dsh-agentone 0.5.0

package/lib/proc.js

@@ -0,0 +1,113 @@
+// dsh plugin CLI 转发器：唯一的外部进程调用点。
+//
+// 官方 `dsh plugin --profile web <args>` 内部就是 pnpm 转发 + profile
+// 初始化 + dsh.profile.bundles reconcile，全部复用。这里只封装进程执行
+// （execFile 参数数组、绝不经过 shell）与错误翻译；包名/版本白名单在
+// index.js 的调用侧执行。
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+
+/** 从 pnpm 冗长输出里提取对用户有意义的错误行。 */
+function firstErrorLines(raw) {
+  const lines = String(raw).split('\n').map((line) => line.trim()).filter(Boolean);
+  const meaningful = lines.filter(
+    (line) => /ERR_|error|ERROR|404|ENOTFOUND|ETIMEDOUT|ECONNREFUSED/.test(line)
+      && !/^✓|^Done|Progress/.test(line),
+  );
+  const picked = (meaningful.length ? meaningful : lines).slice(0, 3).join('；');
+  return picked.slice(0, 300);
+}
+
+/**
+ * 运行一次性命令。webServer 注册的处理器是同步 Node handler 场景下的
+ * async 函数；execFile 不经过 shell，参数数组中的每个元素都是独立参数，
+ * 不存在拼接解释执行。
+ */
+export async function runCliTool(tool, args, { timeoutMs = 300000 } = {}) {
+  try {
+    const { stdout, stderr } = await execFileAsync(tool, args, {
+      timeout: timeoutMs,
+      killSignal: 'SIGKILL',
+      env: process.env,
+    });
+    return { stdout, stderr };
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      throw new Error(`未找到 ${tool} 命令，请确认已安装`);
+    }
+    if (error.killed) {
+      throw new Error('命令执行超时，请稍后重试');
+    }
+    const message = firstErrorLines(`${error.stderr || ''}\n${error.stdout || ''}`);
+    throw new Error(message || `命令执行失败（退出码 ${error.code ?? '未知'}）`);
+  }
+}
+
+/** dsh plugin 子命令：转发给官方 CLI。 */
+export function dshPluginCli(args) {
+  return runCliTool('dsh', ['plugin', '--profile', 'web', ...args]);
+}
+
+/** pnpm 子命令（当前仅 outdated 查询）。 */
+export function pnpmCli(args, timeoutMs) {
+  return runCliTool('pnpm', args, { timeoutMs });
+}
+
+/**
+ * 探测本机 CLI 工具状态。返回 'missing'（未安装）/ 'authorized' /
+ * 'unauthorized'（已装未授权）。与平台 instance_service 的判定口径一致：
+ *   lark-cli   auth status → identities.{user-default,user}.tokenStatus
+ *              ∈ {valid, needs_refresh} 或 status=ready + available=true
+ *   ccpg-cli   CCPG_FULL_CLI=1 auth status → 顶层 tokenStatus
+ *              ∈ {valid, needs_refresh}（access 过期但 refresh 可用仍算已授权）
+ */
+export async function probeCliTool(tool, { timeoutMs = 15000 } = {}) {
+  let stdout;
+  try {
+    ({ stdout } = await execFileAsync(tool, ['auth', 'status'], {
+      timeout: timeoutMs,
+      killSignal: 'SIGKILL',
+      env: tool === 'ccpg-cli' ? { ...process.env, CCPG_FULL_CLI: '1' } : process.env,
+    }));
+  } catch (error) {
+    if (error.code === 'ENOENT') return 'missing';
+    // 探测失败不区分超时/非零退出：统一按已装但状态未知处理
+    stdout = `${error.stdout || ''}`;
+  }
+  return larkStyleAuthorized(stdout) || ccpgStyleAuthorized(stdout) ? 'authorized' : 'unauthorized';
+}
+
+/** lark-cli 形态：identities 下的 tokenStatus 或新版 status/available 组合。 */
+function larkStyleAuthorized(raw) {
+  const data = parseJsonObject(raw);
+  const identities = data?.identities;
+  if (!identities || typeof identities !== 'object') return false;
+  for (const key of ['user-default', 'user']) {
+    const identity = identities[key];
+    if (!identity || typeof identity !== 'object') continue;
+    if (['valid', 'needs_refresh'].includes(identity.tokenStatus)) return true;
+    if (identity.status === 'ready' && identity.available === true) return true;
+  }
+  return false;
+}
+
+/** ccpg-cli 形态：顶层 tokenStatus；lark-cli 的 _authList 兜底同判。 */
+function ccpgStyleAuthorized(raw) {
+  const data = parseJsonObject(raw);
+  if (!data) return false;
+  if (['valid', 'needs_refresh'].includes(data.tokenStatus)) return true;
+  return Array.isArray(data._authList) && data._authList.some(
+    (item) => item && ['valid', 'needs_refresh'].includes(item.tokenStatus),
+  );
+}
+
+function parseJsonObject(raw) {
+  try {
+    const data = JSON.parse(String(raw).trim());
+    return data && typeof data === 'object' && !Array.isArray(data) ? data : null;
+  } catch {
+    return null;
+  }
+}

package/lib/skill.js

@@ -0,0 +1,132 @@
+// dsh-agentone 技能同步（M3）：平台 /api/plugin/v1/skills 用户级通道。
+//
+// 平台代理下载（SkillHub token 不出平台），本插件负责：
+//   1. listPlatformSkills   拉套餐技能 + 台账安装状态；
+//   2. installPlatformSkill 下载 zip → 解包到 $DSH_HOME/skills/<ns--slug>/
+//      （目录名保留 ns--slug 原样，见平台侧 namespaced-dir 约定）→ 回报
+//      版本指纹（X-Skill-* 响应头）；
+//   3. removePlatformSkill  卸载（平台删台账 + 本机删目录）。
+// 解包用 fflate（纯 JS 无原生依赖）；zip 条目名做穿越清洗，落盘先写临时
+// 目录再原子改名，失败不留半成品。
+import { mkdir, rm, writeFile, rename } from 'node:fs/promises';
+import { join } from 'node:path';
+import { unzipSync } from 'fflate';
+
+import { platformError, platformFetch } from './http.js';
+import { resolveDshHome } from './store.js';
+
+/** 技能包下载超时：zip 体积可达数十 MB，比普通 JSON 调用放宽。 */
+const DOWNLOAD_TIMEOUT_MS = 60_000;
+
+function skillsRoot(config) {
+  return join(resolveDshHome(config), 'skills');
+}
+
+export function skillDir(config, canonicalSlug) {
+  return join(skillsRoot(config), canonicalSlug);
+}
+
+export async function listPlatformSkills(platformUrl, accessToken) {
+  const response = await platformFetch(`${platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills`, {
+    headers: { Authorization: `Bearer ${accessToken}` },
+  });
+  if (!response.ok) throw await platformError(response, '获取平台技能列表失败');
+  return response.json();
+}
+
+/** zip 条目名清洗：拒绝绝对路径/上跳/空名，返回安全相对路径。 */
+function safeEntryName(name) {
+  const normalized = String(name || '').replace(/\\/g, '/').replace(/^\/+/, '');
+  if (!normalized || normalized.includes('../') || normalized === '..') return null;
+  return normalized;
+}
+
+/** 拆技能标识：含 `--` 拆 ns/slug，否则按平台兼容规则归 global 命名空间。 */
+export function splitSkillSlug(canonicalSlug) {
+  const separator = canonicalSlug.indexOf('--');
+  if (separator > 0) {
+    return {
+      namespace: canonicalSlug.slice(0, separator),
+      slug: canonicalSlug.slice(separator + 2),
+    };
+  }
+  return { namespace: 'global', slug: canonicalSlug };
+}
+
+export async function installPlatformSkill(platformUrl, accessToken, canonicalSlug, options = {}) {
+  const base = platformUrl.replace(/\/+$/, '');
+  const { namespace, slug } = splitSkillSlug(canonicalSlug);
+  if (!slug) throw new Error(`技能标识格式不正确：${canonicalSlug}`);
+
+  const downloadResponse = await platformFetch(
+    `${base}/api/plugin/v1/skills/${namespace}/${slug}/download`,
+    { headers: { Authorization: `Bearer ${accessToken}` } },
+    DOWNLOAD_TIMEOUT_MS,
+  );
+  if (!downloadResponse.ok) {
+    throw await platformError(downloadResponse, `技能包下载失败（HTTP ${downloadResponse.status}）`);
+  }
+  const version = downloadResponse.headers.get('x-skill-version') || '';
+  const fingerprint = downloadResponse.headers.get('x-skill-fingerprint') || '';
+  if (!version || !fingerprint) throw new Error('技能包响应缺少版本信息');
+
+  const archive = new Uint8Array(await downloadResponse.arrayBuffer());
+  let entries;
+  try {
+    entries = unzipSync(archive);
+  } catch {
+    throw new Error('技能包不是有效的 zip 文件');
+  }
+
+  const root = skillsRoot(options.config || {});
+  const finalDir = join(root, canonicalSlug);
+  const stagingDir = `${finalDir}.__staging`;
+  await rm(stagingDir, { recursive: true, force: true }).catch(() => {});
+  await mkdir(stagingDir, { recursive: true });
+  try {
+    let fileCount = 0;
+    for (const [name, bytes] of Object.entries(entries)) {
+      if (name.endsWith('/')) continue;
+      const safeName = safeEntryName(name);
+      if (!safeName) throw new Error(`技能包含不安全路径：${name}`);
+      const target = join(stagingDir, safeName);
+      await mkdir(join(target, '..'), { recursive: true });
+      await writeFile(target, bytes);
+      fileCount += 1;
+    }
+    if (fileCount === 0) throw new Error('技能包为空');
+    await rm(finalDir, { recursive: true, force: true }).catch(() => {});
+    await rename(stagingDir, finalDir);
+  } catch (error) {
+    await rm(stagingDir, { recursive: true, force: true }).catch(() => {});
+    throw error;
+  }
+
+  const confirmParams = options.source === 'plan' ? '?source=plan' : '';
+  const confirmResponse = await platformFetch(
+    `${base}/api/plugin/v1/skills/${namespace}/${slug}/installed${confirmParams}`,
+    {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ version, fingerprint }),
+    },
+  );
+  if (!confirmResponse.ok) {
+    throw await platformError(confirmResponse, '技能安装回报失败');
+  }
+  return { canonical_slug: canonicalSlug, version, files: Object.keys(entries).length };
+}
+
+export async function removePlatformSkill(platformUrl, accessToken, canonicalSlug, options = {}) {
+  const base = platformUrl.replace(/\/+$/, '');
+  const { namespace, slug } = splitSkillSlug(canonicalSlug);
+  if (!slug) throw new Error(`技能标识格式不正确：${canonicalSlug}`);
+  await platformFetch(`${base}/api/plugin/v1/skills/${namespace}/${slug}`, {
+    method: 'DELETE',
+    headers: { Authorization: `Bearer ${accessToken}` },
+  }).catch(() => {});
+  await rm(skillDir(options.config || {}, canonicalSlug), { recursive: true, force: true }).catch(
+    () => {},
+  );
+  return { canonical_slug: canonicalSlug };
+}

package/lib/store.js

@@ -0,0 +1,60 @@
+// 平台凭据持久化：$DSH_HOME/agentone/credentials.json（0600，仅本机插件可读）。
+import { copyFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+
+export function resolveDshHome() {
+  return process.env.DSH_HOME || join(homedir(), '.dsh');
+}
+
+function storeDir(config) {
+  return config.storeDir || join(resolveDshHome(), 'agentone');
+}
+
+function credentialsPath(config) {
+  return join(storeDir(config), 'credentials.json');
+}
+
+/**
+ * 读取凭据。文件损坏（截断/手改坏）不抛出：把坏文件移开为
+ * credentials.json.corrupt，返回 null 回到未登录态——否则 logout 也依赖
+ * 读取成功，用户会被永久卡在「已登录但一切接口报错」的状态。
+ */
+export async function loadCredentials(config) {
+  const path = credentialsPath(config);
+  let raw;
+  try {
+    raw = await readFile(path, 'utf8');
+  } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    throw error;
+  }
+  try {
+    const data = JSON.parse(raw);
+    if (!data || typeof data.access_token !== 'string') throw new Error('not a credentials object');
+    return data;
+  } catch {
+    await copyFile(path, `${path}.corrupt`).catch(() => {});
+    await rm(path, { force: true }).catch(() => {});
+    return null;
+  }
+}
+
+export async function saveCredentials(config, credentials) {
+  const dir = storeDir(config);
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await writeFile(credentialsPath(config), JSON.stringify(credentials, null, 2) + '\n', {
+    mode: 0o600,
+    flag: 'w',
+  });
+}
+
+/** 读取-合并-写回：模型同步结果等增量字段落盘。 */
+export async function updateCredentials(config, patch) {
+  const current = (await loadCredentials(config)) || {};
+  await saveCredentials(config, { ...current, ...patch });
+}
+
+export async function clearCredentials(config) {
+  await rm(credentialsPath(config), { force: true });
+}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "dsh-agentone",
+  "version": "0.5.0",
+  "description": "AgentOne 平台集成插件：飞书登录、平台模型、SkillHub 技能、套餐申请、插件管理、lark-cli / ccpg-cli 探测（请求超时与错误码透传、令牌轮换 single-flight、凭据损坏容错、状态页 UX 增强）",
+  "type": "module",
+  "main": "lib/index.js",
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./lib/client.js"
+  },
+  "license": "MIT",
+  "files": [
+    "lib/",
+    "cordis.patch.yml",
+    "README.md"
+  ],
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "agentone"
+  ],
+  "dependencies": {
+    "fflate": "^0.8.3",
+    "yaml": "^2.5.0"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "*",
+    "@deepseek-ai/schemastery": "*"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  }
+}