成！${NC}"
-echo -e "${GREEN}======================================${NC}"
-echo ""
-echo "已建立的 Secrets:"
-gcloud secrets list --format="table(name,createTime)"
-echo ""
-echo -e "${YELLOW}下一步:${NC}"
-echo "1. 更新 Cloud Run 部署，使用 Secret Manager"
-echo "2. 從 .env 檔案移除敏感變數"
-echo "3. 測試應用程式運作正常"
-echo ""
-echo -e "${RED}重要提醒:${NC}"
-echo "- 請立即重置所有已洩露的 API 金鑰"
-echo "- 不要將 .env 檔案提交到 git"
-echo "- 定期輪換 secrets"
-echo ""