codebee 0.1.95 → 0.1.97

package/app/main.py

@@ -143,6 +143,7 @@ class Handler(BaseHTTPRequestHandler):
             return cached
         raw_len = self.headers.get("Content-Length")
         if not raw_len:
+            self._raw_body = b""
             body = {}
         else:
             try:
@@ -158,6 +159,7 @@ class Handler(BaseHTTPRequestHandler):
                 body = {}
             else:
                 data = self.rfile.read(n)
+                self._raw_body = data
                 try:
                     text = data.decode("utf-8")
                 except UnicodeDecodeError:
@@ -171,6 +173,12 @@ class Handler(BaseHTTPRequestHandler):
         self._parsed_body = body
         return body
 
+    def _raw_request_body(self):
+        """Return the exact bytes used for webhook signature verification."""
+        if not hasattr(self, "_raw_body"):
+            self._body()
+        return getattr(self, "_raw_body", b"")
+
     # ------------------------------------------------------------ 远程访问
     def _forwarded_ip(self):
         """经代理进来的真实客户端 IP：X-Forwarded-For 首跳，缺省 CF-Connecting-IP。"""
@@ -278,6 +286,13 @@ class Handler(BaseHTTPRequestHandler):
             if path == "/api/board":
                 # 任务驾驶舱大屏的轻量聚合（KB 级；别让它去拉 /api/state 全量）
                 return self._json(200, board.payload())
+            if path == "/api/board/run":
+                # 大屏下钻抽屉的步骤链：点开才拉，不进 /api/board 的 8 秒缓存
+                rid = (parse_qs(urlparse(self.path).query).get("run_id") or [""])[0]
+                detail = board.run_detail(rid)
+                if not detail:
+                    return self._json(404, {"error": "not found"})
+                return self._json(200, detail)
             if path == "/api/analytics":
                 from core import analytics
                 return self._json(200, analytics.summary(store))
@@ -300,6 +315,13 @@ class Handler(BaseHTTPRequestHandler):
                 qs = parse_qs(urlparse(self.path).query)
                 fid = (qs.get("id") or [""])[0]
                 return self._json(200, {"versions": flows.flow_versions(fid)})
+            m = re.match(r"^/api/flows/([^/]+)/graph$", path)
+            if m:
+                from core import flow_graph
+                try:
+                    return self._json(200, {"graph": flow_graph.build(m.group(1))})
+                except ValueError as exc:
+                    return self._json(404, {"error": str(exc)})
             if path == "/api/skills":
                 from core import skills
                 v = skills.view()
@@ -326,6 +348,16 @@ class Handler(BaseHTTPRequestHandler):
             if path == "/api/knowledge":
                 from core import knowledge
                 return self._json(200, knowledge.view())
+            m = re.match(r"^/api/tasks/([^/]+)/memory$", path)
+            if m:
+                task = store.get_task(m.group(1))
+                if not task:
+                    return self._json(404, {"error": "not found"})
+                from core import project_memory
+                try:
+                    return self._json(200, {"entries": project_memory.list_entries(task.get("workdir"))})
+                except (OSError, ValueError) as exc:
+                    return self._json(409, {"error": str(exc)})
             if path == "/api/agents/presence":
                 from core import presence
                 return self._json(200, {"agents": presence.list_agents()})
@@ -339,8 +371,18 @@ class Handler(BaseHTTPRequestHandler):
                     return self._json(400, {"error": str(exc)})
                 return self._json(200, {"query": (q.get("q") or [""])[0][:500],
                                         "results": results})
+            if path == "/api/knowledge/pipeline":
+                from core import knowledge_pipeline
+                q = parse_qs(urlparse(self.path).query)
+                return self._json(200, knowledge_pipeline.quality_report(
+                    (q.get("ingest_id") or [""])[0]))
+            if path == "/api/policy":
+                from core import policy
+                q = parse_qs(urlparse(self.path).query)
+                return self._json(200, policy.normalize_sandbox(
+                    {}, (q.get("workdir") or [settings.default_workdir()])[0]))
             if path == "/api/settings":
-                return self._json(200, dict(settings.load(), **jobs.workers_info()))
+                return self._json(200, dict(settings.public_view(), **jobs.workers_info()))
             if path == "/api/settings-v2":
                 # schema 化设置全貌（secret 已脱敏；前端调参卡直读）
                 from core import settings_schema as ss2
@@ -554,6 +596,24 @@ class Handler(BaseHTTPRequestHandler):
                 from core import dispatch_log, tracing
                 return self._json(200, {"trace": tracing.build_trace(
                     run, dispatch_log.replay(run_id=m.group(1), limit=200))})
+            m = re.match(r"^/api/runs/([^/]+)/otel$", path)
+            if m:
+                run = store.get_run(m.group(1))
+                if not run:
+                    return self._json(404, {"error": "not found"})
+                from core import dispatch_log, tracing
+                trace = tracing.build_trace(run, dispatch_log.replay(run_id=m.group(1), limit=200))
+                return self._json(200, tracing.to_otel(trace))
+            m = re.match(r"^/api/runs/([^/]+)/checkpoints$", path)
+            if m:
+                if not store.get_run(m.group(1)):
+                    return self._json(404, {"error": "not found"})
+                from core import checkpoints
+                run = store.get_run(m.group(1)) or {}
+                task = store.get_task(run.get("task_id")) or {}
+                return self._json(200, {
+                    "checkpoint": checkpoints.replay_preview(m.group(1)),
+                    "files": checkpoints.snapshot_preview(m.group(1), task.get("workdir") or "")})
             m = re.match(r"^/api/runs/([^/]+)/preview$", path)
             if m:
                 # 网页成品预览：入口 HTML + 同目录代码文件（前端渲染「预览」页签）
@@ -847,6 +907,22 @@ class Handler(BaseHTTPRequestHandler):
             return self._json(200, {"ok": ok, "output": out})
         if path == "/api/tasks/clarify":
             return self._api_task_clarify()
+        m = re.match(r"^/api/tasks/([^/]+)/memory$", path)
+        if m:
+            task = store.get_task(m.group(1))
+            if not task:
+                return self._json(404, {"error": "not found"})
+            body = self._body() or {}
+            from core import project_memory
+            try:
+                row = project_memory.decide(task.get("workdir"), body.get("id"),
+                                            body.get("action"),
+                                            expected_version=body.get("expected_version"))
+                return self._json(200, {"entry": row})
+            except KeyError as exc:
+                return self._json(404, {"error": str(exc)})
+            except (OSError, TypeError, ValueError) as exc:
+                return self._json(400, {"error": str(exc)})
         if path == "/api/agents/presence":
             from core import presence
             body = self._body() or {}
@@ -947,7 +1023,8 @@ class Handler(BaseHTTPRequestHandler):
             return self._json(200, dict(ok=True, **info))
         if path == "/api/evalbench/cancel":
             from core import evalbench
-            return self._json(200, {"ok": evalbench.cancel()})
+            body = self._body() or {}
+            return self._json(200, evalbench.cancel(force=bool(body.get("force"))))
         if path == "/api/evalbench/sample-op":
             # 自定义样题增删：{op:add|delete, sample:{...}|sid}
             from core import evalbench
@@ -972,6 +1049,32 @@ class Handler(BaseHTTPRequestHandler):
             if err:
                 return self._json(400, {"error": err})
             return self._json(200, dict(ok=True, **res))
+        if path == "/api/eval-matrix/normalize":
+            from core import eval_matrix
+            try:
+                return self._json(200, {"manifest": eval_matrix.normalize_manifest(self._body())})
+            except ValueError as exc:
+                return self._json(400, {"error": str(exc)})
+        if path == "/api/eval-matrix/evaluate":
+            from core import eval_matrix
+            body = self._body() or {}
+            try:
+                report = eval_matrix.evaluate(body.get("manifest"),
+                                              body.get("results"), body.get("baseline"))
+            except ValueError as exc:
+                return self._json(400, {"error": str(exc)})
+            return self._json(200, {"report": report})
+        if path == "/api/knowledge/pipeline":
+            from core import knowledge_pipeline
+            body = self._body() or {}
+            try:
+                report = knowledge_pipeline.ingest(
+                    body.get("source"), body.get("text"), body.get("metadata"),
+                    chunk_size=body.get("chunk_size", 1200),
+                    overlap=body.get("overlap", 120))
+            except ValueError as exc:
+                return self._json(400, {"error": str(exc)})
+            return self._json(200, {"ok": True, "report": report})
         if path == "/api/hooks/run":
             return self._api_hook_run()
         if path == "/api/health/op":
@@ -1181,6 +1284,35 @@ class Handler(BaseHTTPRequestHandler):
         m = re.match(r"^/api/(tasks|runs)/([^/]+)/reveal$", path)
         if m:
             return self._api_reveal(m.group(1), m.group(2))
+        m = re.match(r"^/api/runs/([^/]+)/checkpoints/restore$", path)
+        if m:
+            if not bool((self._body() or {}).get("confirm")):
+                return self._json(400, {"error": "文件恢复会覆盖检查点记录的文件，请确认 confirm=true 后重试"})
+            run = store.get_run(m.group(1))
+            if not run:
+                return self._json(404, {"error": "not found"})
+            if run.get("status") not in ("done", "failed", "cancelled", "timeout"):
+                return self._json(409, {"error": "任务仍在运行或排队；请先停止并等待终态后再恢复文件"})
+            task = store.get_task(run.get("task_id")) or {}
+            if not task.get("workdir"):
+                return self._json(409, {"error": "任务工作目录不可用，拒绝恢复"})
+            from core import checkpoints
+            # Serialize the final safety check and file restore with run creation
+            # and status transitions. Otherwise a new run can start on this task
+            # after the terminal check and race with restoration in the same tree.
+            with store.LOCK:
+                current = store.get_run(m.group(1)) or {}
+                task = store.get_task(current.get("task_id")) or {}
+                latest = store.latest_run_by_task().get(current.get("task_id")) or {}
+                terminal = ("done", "failed", "cancelled", "timeout")
+                if current.get("status") not in terminal:
+                    return self._json(409, {"error": "任务状态已变化；请等待终态后再恢复文件"})
+                task_active = task.get("status") in ("queued", "running")
+                newer_run_active = latest.get("status") in ("queued", "running")
+                if task_active or newer_run_active:
+                    return self._json(409, {"error": "该任务已有运行中的新任务；请等待其结束后再恢复文件"})
+                return self._json(200, checkpoints.restore_files(
+                    m.group(1), task.get("workdir") or ""))
         m = re.match(r"^/api/runs/([^/]+)/messages$", path)
         if m:
             return self._api_add_message(m.group(1))
@@ -1500,9 +1632,9 @@ class Handler(BaseHTTPRequestHandler):
         if path == "/api/settings":
             view, err = settings.save(self._body())
             if err:
-                return self._json(400, {"error": err, "settings": view})
+                return self._json(400, {"error": err, "settings": settings.public_view(view)})
             n = jobs.configure(view["max_concurrent_jobs"])
-            return self._json(200, {"ok": True, "settings": view, "workers": n})
+            return self._json(200, {"ok": True, "settings": settings.public_view(view), "workers": n})
         m = re.match(r"^/api/settings-v2/([a-z_-]+)$", path)
         if m:
             # schema 化设置写入口：{ops:[{op:"set",path,value}], expected_revision?}
@@ -2143,11 +2275,14 @@ class Handler(BaseHTTPRequestHandler):
         force = bool(body.get("force"))
         force_confirmed = bool(body.get("force_confirmed"))
         force_reason = str(body.get("force_reason") or "").strip()
+        only = body.get("chapters")            # 批量选择发布：章号数组（可省=全部待发）
+        kwargs = {"only": only if isinstance(only, list) else None}
+        if force or force_confirmed or force_reason:
+            kwargs.update(force=force, force_confirmed=force_confirmed,
+                          force_reason=force_reason)
         ok, err = pub_auto.publish_pending_async(
             task_id, platform, auto_submit=bool(body.get("auto_submit")),
-            **({"force": force, "force_confirmed": force_confirmed,
-                "force_reason": force_reason}
-               if force or force_confirmed or force_reason else {}))
+            **kwargs)
         if not ok:
             payload = {"error": err or "操作失败"}
             if str(err or "").startswith("质量门禁拦截："):
@@ -2988,8 +3123,16 @@ class Handler(BaseHTTPRequestHandler):
                   '[{"q": "问题", "options": ["选项1", "选项2"]}]' % (ttype, goal[:200]))
         try:
             # 澄清是可选增强，不能占住创建请求；主流程有自己的执行超时。
+            # 此调用只负责生成问题，不得继承完整执行工具权限或访问网络。
+            from core import policy
+            clarify_sandbox = policy.normalize_sandbox({
+                "network": False,
+                "disabled_tools": ["run_command", "write_file", "edit_file",
+                                   "append_file", "fs_manage", "create_task",
+                                   "read_tool_output"],
+            }, os.getcwd() if hasattr(os, "getcwd") else ".")
             res = builtin_agent.run(bi, prompt, os.getcwd() if hasattr(os, "getcwd") else ".",
-                                    timeout=8)
+                                    timeout=8, sandbox=clarify_sandbox)
             import json as _json
             arr = None
             text = (res.get("text") or "").strip()
@@ -3024,10 +3167,13 @@ class Handler(BaseHTTPRequestHandler):
         POST /api/hooks/run，头 X-CodeBee-Token；体 {goal 必填, type, workdir,
         context, title}。令牌取设置 hooks_token（data/settings.json，UI/文件均可
         配置）：已配置则必须精确匹配；未配置仅放行本机回环。任务链与 UI 完全相同。"""
+        from core import webhooks
         try:
-            tok = str(settings.load().get("hooks_token") or "")
+            cfg = settings.load()
+            tok = str(cfg.get("hooks_token") or "")
+            signing_secret = str(cfg.get("hooks_signing_secret") or "")
         except Exception:
-            tok = ""
+            tok, signing_secret = "", ""
         given = (self.headers.get("X-CodeBee-Token") or "").strip()
         if tok:
             if given != tok:
@@ -3037,6 +3183,18 @@ class Handler(BaseHTTPRequestHandler):
             if host not in ("127.0.0.1", "::1", "::ffff:127.0.0.1"):
                 return self._json(403, {
                     "error": "未配置 hooks.token，仅允许本机触发；请先在设置中配置令牌"})
+        # Optional HMAC envelope for GitHub/GitLab-style integrations. A
+        # configured secret makes the signature mandatory; token auth remains
+        # useful for old local scripts when no secret is configured.
+        if signing_secret:
+            timestamp = self.headers.get("X-CodeBee-Timestamp") or ""
+            signature = (self.headers.get("X-CodeBee-Signature") or
+                         self.headers.get("X-Hub-Signature-256") or "")
+            signed = (webhooks.verify(signing_secret, self._raw_request_body(),
+                                      signature, timestamp) if timestamp else
+                      webhooks.verify_raw(signing_secret, self._raw_request_body(), signature))
+            if not signed:
+                return self._json(401, {"error": "Webhook 签名无效或已过期"})
         raw = self._body()
         payload = {}
         for k, cap in (("goal", 4000), ("context", 4000), ("type", 40),
@@ -3050,7 +3208,18 @@ class Handler(BaseHTTPRequestHandler):
             payload["type"] = "direct"
         if not payload.get("title"):
             payload["title"] = payload["goal"][:30]
+        delivery_id = (self.headers.get("X-CodeBee-Delivery") or
+                       self.headers.get("X-Delivery-Id") or "").strip()
+        if delivery_id:
+            claimed, info = webhooks.claim_delivery(delivery_id)
+            if not claimed:
+                return self._json(200, {"ok": True, "deduplicated": True,
+                                        "delivery_id": info.get("delivery_id")})
         status, resp = self._create_and_start(payload)
+        if delivery_id and status != 200:
+            webhooks.release_delivery(delivery_id)
+        if delivery_id:
+            resp = dict(resp, delivery_id=delivery_id)
         return self._json(status, resp)
 
     def _enqueue_run(self, run_id, task_id, job):