dsh-bridge-gateway 0.1.0

package/lib/feishu/node.js

@@ -0,0 +1,409 @@
+// dsh-bridge Feishu / Lark conversation node
+// 把飞书 OpenAPI / WebSocket 长连接入站事件解析后交给平台无关的
+// ConversationBridge 处理，出站通过 FeishuGateway 发送文本 / 卡片。
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { ConversationBridge, conversationBridgeHelpers } from '../platform/conversation-bridge.js'
+
+function makePlatform(gateway) {
+  return {
+    id: 'feishu',
+    name: 'Feishu / Lark',
+    capabilities: { supportsGroup: true, group: true, media: true, approvals: true },
+    async sendText(peerId, text, opts = {}) {
+      return gateway?.sendMarkdownCard(peerId, text, opts)
+    },
+    async sendMediaFile(peerId, filePath, opts = {}) {
+      return gateway?.sendMediaFile(peerId, filePath, opts)
+    },
+    async sendTyping() {},
+    dispose() {},
+  }
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+function splitIntoIncremental(content, maxChunk = 150) {
+  const chunks = []
+  let start = 0
+  while (start < content.length) {
+    if (content.length - start <= maxChunk) {
+      chunks.push(content.slice(start))
+      break
+    }
+    const windowStart = start + Math.floor(maxChunk * 0.6)
+    const windowEnd = start + maxChunk
+    let cut = content.lastIndexOf('\n', windowEnd)
+    if (cut <= windowStart || cut === -1) cut = windowEnd
+    chunks.push(content.slice(start, cut))
+    start = cut
+  }
+  if (chunks.length <= 1 && content.length > 30) {
+    const step = Math.max(20, Math.floor(content.length / 4))
+    chunks.length = 0
+    for (let i = 0; i < content.length; i += step) {
+      chunks.push(content.slice(i, Math.min(i + step, content.length)))
+    }
+  }
+  const slices = []
+  let acc = ''
+  for (const s of chunks) {
+    acc += s
+    slices.push(acc)
+  }
+  return slices
+}
+
+export class FeishuConversationNode extends ConversationBridge {
+  constructor(ctx, config, logger, { onFirstSender, onActiveSessionChange } = {}) {
+    super({
+      ctx,
+      logger,
+      config,
+      platform: makePlatform(ctx.feishu),
+      onFirstSender,
+      onActiveSessionChange,
+    })
+    this.gateway = ctx.feishu
+    this._lastPeer = null // { peerId, senderId, isGroup }
+    this._streamCardId = null // 当前轮次的流式卡片 message_id
+    this._streamContent = ''  // 当前轮次流式卡片的内容
+    this._patchTimer = null   // 节流定时器
+    this._inTurn = false
+
+    // 订阅网关入站消息事件
+    this.disposers.push(this.ctx.on('feishu/message', (event) => this._handleInbound(event)))
+
+    // 订阅卡片交互事件（审批按钮点击）
+    this.disposers.push(this.ctx.on('feishu/action', (event) => this._handleAction(event)))
+
+    // 监听轮次事件：turn/start 开启流式会话，turn/end 最终刷新并重置
+    this.disposers.push(this.ctx.on('session/event', (session, event) => {
+      if (session.id !== this.activeSessionId) return
+      if (event.type === 'turn/start') {
+        this._inTurn = true
+        this._streamCardId = null
+        this._streamContent = ''
+        if (this._patchTimer) {
+          clearTimeout(this._patchTimer)
+          this._patchTimer = null
+        }
+      } else if (event.type === 'turn/end') {
+        this._inTurn = false
+        if (this._patchTimer) {
+          clearTimeout(this._patchTimer)
+          this._patchTimer = null
+        }
+        if (this._streamCardId && this._streamContent) {
+          void this.gateway.patchCard(this._streamCardId, this._streamContent).catch(() => {})
+        }
+        this._streamCardId = null
+        this._streamContent = ''
+      }
+    }))
+  }
+
+  async _handleInbound(event) {
+    if (this.gateway?._closing || this.gateway?.status === 'offline') return
+    const { peerId, senderId, isGroup, text, messageId, messageType, contentObj } = event
+    this._lastPeer = { peerId, senderId, isGroup }
+
+    let mediaFiles = []
+    if (messageType && messageType !== 'text') {
+      mediaFiles = await this._processMedia(messageId, messageType, contentObj, this.config.cwd)
+    }
+
+    if (!text && mediaFiles.length === 0) {
+      this.logger.debug?.(`[dsh-bridge feishu] ignore empty message from ${peerId}`)
+      return
+    }
+
+    let fullText = text || ''
+    if (mediaFiles.length > 0) {
+      const mediaDesc = mediaFiles.map((f) => `[文件: ${f.path}]`).join('\n')
+      fullText = fullText ? `${fullText}\n\n${mediaDesc}` : mediaDesc
+    }
+
+    this.logger.debug?.(`[dsh-bridge feishu] handling inbound message from ${peerId} (group=${isGroup}): ${fullText}`)
+
+    // 如果还没有活动会话，且是首条消息，自动尝试选择最新已有会话
+    if (!this.activeSessionId) {
+      await this._pickDefaultSession().catch(() => {})
+    }
+
+    // 转交通用 ConversationBridge 路由
+    return this.handleInbound({
+      senderId: isGroup ? peerId : senderId,
+      peerId,
+      isGroup,
+      text: fullText,
+    })
+  }
+
+  async _processMedia(messageId, messageType, contentObj = {}, sessionCwd) {
+    if (!messageId || !messageType) return []
+    const mediaDir = path.join(sessionCwd || this.config.cwd || process.cwd(), '.feishu-media')
+    try { await fs.promises.mkdir(mediaDir, { recursive: true }) } catch {}
+
+    const downloaded = []
+    const fileKey = contentObj.image_key || contentObj.file_key
+    const fileName = contentObj.file_name
+
+    if (fileKey) {
+      try {
+        const type = messageType === 'image' ? 'image' : 'file'
+        const buf = await this.gateway.downloadMessageResource({ messageId, fileKey, type })
+        if (buf && buf.length > 0) {
+          const ext = fileName ? path.extname(fileName) : (type === 'image' ? '.png' : '.bin')
+          const safeName = fileName ? path.basename(fileName) : `feishu_${Date.now()}_${Math.random().toString(36).slice(2, 8)}${ext}`
+          const filePath = path.join(mediaDir, safeName)
+          await fs.promises.writeFile(filePath, buf)
+          downloaded.push({ filename: safeName, path: filePath, size: buf.length })
+          this.logger.info?.(`[dsh-bridge feishu] downloaded media ${safeName} (${buf.length} bytes)`)
+        }
+      } catch (err) {
+        this.logger.warn?.(`[dsh-bridge feishu] download media failed: ${err.message}`)
+      }
+    }
+    return downloaded
+  }
+
+  async _handleAction(event) {
+    const { operatorId, value } = event
+    const approvalId = Number(value.approvalId)
+    const action = value.action
+
+    if (approvalId && (action === 'approve' || action === 'reject')) {
+      const outcome = action === 'approve' ? 'allowed-once' : 'rejected'
+      const pending = this.pending.get(approvalId)
+      if (pending) {
+        this.clearApproval(approvalId)
+        pending.resolve(outcome)
+      }
+    }
+  }
+
+  async sendText(text) {
+    const peerId = this._lastPeer?.peerId || this.peerId
+    if (!peerId) return
+    const isGroup = this._lastPeer?.isGroup ?? (peerId.startsWith('oc_') || peerId.startsWith('chat_'))
+    const content = String(text || '').trim()
+    if (!content) return
+
+    // 如果处于 Agent 生成轮次中（turn 期间）：流式打字机逐段增量更新
+    if (this._inTurn) {
+      const maxChunk = 150
+      const slices = splitIntoIncremental(content, maxChunk)
+      const delayMs = Math.min(Math.max(this.config.sendChunkDelayMs ?? 200, 100), 1000)
+
+      if (!this._streamCardId) {
+        // 首片：创建卡片并记录 message_id
+        const firstSlice = slices[0] || content
+        try {
+          const res = await this.gateway.sendMarkdownCard(peerId, firstSlice, { isGroup })
+          this._streamCardId = res?.message_id || null
+          this._streamContent = firstSlice
+        } catch (err) {
+          this.logger.warn?.('[dsh-bridge feishu] sendMarkdownCard failed, fallback to sendText:', err?.message ?? err)
+          await this.gateway.sendText(peerId, content, { isGroup })
+          return
+        }
+
+        // 后续片依次 patchCard（间隔 delayMs，呈现真实打字机流式效果）
+        for (let i = 1; i < slices.length; i++) {
+          await sleep(delayMs)
+          this._streamContent = slices[i]
+          if (this._streamCardId) {
+            await this.gateway.patchCard(this._streamCardId, this._streamContent).catch(() => {})
+          }
+        }
+      } else {
+        // 如果卡片已存在（同轮次后续输出）：更新到最终内容
+        this._streamContent = content
+        await this.gateway.patchCard(this._streamCardId, this._streamContent).catch(() => {})
+      }
+      return
+    }
+
+    // 非 turn 期间（指令响应、系统提示、单条通知等）：以完整单张卡片直接发送，杜绝碎片拆分
+    try {
+      if (content.length <= 25000) {
+        await this.gateway.sendMarkdownCard(peerId, content, { isGroup })
+      } else {
+        const chunks = conversationBridgeHelpers.splitForIM(content, 20000)
+        for (const chunk of chunks) {
+          await this.gateway.sendMarkdownCard(peerId, chunk, { isGroup })
+        }
+      }
+    } catch (err) {
+      this.logger.warn?.('[dsh-bridge feishu] sendMarkdownCard failed, fallback to plain text:', err?.message ?? err)
+      await this.gateway.sendText(peerId, content, { isGroup })
+    }
+  }
+
+  // ---- 飞书专属卡片审批桥 ----
+
+  _attachApprovalBridge() {
+    const listener = async (req, next) => {
+      if (!this.ownsAgent(req.agent)) return next?.()
+      const peer = this._lastPeer
+      if (!peer?.peerId) return next?.()
+
+      const number = this.nextApprovalNumber()
+      const timeoutSec = this.config.approvalTimeoutSec || 600
+      const timeoutMin = Math.max(1, Math.round(timeoutSec / 60))
+
+      // 构建飞书原生交互卡片 (JSON 2.0)
+      const card = {
+        schema: '2.0',
+        header: {
+          title: {
+            tag: 'plain_text',
+            content: `⚠️ 操作权限确认 (#${number})`,
+          },
+          template: 'orange',
+        },
+        body: {
+          elements: [
+            {
+              tag: 'markdown',
+              content: [
+                `| 项目 | 详情 |`,
+                `| :--- | :--- |`,
+                `| **调用工具** | \`${req.toolName}\` |`,
+                ...(req.reason ? [`| **申请原因** | ${String(req.reason).replace(/\|/g, '｜')} |`] : []),
+                `| **等待超时** | ${timeoutMin} 分钟 (超时自动拒绝) |`,
+              ].join('\n'),
+            },
+            {
+              tag: 'column_set',
+              flex_mode: 'flow',
+              columns: [
+                {
+                  tag: 'column',
+                  width: 'auto',
+                  elements: [
+                    {
+                      tag: 'button',
+                      text: {
+                        tag: 'plain_text',
+                        content: '✓ 批准执行',
+                      },
+                      type: 'primary',
+                      value: {
+                        action: 'approve',
+                        approvalId: number,
+                      },
+                    },
+                  ],
+                },
+                {
+                  tag: 'column',
+                  width: 'auto',
+                  elements: [
+                    {
+                      tag: 'button',
+                      text: {
+                        tag: 'plain_text',
+                        content: '✕ 拒绝执行',
+                      },
+                      type: 'danger',
+                      value: {
+                        action: 'reject',
+                        approvalId: number,
+                      },
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      }
+
+      // 发送飞书卡片
+      try {
+        await this.gateway.sendCard(peer.peerId, card, { isGroup: peer.isGroup })
+      } catch (err) {
+        // 卡片发送失败降级发送 Markdown
+        const textFallback = [
+          `## ⚠️ 操作权限确认 (#${number})`,
+          '',
+          `| 项目 | 详情 |`,
+          `| :--- | :--- |`,
+          `| **调用工具** | \`${req.toolName}\` |`,
+          ...(req.reason ? [`| **申请原因** | ${String(req.reason).replace(/\|/g, '｜')} |`] : []),
+          `| **等待超时** | ${timeoutMin} 分钟 (超时自动拒绝) |`,
+          '',
+          `> 回复 \`/yes\` (或 \`1\`) 批准执行`,
+          `> 回复 \`/no\` (或 \`2\`) 拒绝执行`,
+        ].join('\n')
+        void this.gateway.sendMarkdownCard(peer.peerId, textFallback, { isGroup: peer.isGroup })
+      }
+
+      // 同时调用 downstream next()，使 Web UI 原生弹窗也能同步显示并支持直接操作
+      let nextPromise = null
+      if (typeof next === 'function') {
+        try {
+          const res = next()
+          if (res && typeof res.then === 'function') {
+            nextPromise = res
+          }
+        } catch {}
+      }
+
+      let timeoutFired = false
+      let winner = 'feishu'
+      const feishuPromise = new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          timeoutFired = true
+          this.clearApproval(number)
+          resolve('rejected')
+        }, timeoutSec * 1000)
+        if (typeof timer.unref === 'function') timer.unref()
+        this.registerApproval(number, { number, request: req, resolve, timer })
+      })
+
+      const outcome = await (nextPromise
+        ? Promise.race([
+            feishuPromise.then(res => { winner = 'feishu'; return res }),
+            nextPromise.then(res => { winner = 'web'; return res }),
+          ])
+        : feishuPromise)
+
+      // 如果 Web 端先决议，清除飞书端 pending 记录
+      if (winner === 'web') {
+        this.clearApproval(number)
+      }
+
+      if (!timeoutFired) {
+        const sourceHint = winner === 'web' ? '（Web 端操作）' : ''
+        const label = outcome === 'allowed-once' ? `✓ **已批准执行**${sourceHint}` : outcome === 'rejected' ? `❌ **已拒绝执行**${sourceHint}` : `**[${outcome}]**`
+        void this.gateway.sendMarkdownCard(peer.peerId, `${label}（#${number}）`, { isGroup: peer.isGroup })
+      }
+      return outcome
+    }
+
+    const disposer = this.ctx.on('approval/request', listener)
+    this.disposers.push(disposer)
+  }
+
+  dispose() {
+    if (this._patchTimer) {
+      clearTimeout(this._patchTimer)
+      this._patchTimer = null
+    }
+    this._inTurn = false
+    this._streamCardId = null
+    this._streamContent = ''
+    this._lastPeer = null
+    super.dispose()
+  }
+}
+
+export const feishuNodeHelpers = {
+  makePlatform,
+}

package/lib/gateway/cert.js

@@ -0,0 +1,214 @@
+// 零依赖自签证书生成器（IP 直连场景适用）
+// 仅用 Node 内置 crypto：RSA 密钥对 + DER 编码一张最基本的自签 X.509 v3 证书。
+// 无需 openssl 命令行、无需额外 npm 依赖，可在 macOS / Linux / Windows 开箱生成 TLS 证书。
+//
+// 注意：个人远程访问（IP 直连）使用本证书时，浏览器首次会提示"证书无效/不安全"，
+// 用户需选择"继续前往"。若要彻底消除告警，请在网关配置区上传域名/权威证书。
+
+import { dirname } from 'node:path';
+import {
+  generateKeyPairSync,
+  sign,
+  randomBytes,
+} from 'node:crypto';
+
+// --- 最小 ASN.1 DER 编码助手 ---
+
+function len(n) {
+  if (n < 0x80) return [n];
+  const bytes = [];
+  while (n > 0) {
+    bytes.unshift(n & 0xff);
+    n >>>= 8;
+  }
+  return [0x80 | bytes.length, ...bytes];
+}
+
+function tlv(tag, content) {
+  return [tag, ...len(content.length), ...content];
+}
+
+function integerBytes(bytes) {
+  if (bytes.length && (bytes[0] & 0x80)) bytes = [0, ...bytes];
+  return tlv(0x02, bytes);
+}
+
+function oid(oidArr) {
+  let body = [40 * oidArr[0] + oidArr[1]];
+  for (let i = 2; i < oidArr.length; i++) {
+    let v = oidArr[i];
+    let sub = [];
+    if (v === 0) {
+      sub = [0];
+    } else {
+      while (v > 0) {
+        sub.unshift(v & 0x7f);
+        v >>>= 7;
+      }
+      for (let j = 0; j < sub.length - 1; j++) sub[j] |= 0x80;
+    }
+    body.push(...sub);
+  }
+  return tlv(0x06, body);
+}
+
+function nullValue() {
+  return tlv(0x05, []);
+}
+
+function printableString(str) {
+  return tlv(0x13, [...Buffer.from(str, 'utf8')]);
+}
+
+function bitString(bytes) {
+  return tlv(0x03, [0, ...bytes]);
+}
+
+function octetString(...bytes) {
+  return tlv(0x04, bytes.flat());
+}
+
+function sequence(...inner) {
+  return tlv(0x30, inner.flat());
+}
+
+function setOf(...inner) {
+  return tlv(0x31, inner.flat());
+}
+
+function utcTimeStr(d) {
+  const p = (n) => String(n).padStart(2, '0');
+  return (d.getUTCFullYear() % 100).toString().padStart(2, '0') +
+    p(d.getUTCMonth() + 1) + p(d.getUTCDate()) +
+    p(d.getUTCHours()) + p(d.getUTCMinutes()) + p(d.getUTCSeconds()) + 'Z';
+}
+
+function toPem(der, type) {
+  const b64 = Buffer.from(der).toString('base64').match(/.{1,64}/g).join('\n');
+  return `-----BEGIN ${type}-----\n${b64}\n-----END ${type}-----\n`;
+}
+
+/**
+ * 生成单张可被浏览器接受的 IP / 域名自签证书。
+ * 关键点：subjectAltName 必须包含浏览器访问所用的宿主（IP 或域名）。
+ */
+export function generateSelfSignedCert({
+  commonName = 'dsh-bridge-gateway',
+  subjectAltNames = ['localhost', '127.0.0.1', '::1'],
+  days = 825,
+} = {}) {
+  const { publicKey, privateKey } = generateKeyPairSync('rsa', { modulusLength: 2048 });
+  const keyObj = privateKey; // generateKeyPairSync 返回的已是 PrivateKeyObject，可直接用于签名
+  const pubObject = publicKey; // 同理：已是公钥 KeyObject
+  const derSpki = pubObject.export({ type: 'spki', format: 'der' });
+
+  // 从 SPKI DER 提取公钥 BIT STRING 内容
+  const spki = parseTlvs(derSpki);
+  // spki: [0]=SEQUENCE(AlgorithmIdentifier, BIT STRING)
+  const spkiSeq = parseTlvs(spki[0].content);
+  const pubBitString = spkiSeq[1].content.subarray(1); // 跳过第一个 0x00
+
+  const now = Date.now();
+  const notBefore = new Date(now - 60 * 60 * 1000);
+  const notAfter = new Date(now + days * 24 * 3600 * 1000);
+
+  // subjectAltName (GeneralNames)：dNSName [2] IMPLICIT IA5String / iPAddress [7] IMPLICIT OCTET STRING
+  // 每个 GeneralName 都是 context-specific 标签，必须带长度前缀（首次手写漏了长度导致 X509 "wrong tag"）。
+  const sanValues = [];
+  for (const name of subjectAltNames) {
+    if (isIpv4(name)) {
+      sanValues.push(tlv(0x87, name.split('.').map((n) => parseInt(n, 10))));
+    } else if (name === '::1') {
+      const raw = Buffer.alloc(16);
+      raw[15] = 1;
+      sanValues.push(tlv(0x87, [...raw]));
+    } else {
+      sanValues.push(tlv(0x82, [...Buffer.from(name, 'utf8')]));
+    }
+  }
+
+  const extensions = sequence(
+    // basicConstraints: critical CA:FALSE —— 值为空 SEQUENCE `30 00`
+    sequence(oid([2, 5, 29, 19]), octetString(...sequence(...[]))),
+    // subjectAltName
+    sequence(oid([2, 5, 29, 17]), octetString(...sequence(...sanValues))),
+  );
+
+  const tbs = sequence(
+    tlv(0xa0, integerTlv(2)), // version [0] EXPLICIT Version = v3
+    integerBytes([...randomBytes(16)]), // serial
+    sequence(oid([1, 2, 840, 113549, 1, 1, 11]), nullValue()), // sha256WithRSA 算法
+    sequence(setOf(sequence(oid([2, 5, 4, 3]), printableString(commonName)))), // issuer
+    sequence(
+      tlv(0x17, [...Buffer.from(utcTimeStr(notBefore), 'ascii')]),
+      tlv(0x17, [...Buffer.from(utcTimeStr(notAfter), 'ascii')]),
+    ),
+    sequence(setOf(sequence(oid([2, 5, 4, 3]), printableString(commonName)))), // subject
+    sequence(
+      // SubjectPublicKeyInfo
+      sequence(oid([1, 2, 840, 113549, 1, 1, 1]), nullValue()),
+      bitString([...pubBitString]),
+    ),
+    tlv(0xa3, extensions), // [3] extensions
+  );
+
+  const algorithm = sequence(oid([1, 2, 840, 113549, 1, 1, 11]), nullValue());
+  const sig = sign('sha256', Buffer.from(tbs), keyObj);
+  const certDer = sequence(tbs, algorithm, bitString([...sig]));
+
+  return {
+    key: privateKey.export({ type: 'pkcs8', format: 'pem' }),
+    cert: toPem(certDer, 'CERTIFICATE'),
+  };
+}
+
+// --- DER 解析（用于从 SPKI 提取公钥；返回元素数组，元素 {content: Buffer}，忽略不用的 tag） ---
+function parseTlvs(buf) {
+  const out = [];
+  let i = 0;
+  while (i < buf.length) {
+    const tag = buf[i++];
+    let n = buf[i++];
+    if (n & 0x80) {
+      const c = n & 0x7f;
+      n = 0;
+      for (let k = 0; k < c; k++) n = (n << 8) | buf[i++];
+    }
+    out.push({ tag, content: buf.subarray(i, i + n) });
+    i += n;
+  }
+  return out;
+}
+
+function integerTlv(n) {
+  return tlv(0x02, [n]);
+}
+
+function isIpv4(str) {
+  return /^\d{1,3}(\.\d{1,3}){3}$/.test(str);
+}
+
+/**
+ * 读取已缓存自签证书，否则生成并持久化到 DSH_HOME/dsh-bridge/certs/。
+ */
+export async function getOrCreateSelfSignedCert({ certFile, keyFile, logger }) {
+  const { readFile, writeFile, mkdir } = await import('node:fs/promises');
+  try {
+    const [cert, key] = await Promise.all([
+      readFile(certFile, 'utf8'),
+      readFile(keyFile, 'utf8'),
+    ]);
+    if (cert && key) return { cert, key };
+  } catch {}
+  const { cert, key } = generateSelfSignedCert();
+  try {
+    await mkdir(dirname(certFile), { recursive: true });
+    await Promise.all([
+      writeFile(certFile, cert, 'utf8'),
+      writeFile(keyFile, key, 'utf8'),
+    ]);
+  } catch (err) {
+    logger?.warn?.('dsh-bridge: 无法持久化自签证书: %s', err?.message ?? err);
+  }
+  return { cert, key };
+}