dsh-cloudq 0.2.1 → 0.3.0

package/lib/client.js

@@ -3385,7 +3385,7 @@ display: none;
 					});
 				} catch (error) {
 					setValidated(false);
-					const invalid = error instanceof CloudQApiError && error.code !== "network-error" && error.code !== "invalid-response" && error.code !== "script-launch-failed";
+					const invalid = error instanceof CloudQApiError && error.code !== "network-error" && error.code !== "invalid-response";
 					setFeedback({
 						kind: "error",
 						text: invalid ? "AKSK 无效，请检查后重新配置。" : error.message

package/lib/index.js

@@ -1,12 +1,14 @@
 import { createRequire } from "node:module";
-import { spawn, spawnSync } from "node:child_process";
-import { existsSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
-import { get } from "node:https";
+import { spawn } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { get, request } from "node:https";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import Schema from "@deepseek-ai/schemastery";
-import { Buffer as Buffer$1 } from "node:buffer";
+import { Buffer } from "node:buffer";
 import yaml from "js-yaml";
+import { createHash, createHmac } from "node:crypto";
+import { homedir } from "node:os";
 //#region src/http.js
 /** Maximum accepted JSON request body size. */
 const MAX_JSON_BODY_BYTES = 65536;
@@ -115,7 +117,7 @@ function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
 		};
 		request.on("data", (chunk) => {
 			if (settled) return;
-			const buffer = Buffer$1.isBuffer(chunk) ? chunk : Buffer$1.from(chunk);
+			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
 			bytes += buffer.byteLength;
 			if (bytes > maxBytes) {
 				rejectOnce(new HttpError(413, "payload-too-large", "The JSON request body is too large."));
@@ -131,7 +133,7 @@ function readJsonBody(request, { maxBytes = MAX_JSON_BODY_BYTES } = {}) {
 				return;
 			}
 			try {
-				resolveBody(JSON.parse(Buffer$1.concat(chunks).toString("utf8")));
+				resolveBody(JSON.parse(Buffer.concat(chunks).toString("utf8")));
 			} catch {
 				rejectBody(new HttpError(400, "invalid-json", "The request body is not valid JSON."));
 			}
@@ -288,118 +290,157 @@ function setPluginDisabled(baseUrl, id, disabled) {
 	};
 }
 //#endregion
-//#region src/script-runner.js
-const MAX_SCRIPT_OUTPUT_BYTES = 1048576;
-let resolvedPythonCommand = null;
-function pythonCommand() {
-	if (resolvedPythonCommand) return resolvedPythonCommand;
-	for (const candidate of [
-		"python3",
-		"python",
-		"py"
-	]) try {
-		if (spawnSync(candidate, ["--version"], {
-			stdio: "ignore",
-			timeout: 5e3
-		}).status === 0) {
-			resolvedPythonCommand = candidate;
-			return candidate;
-		}
-	} catch {}
-	return "python3";
+//#region src/tcloud.js
+/**
+* Node-native Tencent Cloud API client (TC3-HMAC-SHA256) and credential
+* store for the dsh-cloudq host.
+*
+* The DSH host itself runs on Node, so — same as dsh-cos — every panel API
+* call happens in-process with zero external runtime dependency. Python only
+* remains for the agent-driven skill conversation flow.
+*
+* @module dsh-cloudq/tcloud
+*/
+const CREDENTIAL_FILE = join(homedir(), ".tencent-cloudq", "credential.json");
+const sha256 = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+const hmacSha256 = (key, value) => createHmac("sha256", key).update(value, "utf8").digest();
+const hmacSha256Hex = (key, value) => createHmac("sha256", key).update(value, "utf8").digest("hex");
+/** Mask a SecretId exactly like the Python helpers: keep only the last 4. */
+function maskSecretId(value) {
+	const text = String(value ?? "");
+	return text.length <= 4 ? "*".repeat(text.length) : "*".repeat(text.length - 4) + text.slice(-4);
+}
+/**
+* Read the stored credential shared with the CloudQ skill.
+* Only the AK/SK entries (`type: "ak"`, optional STS token) can TC3-sign;
+* OAuth/Connector entries carry no SecretKey and surface as NeedAuth.
+*/
+function readCredential() {
+	let data;
+	try {
+		data = JSON.parse(readFileSync(CREDENTIAL_FILE, "utf8"));
+	} catch {
+		return null;
+	}
+	const secretId = typeof data?.secretId === "string" ? data.secretId : "";
+	const secretKey = typeof data?.secretKey === "string" ? data.secretKey : "";
+	if (!secretId || !secretKey) return null;
+	return {
+		secretId,
+		secretKey,
+		token: typeof data?.token === "string" ? data.token : "",
+		authType: typeof data?.type === "string" ? data.type : "ak"
+	};
 }
-function safeCode(value) {
-	return typeof value === "string" && /^[a-zA-Z0-9._-]{1,80}$/.test(value) ? value : "script-failed";
+/** Credential state for the settings UI (never exposes the SecretKey). */
+function credentialStatus$1() {
+	const credential = readCredential();
+	if (!credential) return { logged_in: false };
+	return {
+		logged_in: true,
+		secret_id_masked: maskSecretId(credential.secretId),
+		auth_type: credential.authType
+	};
+}
+/** Persist an AK/SK pair atomically, mirroring credential_manager (dir 700, file 600). */
+function saveCredential(secretId, secretKey) {
+	const data = {
+		type: "ak",
+		secretId,
+		secretKey,
+		token: "",
+		expiresAt: 0,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const directory = dirname(CREDENTIAL_FILE);
+	mkdirSync(directory, { recursive: true });
+	const temporary = `${CREDENTIAL_FILE}.tmp-${process.pid}`;
+	writeFileSync(temporary, JSON.stringify(data, null, 2), {
+		encoding: "utf8",
+		mode: 384
+	});
+	renameSync(temporary, CREDENTIAL_FILE);
+	if (process.platform !== "win32") try {
+		chmodSync(directory, 448);
+		chmodSync(CREDENTIAL_FILE, 384);
+	} catch {}
 }
-function redact(value, sensitiveValues) {
-	let text = String(value ?? "");
-	for (const sensitive of sensitiveValues) if (sensitive) text = text.replaceAll(sensitive, "[redacted]");
-	return text.replace(/[\r\n\t]+/g, " ").slice(0, 300);
+/** Remove the stored credential (退出登录). */
+function deleteCredential() {
+	try {
+		unlinkSync(CREDENTIAL_FILE);
+	} catch {}
 }
 /**
-* Run one bundled Python helper with bounded output and optional stdin.
-* @param {string} scriptsDirectory Absolute scripts directory.
-* @param {string} scriptName Bundled script filename.
-* @param {string[]} args Non-sensitive command-line arguments.
-* @param {object} options Execution options.
-* @returns {Promise<Record<string, unknown>>} Parsed helper response.
+* Call a Tencent Cloud API with TC3-HMAC-SHA256 signing.
+* Returns the unwrapped `Response` payload; API errors become HttpError with
+* the upstream code (AuthFailure.* etc.) so callers can map them like the
+* Python helpers did.
 */
-function runScript$1(scriptsDirectory, scriptName, args, { timeoutMs = 3e4, jsonOnly = true, stdin, sensitiveValues = [], spawnProcess = spawn } = {}) {
-	return new Promise((resolveRun, rejectRun) => {
-		const script = resolve(scriptsDirectory, scriptName);
-		const child = spawnProcess(pythonCommand(), [script, ...args], {
-			stdio: [
-				stdin === void 0 ? "ignore" : "pipe",
-				"pipe",
-				"pipe"
-			],
-			timeout: timeoutMs
-		});
-		let stdout = "";
-		let stderr = "";
-		let outputBytes = 0;
-		let settled = false;
-		const rejectOnce = (error) => {
-			if (settled) return;
-			settled = true;
-			rejectRun(error);
-		};
-		const resolveOnce = (value) => {
-			if (settled) return;
-			settled = true;
-			resolveRun(value);
-		};
-		const collect = (current, chunk) => {
-			const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-			outputBytes += buffer.byteLength;
-			if (outputBytes > MAX_SCRIPT_OUTPUT_BYTES) {
-				child.kill();
-				rejectOnce(new HttpError(502, "script-output-too-large", "The CloudQ helper returned too much data."));
-				return current;
-			}
-			return current + buffer.toString("utf8");
-		};
-		child.stdout.on("data", (chunk) => {
-			stdout = collect(stdout, chunk);
-		});
-		child.stderr.on("data", (chunk) => {
-			stderr = collect(stderr, chunk);
-		});
-		child.on("error", () => {
-			rejectOnce(new HttpError(502, "script-launch-failed", "无法启动 Python 运行环境，请先安装 Python 3 后重试。"));
+async function callTcloudApi({ service, host, action, version, payload = {} }, credential = readCredential()) {
+	if (!credential) throw new HttpError(401, "NeedAuth", "尚未配置 AK/SK，请前往「设置 → 插件 → CloudQ」完成配置。");
+	const body = JSON.stringify(payload);
+	const timestamp = Math.floor(Date.now() / 1e3);
+	const date = (/* @__PURE__ */ new Date(timestamp * 1e3)).toISOString().slice(0, 10);
+	const canonicalRequest = [
+		"POST",
+		"/",
+		"",
+		`content-type:application/json\nhost:${host}\nx-tc-action:${action.toLowerCase()}`,
+		"",
+		"content-type;host;x-tc-action",
+		sha256(body)
+	].join("\n");
+	const stringToSign = [
+		"TC3-HMAC-SHA256",
+		String(timestamp),
+		`${date}/${service}/tc3_request`,
+		sha256(canonicalRequest)
+	].join("\n");
+	const keyDate = hmacSha256(`TC3${credential.secretKey}`, date);
+	const keyService = hmacSha256(keyDate, service);
+	const keySigning = hmacSha256(keyService, "tc3_request");
+	const signature = hmacSha256Hex(keySigning, stringToSign);
+	const authorization = `TC3-HMAC-SHA256 Credential=${credential.secretId}/${date}/${service}/tc3_request, SignedHeaders=content-type;host;x-tc-action, Signature=${signature}`;
+	const headers = {
+		"Content-Type": "application/json",
+		"X-TC-Action": action,
+		"X-TC-Version": version,
+		"X-TC-Timestamp": String(timestamp),
+		Authorization: authorization
+	};
+	if (credential.token) headers["X-TC-Token"] = credential.token;
+	const text = await new Promise((resolveRequest, rejectRequest) => {
+		const request$1 = request({
+			host,
+			path: "/",
+			method: "POST",
+			headers,
+			timeout: 3e4
+		}, (response) => {
+			let bodyText = "";
+			response.on("data", (chunk) => {
+				bodyText += chunk;
+				if (bodyText.length > 1048576) request$1.destroy();
+			});
+			response.on("end", () => resolveRequest(bodyText));
 		});
-		child.on("close", (code) => {
-			if (settled) return;
-			const trimmed = stdout.trim();
-			if (!jsonOnly) {
-				if (code !== 0) rejectOnce(new HttpError(502, "script-failed", "The CloudQ helper failed."));
-				else resolveOnce({
-					success: true,
-					message: redact(trimmed, sensitiveValues)
-				});
-				return;
-			}
-			let parsed;
-			try {
-				parsed = trimmed ? JSON.parse(trimmed) : {};
-			} catch {
-				rejectOnce(new HttpError(502, "script-invalid-output", "The CloudQ helper returned an invalid response."));
-				return;
-			}
-			if (code !== 0 || parsed?.ok === false || parsed?.success === false) {
-				const codeValue = safeCode(parsed?.error?.code ?? parsed?.code);
-				rejectOnce(new HttpError(502, codeValue, "The CloudQ helper failed."));
-				return;
-			}
-			resolveOnce(parsed);
+		request$1.on("error", () => rejectRequest(new HttpError(502, "network-error", "无法连接腾讯云服务，请检查网络后重试。")));
+		request$1.on("timeout", () => {
+			request$1.destroy();
+			rejectRequest(new HttpError(504, "network-timeout", "腾讯云服务响应超时，请稍后重试。"));
 		});
-		if (stdin !== void 0) {
-			child.stdin.on("error", () => {
-				rejectOnce(new HttpError(502, "script-input-failed", "The CloudQ helper could not receive its input."));
-			});
-			child.stdin.end(stdin);
-		}
+		request$1.end(body);
 	});
+	let parsed;
+	try {
+		parsed = JSON.parse(text);
+	} catch {
+		throw new HttpError(502, "invalid-response", "腾讯云服务返回了无法识别的响应。");
+	}
+	const envelope = parsed?.Response ?? {};
+	if (envelope.Error) throw new HttpError(502, String(envelope.Error.Code ?? "api-error"), String(envelope.Error.Message ?? "腾讯云接口调用失败。"));
+	return envelope;
 }
 //#endregion
 //#region src/index.js
@@ -554,119 +595,124 @@ function renderedSkillContent() {
 	const baseDir = skillDirectory();
 	return rawSkillContent().replace(/\{baseDir\}/g, baseDir);
 }
-/** Run one helper from the bundled CloudQ skill. */
-async function runScript(scriptName, args, options) {
+/** Map upstream TC error codes to stable, actionable client-facing errors. */
+function normalizeApiError(error) {
+	if (error instanceof HttpError) {
+		if (error.code === "NeedAuth") throw error;
+		if (typeof error.code === "string" && error.code.startsWith("AuthFailure")) throw new HttpError(401, "AuthFailure", "AK/SK 无效或权限不足，请前往「设置 → 插件 → CloudQ」检查配置。");
+	}
+	throw error;
+}
+/** Wrap one API call with the credential-error mapping. */
+async function callCloudq(spec) {
 	try {
-		return await runScript$1(resolve(skillDirectory(), "scripts"), scriptName, args, options);
+		return { data: await callTcloudApi(spec) };
 	} catch (error) {
-		if (error instanceof HttpError) {
-			if (error.code === "NeedAuth") throw new HttpError(401, "NeedAuth", "尚未配置 AK/SK，请前往「设置 → 插件 → CloudQ」完成配置。");
-			if (error.code === "CredentialExpired") throw new HttpError(401, "CredentialExpired", "凭证已过期，请前往「设置 → 插件 → CloudQ」重新配置。");
-			if (typeof error.code === "string" && error.code.startsWith("AuthFailure")) throw new HttpError(401, "AuthFailure", "AK/SK 无效或权限不足，请前往「设置 → 插件 → CloudQ」检查配置。");
-		}
+		normalizeApiError(error);
 		throw error;
 	}
 }
-/** Remove host filesystem details before returning credential state to the browser. */
-function publicCredentialStatus(status) {
-	if (!status || typeof status !== "object" || Array.isArray(status)) return status;
-	const safeStatus = { ...status };
-	delete safeStatus.credential_file;
-	return safeStatus;
-}
-/** Wrap runScript so failures keep a stable envelope for the client. */
-async function credentialStatus() {
-	return publicCredentialStatus(await runScript("login.py", ["--status"]));
+/** Credential state for the settings UI (never exposes the SecretKey). */
+function credentialStatus() {
+	return credentialStatus$1();
 }
 function logout() {
-	return runScript("logout.py", [], { jsonOnly: false });
+	deleteCredential();
+	return { message: "已退出登录。" };
 }
 /**
 * Validate a long-lived Tencent Cloud AK/SK pair without persisting it.
-* The script performs one read-only CloudQ call to prove the key works.
+* DescribeCloudQUsageOverview is read-only, parameterless, and CloudQ's own
+* API — a successful call proves both the key and the CloudQ enrollment.
 */
-function testAccessKey(secretId, secretKey) {
-	return runScript("save_ak.py", ["--test", "--stdin"], {
-		stdin: JSON.stringify({
+async function testAccessKey(secretId, secretKey) {
+	try {
+		await callTcloudApi({
+			service: "advisor",
+			host: "advisor.tencentcloudapi.com",
+			action: "DescribeCloudQUsageOverview",
+			version: "2020-07-21"
+		}, {
 			secretId,
-			secretKey
-		}),
-		sensitiveValues: [secretId, secretKey]
-	});
+			secretKey,
+			token: ""
+		});
+		return {
+			valid: true,
+			secret_id_masked: maskSecretId(secretId)
+		};
+	} catch (error) {
+		normalizeApiError(error);
+		throw error;
+	}
 }
 /** Validate then persist a long-lived AK/SK pair as `type:"ak"`. */
 async function saveAccessKey(secretId, secretKey) {
-	return publicCredentialStatus(await runScript("save_ak.py", ["--save", "--stdin"], {
-		stdin: JSON.stringify({
-			secretId,
-			secretKey
-		}),
-		sensitiveValues: [secretId, secretKey]
-	}));
+	await testAccessKey(secretId, secretKey);
+	saveCredential(secretId, secretKey);
+	return credentialStatus$1();
 }
 function cloudqUsageOverview() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQUsageOverview",
-		"2020-07-21",
-		"{}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQUsageOverview",
+		version: "2020-07-21"
+	});
 }
 function cloudqUsageDetail({ startTime, endTime, limit = 20, offset = 0 }) {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQUsageDetail",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQUsageDetail",
+		version: "2020-07-21",
+		payload: {
 			StartTime: startTime,
 			EndTime: endTime,
 			Limit: limit,
 			Offset: offset
-		})
-	]);
+		}
+	});
 }
 function cloudqInspirationList() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQInspirationList",
-		"2020-07-21",
-		"{\"Category\":0}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQInspirationList",
+		version: "2020-07-21",
+		payload: { Category: 0 }
+	});
 }
 /** Fetch all CloudQ artifact sessions and their archived files. */
 function cloudqArtifactLibrary() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeCloudQArtifactLibrary",
-		"2020-07-21",
-		"{}"
-	]);
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeCloudQArtifactLibrary",
+		version: "2020-07-21"
+	});
 }
 /** Fetch the architecture directory tree available to the current account. */
 function cloudqArchitectureDirectories() {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"ListDirectoryV2",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "ListDirectoryV2",
+		version: "2020-07-21",
+		payload: {
 			Tags: [],
 			TagKeys: []
-		})
-	]);
+		}
+	});
 }
 /** Fetch one page of diagrams in a CloudQ architecture directory. */
 function cloudqArchitectureList({ folderId, pageNumber = 1, pageSize = 30 }) {
-	return runScript("tcloud_api.py", [
-		"advisor",
-		"advisor.tencentcloudapi.com",
-		"DescribeArchList",
-		"2020-07-21",
-		JSON.stringify({
+	return callCloudq({
+		service: "advisor",
+		host: "advisor.tencentcloudapi.com",
+		action: "DescribeArchList",
+		version: "2020-07-21",
+		payload: {
 			PageNumber: pageNumber,
 			PageSize: pageSize,
 			SearchKey: "",
@@ -674,8 +720,8 @@ function cloudqArchitectureList({ folderId, pageNumber = 1, pageSize = 30 }) {
 			WithSvgURL: true,
 			Tags: [],
 			TagKeys: []
-		})
-	]);
+		}
+	});
 }
 /**
 * Extract and validate an AK/SK pair from a request body.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cloudq",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "CloudQ integration for DeepSeek Harness with secure credential, workspace, and plugin-management surfaces",
   "license": "MIT",
   "type": "module",