dsh-agentone 0.5.38 → 0.5.40

package/lib/skill.js

@@ -1,132 +1,210 @@
-// dsh-agentone 技能同步（M3）：平台 /api/plugin/v1/skills 用户级通道。
-//
-// 平台代理下载（SkillHub token 不出平台），本插件负责：
-//   1. listPlatformSkills   拉套餐技能 + 台账安装状态；
-//   2. installPlatformSkill 下载 zip → 解包到 $DSH_HOME/skills/<ns--slug>/
-//      （目录名保留 ns--slug 原样，见平台侧 namespaced-dir 约定）→ 回报
-//      版本指纹（X-Skill-* 响应头）；
-//   3. removePlatformSkill  卸载（平台删台账 + 本机删目录）。
-// 解包用 fflate（纯 JS 无原生依赖）；zip 条目名做穿越清洗，落盘先写临时
-// 目录再原子改名，失败不留半成品。
-import { mkdir, rm, writeFile, rename } from 'node:fs/promises';
+// 平台技能本机安装：唯一 staging、旧目录备份、落盘与回报分离。
+import { randomUUID } from 'node:crypto';
+import { lstat, mkdir, rm, writeFile, rename, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { unzipSync } from 'fflate';
-
 import { platformError, platformFetch } from './http.js';
-import { resolveDshHome } from './store.js';
+import { canonicalSkillSlug, localSkillState, readSkillRecord, skillDigest, skillOwner, skillPaths, writeSkillRecord } from './skill-state.js';
 
-/** 技能包下载超时：zip 体积可达数十 MB，比普通 JSON 调用放宽。 */
 const DOWNLOAD_TIMEOUT_MS = 60_000;
-
-function skillsRoot(config) {
-  return join(resolveDshHome(config), 'skills');
+// 多个 profile 共享同一 skills root，锁绑定物理技能目录而非 profile。
+const operations = new Map();
+function locked(paths, operation) {
+  const previous = operations.get(paths.dir) || Promise.resolve();
+  const result = previous.catch(() => {}).then(operation);
+  const tail = result.catch(() => {}).finally(() => { if (operations.get(paths.dir) === tail) operations.delete(paths.dir); });
+  operations.set(paths.dir, tail);
+  return result;
 }
-
-export function skillDir(config, canonicalSlug) {
-  return join(skillsRoot(config), canonicalSlug);
+function checkActive(options) {
+  options.signal?.throwIfAborted();
+  if (options.isCurrent && !options.isCurrent()) throw new Error('登录身份或目标已改变，请重新同步');
 }
+export function skillDir(config, canonicalSlug) { return skillPaths(config, canonicalSlug).dir; }
 
-export async function listPlatformSkills(platformUrl, accessToken) {
+export async function listPlatformSkills(platformUrl, accessToken, options = {}) {
   const response = await platformFetch(`${platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills`, {
-    headers: { Authorization: `Bearer ${accessToken}` },
+    headers: { Authorization: `Bearer ${accessToken}` }, signal: options.signal,
   });
   if (!response.ok) throw await platformError(response, '获取平台技能列表失败');
   return response.json();
 }
-
-/** zip 条目名清洗：拒绝绝对路径/上跳/空名，返回安全相对路径。 */
 function safeEntryName(name) {
-  const normalized = String(name || '').replace(/\\/g, '/').replace(/^\/+/, '');
-  if (!normalized || normalized.includes('../') || normalized === '..') return null;
+  const normalized = String(name || '').replace(/\\/g, '/');
+  if (!normalized || normalized.startsWith('/') || /^[A-Za-z]:/.test(normalized)) return null;
+  const parts = normalized.split('/');
+  if (parts.some((part) => !part || part === '..' || part === '.')) return null;
   return normalized;
 }
-
-/** 拆技能标识：含 `--` 拆 ns/slug，否则按平台兼容规则归 global 命名空间。 */
-export function splitSkillSlug(canonicalSlug) {
+export function splitSkillSlug(value) {
+  const canonicalSlug = canonicalSkillSlug(value);
   const separator = canonicalSlug.indexOf('--');
-  if (separator > 0) {
-    return {
-      namespace: canonicalSlug.slice(0, separator),
-      slug: canonicalSlug.slice(separator + 2),
-    };
-  }
-  return { namespace: 'global', slug: canonicalSlug };
+  return separator > 0
+    ? { namespace: canonicalSlug.slice(0, separator), slug: canonicalSlug.slice(separator + 2) }
+    : { namespace: 'global', slug: canonicalSlug };
 }
-
-export async function installPlatformSkill(platformUrl, accessToken, canonicalSlug, options = {}) {
-  const base = platformUrl.replace(/\/+$/, '');
+async function report(platformUrl, accessToken, canonicalSlug, record, options) {
+  checkActive(options);
   const { namespace, slug } = splitSkillSlug(canonicalSlug);
-  if (!slug) throw new Error(`技能标识格式不正确：${canonicalSlug}`);
-
-  const downloadResponse = await platformFetch(
-    `${base}/api/plugin/v1/skills/${namespace}/${slug}/download`,
-    { headers: { Authorization: `Bearer ${accessToken}` } },
-    DOWNLOAD_TIMEOUT_MS,
+  const source = ['plan', 'builtin'].includes(record.source) ? `?source=${record.source}` : '';
+  const response = await platformFetch(
+    `${platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills/${namespace}/${slug}/installed${source}`,
+    { method: 'POST', signal: options.signal,
+      headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify({ version: record.version, fingerprint: record.fingerprint }), },
   );
-  if (!downloadResponse.ok) {
-    throw await platformError(downloadResponse, `技能包下载失败（HTTP ${downloadResponse.status}）`);
+  if (!response.ok) throw await platformError(response, '技能已安装，平台回报失败，请稍后重试');
+}
+async function exists(path) {
+  try { return await lstat(path); }
+  catch (error) { if (error.code === 'ENOENT') return null; throw error; }
+}
+// 恢复提交前写入的 journal。新目录完整时补齐记录，否则恢复旧目录。
+async function recover(paths) {
+  for (const path of [paths.home, paths.root, paths.dir]) {
+    const stat = await exists(path);
+    if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) throw new Error('技能路径包含符号链接或非目录，请检查本机文件');
   }
-  const version = downloadResponse.headers.get('x-skill-version') || '';
-  const fingerprint = downloadResponse.headers.get('x-skill-fingerprint') || '';
-  if (!version || !fingerprint) throw new Error('技能包响应缺少版本信息');
-
-  const archive = new Uint8Array(await downloadResponse.arrayBuffer());
-  let entries;
-  try {
-    entries = unzipSync(archive);
-  } catch {
-    throw new Error('技能包不是有效的 zip 文件');
+  const journalPath = `${paths.record}.journal`;
+  let journal;
+  try { journal = JSON.parse(await readFile(journalPath, 'utf8')); }
+  catch (error) { if (error.code === 'ENOENT') return; throw new Error('技能安装恢复记录损坏，请检查本机目录'); }
+  if (!/^[0-9a-f-]{36}$/.test(journal.id || '') || !journal.next?.digest) {
+    throw new Error('技能安装恢复记录格式异常，请检查本机目录');
+  }
+  const backup = `${paths.dir}.__backup-${journal.id}`;
+  const staging = `${paths.dir}.__staging-${journal.id}`;
+  for (const path of [backup, staging]) {
+    const stat = await exists(path);
+    if (stat && (!stat.isDirectory() || stat.isSymbolicLink())) throw new Error('技能恢复路径异常，请检查本机文件');
   }
+  if (await exists(paths.dir)) {
+    const digest = await skillDigest(paths.dir);
+    if (digest === journal.next.digest) await writeSkillRecord(paths, journal.next);
+    else if (await exists(backup)) throw new Error('技能恢复遇到目录冲突，请检查本机文件');
+  } else if (await exists(backup)) await rename(backup, paths.dir);
+  await rm(staging, { recursive: true, force: true });
+  await rm(backup, { recursive: true, force: true });
+  await rm(journalPath, { force: true });
+}
 
-  const root = skillsRoot(options.config || {});
-  const finalDir = join(root, canonicalSlug);
-  const stagingDir = `${finalDir}.__staging`;
-  await rm(stagingDir, { recursive: true, force: true }).catch(() => {});
-  await mkdir(stagingDir, { recursive: true });
-  try {
-    let fileCount = 0;
-    for (const [name, bytes] of Object.entries(entries)) {
-      if (name.endsWith('/')) continue;
-      const safeName = safeEntryName(name);
-      if (!safeName) throw new Error(`技能包含不安全路径：${name}`);
-      const target = join(stagingDir, safeName);
-      await mkdir(join(target, '..'), { recursive: true });
-      await writeFile(target, bytes);
-      fileCount += 1;
+export function installPlatformSkill(platformUrl, accessToken, value, options = {}) {
+  const canonicalSlug = canonicalSkillSlug(value);
+  const paths = skillPaths(options.config || {}, canonicalSlug);
+  return locked(paths, async () => {
+    checkActive(options);
+    await recover(paths);
+    const owner = skillOwner(platformUrl, options);
+    const initial = options.missingOnly ? await localSkillState(platformUrl, canonicalSlug, options) : null;
+    if (initial) {
+      if (initial.state === 'conflict') throw new Error('本机技能包含用户文件或来自其他来源，请确认后手动应用');
+      const newer = options.updateLatest && options.latestVersion && options.latestFingerprint && initial.record
+        && (initial.record.version !== options.latestVersion || initial.record.fingerprint !== options.latestFingerprint);
+      if (initial.state === 'current' && !newer) return { canonical_slug: canonicalSlug, version: initial.record.version, state: 'current' };
+      if (initial.state === 'report_pending' && !newer) return retryReport(platformUrl, accessToken, canonicalSlug, paths, options);
     }
-    if (fileCount === 0) throw new Error('技能包为空');
-    await rm(finalDir, { recursive: true, force: true }).catch(() => {});
-    await rename(stagingDir, finalDir);
+    const { namespace, slug } = splitSkillSlug(canonicalSlug);
+    const downloadResponse = await platformFetch(
+      `${platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills/${namespace}/${slug}/download`,
+      { headers: { Authorization: `Bearer ${accessToken}` }, signal: options.signal }, DOWNLOAD_TIMEOUT_MS,
+    );
+    if (!downloadResponse.ok) throw await platformError(downloadResponse, '技能包下载失败，请稍后重试');
+    const version = downloadResponse.headers.get('x-skill-version') || '';
+    const fingerprint = downloadResponse.headers.get('x-skill-fingerprint') || '';
+    if (!version || !fingerprint) throw new Error('技能包响应缺少版本信息');
+    const archive = new Uint8Array(await downloadResponse.arrayBuffer());
+    let entries;
+    try { entries = unzipSync(archive); } catch { throw new Error('技能包不是有效的 zip 文件'); }
+    const id = randomUUID();
+    const staging = `${paths.dir}.__staging-${id}`;
+    const backup = `${paths.dir}.__backup-${id}`;
+    const journal = `${paths.record}.journal`;
+    await mkdir(paths.root, { recursive: true });
+    const rootStat = await lstat(paths.root);
+    if (rootStat.isSymbolicLink()) throw new Error('技能根目录为符号链接，请先检查本机配置');
+    await mkdir(staging);
+    let movedOld = false;
+    let committed = false;
+    try {
+      let fileCount = 0;
+      for (const [name, bytes] of Object.entries(entries)) {
+        if (name.endsWith('/')) continue;
+        const safeName = safeEntryName(name);
+        if (!safeName) throw new Error(`技能包含不安全路径：${name}`);
+        const target = join(staging, safeName);
+        await mkdir(join(target, '..'), { recursive: true });
+        await writeFile(target, bytes); fileCount += 1;
+      }
+      if (!fileCount) throw new Error('技能包为空');
+      let skillEntry = '';
+      try { skillEntry = await readFile(join(staging, 'SKILL.md'), 'utf8'); } catch {}
+      if (!skillEntry.trim()) throw new Error('技能包缺少有效 SKILL.md');
+      const record = { schema_version: 1, ...owner, canonical_slug: canonicalSlug, version, fingerprint,
+        digest: await skillDigest(staging), source: options.source || 'manual', report_pending: true,
+        installed_at: new Date().toISOString() };
+      // 再检查：下载期间可能已注销、更换账号或停用清单。
+      await options.beforeCommit?.();
+      checkActive(options);
+      if (options.missingOnly) {
+        const fresh = await localSkillState(platformUrl, canonicalSlug, options);
+        if (fresh.state === 'conflict' || (initial.state === 'missing' && fresh.state !== 'missing')
+          || (initial.state !== 'missing' && (fresh.state === 'missing' || fresh.record?.digest !== initial.record?.digest
+            || fresh.record?.version !== initial.record?.version || fresh.record?.fingerprint !== initial.record?.fingerprint))) {
+          throw new Error('本机技能在下载期间已改变，请重新核对后同步');
+        }
+      }
+      await mkdir(join(paths.home, 'agentone', 'skill-state'), { recursive: true, mode: 0o700 });
+      await writeFile(journal, JSON.stringify({ id, next: record }) + '\n', { mode: 0o600 });
+      if (await exists(paths.dir)) { await rename(paths.dir, backup); movedOld = true; }
+      try { await rename(staging, paths.dir); }
+      catch (error) { if (movedOld) { await rename(backup, paths.dir); movedOld = false; } throw error; }
+      committed = true;
+      await writeSkillRecord(paths, record);
+      await rm(backup, { recursive: true, force: true });
+      await rm(journal, { force: true });
+      let error = null;
+      try {
+        await report(platformUrl, accessToken, canonicalSlug, record, options);
+        checkActive(options); record.report_pending = false; await writeSkillRecord(paths, record);
+      } catch (failure) { error = failure.message; }
+      return { canonical_slug: canonicalSlug, version, files: fileCount,
+        state: record.report_pending ? 'report_pending' : 'current', error };
+    } catch (error) {
+      if (!committed) {
+        if (movedOld && !(await exists(paths.dir))) await rename(backup, paths.dir);
+        await rm(journal, { force: true });
+      }
+      throw error;
+    } finally { await rm(staging, { recursive: true, force: true }); }
+  });
+}
+async function retryReport(platformUrl, accessToken, canonicalSlug, paths, options) {
+  const record = await readSkillRecord(paths);
+  try {
+    await report(platformUrl, accessToken, canonicalSlug, record, options);
+    checkActive(options); record.report_pending = false; await writeSkillRecord(paths, record);
+    return { canonical_slug: canonicalSlug, version: record.version, state: 'current' };
   } catch (error) {
-    await rm(stagingDir, { recursive: true, force: true }).catch(() => {});
-    throw error;
+    return { canonical_slug: canonicalSlug, version: record.version, state: 'report_pending', error: error.message };
   }
-
-  const confirmParams = options.source === 'plan' ? '?source=plan' : '';
-  const confirmResponse = await platformFetch(
-    `${base}/api/plugin/v1/skills/${namespace}/${slug}/installed${confirmParams}`,
-    {
-      method: 'POST',
-      headers: { Authorization: `Bearer ${accessToken}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify({ version, fingerprint }),
-    },
-  );
-  if (!confirmResponse.ok) {
-    throw await platformError(confirmResponse, '技能安装回报失败');
-  }
-  return { canonical_slug: canonicalSlug, version, files: Object.keys(entries).length };
 }
-
-export async function removePlatformSkill(platformUrl, accessToken, canonicalSlug, options = {}) {
-  const base = platformUrl.replace(/\/+$/, '');
-  const { namespace, slug } = splitSkillSlug(canonicalSlug);
-  if (!slug) throw new Error(`技能标识格式不正确：${canonicalSlug}`);
-  await platformFetch(`${base}/api/plugin/v1/skills/${namespace}/${slug}`, {
-    method: 'DELETE',
-    headers: { Authorization: `Bearer ${accessToken}` },
-  }).catch(() => {});
-  await rm(skillDir(options.config || {}, canonicalSlug), { recursive: true, force: true }).catch(
-    () => {},
-  );
-  return { canonical_slug: canonicalSlug };
+export function removePlatformSkill(platformUrl, accessToken, value, options = {}) {
+  const canonicalSlug = canonicalSkillSlug(value);
+  const paths = skillPaths(options.config || {}, canonicalSlug);
+  return locked(paths, async () => {
+    checkActive(options); await recover(paths);
+    await options.beforeCommit?.();
+    checkActive(options);
+    const local = await localSkillState(platformUrl, canonicalSlug, options);
+    if (local.state === 'conflict') throw new Error('技能包含用户文件或属于其他账号，请先检查本机目录');
+    const { namespace, slug } = splitSkillSlug(canonicalSlug);
+    await platformFetch(`${platformUrl.replace(/\/+$/, '')}/api/plugin/v1/skills/${namespace}/${slug}`, {
+      method: 'DELETE', signal: options.signal, headers: { Authorization: `Bearer ${accessToken}` },
+    }).catch(() => {});
+    await options.beforeCommit?.();
+    checkActive(options);
+    await rm(paths.dir, { recursive: true, force: true });
+    await rm(paths.record, { force: true });
+    return { canonical_slug: canonicalSlug };
+  });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "dsh-agentone",
-  "version": "0.5.38",
-  "description": "AgentOne 平台集成：IDOne 登录（飞书兜底）、平台模型、SkillHub 技能、套餐与 CLI；lark-cli 首装一键初始化飞书应用；平台托管实例免登录自动授权",
+  "version": "0.5.40",
+  "description": "AgentOne 平台集成：平台模型、SkillHub 技能、套餐与 CLI；lark-cli 首装一键初始化飞书应用；修复 DeepSeek HARNESS 桌面壳登录回调地址不合法",
   "type": "module",
   "scripts": {
     "smoke": "node scripts/env-matrix-smoke.mjs"