dsh-workbuddy2api-hub 0.0.0-stage → 1.0.7

package/package.json

@@ -1,6 +1,95 @@
 {
   "name": "dsh-workbuddy2api-hub",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.7",
+  "description": "workbuddy2api-hub 集成：接入本地 hub 面板，同步模型（配额/上下文/思考档位）、实时额度与用量，支持服务地址与 pwd 配置",
+  "type": "module",
+  "main": "lib/index.js",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/HimA6652/dsh-workbuddy2api-hub.git"
+  },
+  "homepage": "https://github.com/HimA6652/dsh-workbuddy2api-hub#readme",
+  "bugs": {
+    "url": "https://github.com/HimA6652/dsh-workbuddy2api-hub/issues"
+  },
+  "keywords": [
+    "dsh",
+    "dsh-plugin",
+    "workbuddy2api-hub",
+    "workbuddy2api",
+    "codebuddy",
+    "tencent-workbuddy",
+    "openai-compatible",
+    "credits",
+    "api-gateway"
+  ],
+  "scripts": {
+    "test": "node --test tests/*.test.mjs",
+    "check": "node scripts/check-secrets.mjs",
+    "mock": "node scripts/mock-hub.mjs",
+    "smoke": "node scripts/smoke-live.mjs",
+    "install": "node scripts/install-local.mjs",
+    "install:dry": "node scripts/install-local.mjs --dry-run",
+    "uninstall": "node scripts/install-local.mjs --uninstall",
+    "release": "node scripts/release.mjs",
+    "notes": "node scripts/release-notes.mjs",
+    "prepublishOnly": "node scripts/check-secrets.mjs && npm test"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-settings"
+      ],
+      "platform": "web"
+    }
+  },
+  "exports": {
+    ".": "./lib/index.js",
+    "./client": "./client/client.js",
+    "./cordis.patch.yml": "./cordis.patch.yml",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "lib",
+    "client",
+    "scripts",
+    "docs",
+    "cordis.patch.yml",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/cordis": "^4.0.2",
+    "@deepseek-ai/dsh-credentials": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.3.0-0",
+    "@deepseek-ai/dsh-host-webserver": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.3.0-0",
+    "@deepseek-ai/dsh-llm-pi-ai": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.3.0-0",
+    "@deepseek-ai/dsh-settings": ">=0.2.0-rc.1 <0.2.1-0 || >=0.2.1-alpha.1 <0.3.0-0"
+  },
+  "peerDependenciesMeta": {
+    "@deepseek-ai/dsh-credentials": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-host-webserver": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-llm-pi-ai": {
+      "optional": true
+    },
+    "@deepseek-ai/dsh-settings": {
+      "optional": true
+    }
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/scripts/check-secrets.mjs

@@ -0,0 +1,86 @@
+#!/usr/bin/env node
+// 发布前自查：扫描项目里有没有凭据泄漏迹象。
+// 用法：node scripts/check-secrets.mjs
+//
+// 只扫源码/配置/文档（.mjs/.js/.json/.yml/.md），跳过 .git、node_modules、tmp、coverage。
+// 命中任何一条就以退出码 1 结束，方便挂到 pre-commit 钩子或 CI 上。
+import { readdir, readFile } from 'node:fs/promises';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const ROOT = dirname(dirname(fileURLToPath(import.meta.url)));
+const SKIP_DIRS = new Set(['.git', 'node_modules', 'tmp', 'coverage', 'docs']);
+const SCAN_EXT = /\.(mjs|js|cjs|json|ya?ml|md)$/;
+
+// 任意一行出现这条标记就整行豁免（写清楚理由，别滥用）。
+const ALLOW_MARK = 'secret-ok';
+
+// 明显的占位/测试值：命中也不算泄漏。
+const PLACEHOLDER = /^(?:admin|wrong|bad|mock|fake|dummy|test|sample|example|your|placeholder|changeme|secret|password)/i;
+
+const RULES = [
+  { name: '私钥', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: 'GitHub Token', re: /gh[pousr]_[A-Za-z0-9]{20,}/ },
+  { name: 'OpenAI 风格 Key', re: /\bsk-[A-Za-z0-9_-]{20,}/ },
+  { name: 'AWS Key', re: /\bAKIA[0-9A-Z]{12,}/ },
+  { name: 'Slack Token', re: /\bxox[bpoa]r?-[A-Za-z0-9-]{10,}/ },
+  { name: '本机绝对路径', re: /[A-Za-z]:\\\\(?:Users|ProgramData)\\\\/ },
+  { name: 'Unix 家目录路径', re: /\/(?:Users|home)\/[A-Za-z0-9._-]+\// },
+  {
+    name: '硬编码密码赋值',
+    re: /(?:password|passwd|pwd)\s*[:=]\s*['"]([^'"]{8,})['"]/i,
+    // 值是中文界面文案（如 pwd: '面板密码（pwd）'）或以占位词开头 → 不算泄漏
+    skip: (value) =>
+      // 值是中文界面文案、含空格/括号（如 pwd: 'Panel password (pwd)'）、或以占位词开头 → 不算泄漏
+      /[\u3400-\u9fff]/.test(value) || /[\s()]/.test(value) || PLACEHOLDER.test(value),
+  },
+];
+
+/** 逐行扫描单个文件。 */
+async function scanFile(file) {
+  const text = await readFile(file, 'utf8');
+  const hits = [];
+  text.split('\n').forEach((line, index) => {
+    if (line.includes(ALLOW_MARK)) return;
+    for (const rule of RULES) {
+      const match = line.match(rule.re);
+      if (!match) continue;
+      if (rule.skip && rule.skip(match[1] ?? '', match)) continue;
+      hits.push({
+        file: relative(ROOT, file).split('\\').join('/'),
+        line: index + 1,
+        rule: rule.name,
+        text: line.trim().slice(0, 120),
+      });
+    }
+  });
+  return hits;
+}
+
+/** 递归收集需要扫描的文件。 */
+async function collect(dir, out = []) {
+  for (const entry of await readdir(dir, { withFileTypes: true })) {
+    if (entry.isDirectory()) {
+      if (!SKIP_DIRS.has(entry.name)) await collect(join(dir, entry.name), out);
+      continue;
+    }
+    if (SCAN_EXT.test(entry.name)) out.push(join(dir, entry.name));
+  }
+  return out;
+}
+
+const files = await collect(ROOT);
+const results = await Promise.all(files.map(scanFile));
+const hits = results.flat();
+
+if (hits.length === 0) {
+  console.log(`OK：扫描 ${files.length} 个文件，未发现疑似凭据。`);
+} else {
+  console.log(`发现 ${hits.length} 处疑似凭据：\n`);
+  for (const hit of hits) {
+    console.log(`${hit.file}:${hit.line}  [${hit.rule}]`);
+    console.log(`    ${hit.text}`);
+  }
+  console.log('\n确认是假数据就在本文件上方 RULES 里豁免，或改成占位符；确认是真凭据则先作废再改代码。');
+  process.exitCode = 1;
+}

package/scripts/install-local.mjs

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+/**
+ * 把本仓库挂进本地 DSH profile（桌面端默认 profile：`~/.dsh/profiles/desktop`）。
+ *
+ * 做的事情只有三件，全部可逆（`--uninstall` 原样退回去）：
+ *   1. 在 profile 的 `package.json` 里加一条 `file:` 依赖与一条 bundle 声明；
+ *   2. 在 profile 的 `node_modules/` 下建一个指向本仓库的链接；
+ *   3. 打印下一步（重启 DSH 才会加载）。
+ *
+ * 不动 `cordis.patch.yml`：插件的挂载点由本包的 `cordis.patch.yml` 自己 insert。
+ *
+ * 用法：
+ *   node scripts/install-local.mjs                # 安装
+ *   node scripts/install-local.mjs --dry-run      # 只看会改什么
+ *   node scripts/install-local.mjs --uninstall    # 卸载
+ *   node scripts/install-local.mjs --profile D:\path\to\profile
+ */
+
+import { existsSync } from 'node:fs'
+import { readFile, rm, symlink, writeFile, mkdir } from 'node:fs/promises'
+import { homedir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const PROJECT = resolve(HERE, '..')
+
+/**
+ * 解析命令行参数。
+ * @param argv - `process.argv.slice(2)`。
+ * @returns 选项对象。
+ */
+function parseArgs(argv) {
+  const options = { uninstall: false, dryRun: false, profile: '' }
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index]
+    if (arg === '--uninstall') options.uninstall = true
+    else if (arg === '--dry-run') options.dryRun = true
+    else if (arg === '--profile') {
+      options.profile = argv[index + 1] ?? ''
+      index += 1
+    } else if (arg === '--help' || arg === '-h') options.help = true
+  }
+  return options
+}
+
+/**
+ * 找到要装的 profile 目录。
+ * @param explicit - `--profile` 传入的值。
+ * @returns 绝对路径。
+ */
+function profileDirOf(explicit) {
+  if (typeof explicit === 'string' && explicit !== '') return resolve(explicit)
+  const name = process.env.DSH_PROFILE !== undefined && process.env.DSH_PROFILE !== '' ? process.env.DSH_PROFILE : 'desktop'
+  return join(homedir(), '.dsh', 'profiles', name)
+}
+
+/**
+ * 读 profile 的 package.json。
+ * @param file - 路径。
+ * @returns 解析后的对象。
+ */
+async function readProfile(file) {
+  const text = await readFile(file, 'utf8')
+  const parsed = JSON.parse(text)
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(`${file} 不是一个 JSON 对象，先手动看一眼`)
+  }
+  return parsed
+}
+
+/** 打印一行「会做什么」。 */
+function plan(action, detail) {
+  console.log(`  ${action.padEnd(8, ' ')} ${detail}`)
+}
+
+/** 主流程。 */
+async function main() {
+  const options = parseArgs(process.argv.slice(2))
+  if (options.help) {
+    console.log('用法：node scripts/install-local.mjs [--dry-run] [--uninstall] [--profile <dir>]')
+    return 0
+  }
+
+  const manifest = JSON.parse(await readFile(join(PROJECT, 'package.json'), 'utf8'))
+  const packageName = manifest.name
+  const profileDir = profileDirOf(options.profile)
+  const packageFile = join(profileDir, 'package.json')
+  const linkPath = join(profileDir, 'node_modules', packageName)
+  const stateFile = join(profileDir, 'workbuddy2api-hub.json')
+
+  if (!existsSync(packageFile)) {
+    console.error(`找不到 profile：${packageFile}`)
+    console.error('DSH 桌面端默认在 ~/.dsh/profiles/desktop；用 --profile 指定其它 profile。')
+    return 2
+  }
+
+  const profile = await readProfile(packageFile)
+  profile.dependencies = profile.dependencies ?? {}
+  profile.dsh = profile.dsh ?? {}
+  profile.dsh.profile = profile.dsh.profile ?? {}
+  const bundles = Array.isArray(profile.dsh.profile.bundles) ? profile.dsh.profile.bundles : []
+
+  console.log(options.uninstall ? '卸载 dsh-workbuddy2api-hub' : '安装 dsh-workbuddy2api-hub')
+  console.log(`  profile  ${profileDir}`)
+  console.log(`  插件     ${PROJECT}`)
+
+  const changes = []
+  if (options.uninstall) {
+    if (packageName in profile.dependencies) {
+      delete profile.dependencies[packageName]
+      changes.push(['删除依赖', packageName])
+    }
+    const nextBundles = bundles.filter((entry) => entry !== packageName)
+    if (nextBundles.length !== bundles.length) {
+      profile.dsh.profile.bundles = nextBundles
+      changes.push(['移除 bundle', packageName])
+    }
+    if (existsSync(linkPath)) changes.push(['删除链接', linkPath])
+    if (existsSync(stateFile)) changes.push(['保留状态', `${stateFile}（要一起删就手动 rm）`])
+  } else {
+    const spec = `file:${PROJECT.replaceAll('\\', '/')}`
+    if (profile.dependencies[packageName] !== spec) {
+      profile.dependencies[packageName] = spec
+      changes.push(['写入依赖', `${packageName} → ${spec}`])
+    }
+    if (!bundles.includes(packageName)) {
+      profile.dsh.profile.bundles = [...bundles, packageName]
+      changes.push(['追加 bundle', packageName])
+    }
+    changes.push(['建立链接', `${linkPath} → ${PROJECT}`])
+  }
+
+  if (changes.length === 0) console.log('  已经是目标状态，无需改动。')
+  for (const [action, detail] of changes) plan(action, detail)
+
+  if (options.dryRun) {
+    console.log('--dry-run：没有写入任何文件。')
+    return 0
+  }
+
+  // 先备份，再改 package.json：profile 起不来是最坏结果，得像改生产配置那样小心。
+  if (changes.length > 0) {
+    const stamp = new Date().toISOString().replace(/[-:]/g, '').replace(/\..+$/, '')
+    const backup = `${packageFile}.bak-workbuddy2api-hub-${stamp}`
+    await writeFile(backup, await readFile(packageFile))
+    console.log(`  备份     ${backup}`)
+    await writeFile(packageFile, `${JSON.stringify(profile, null, 2)}\n`)
+  }
+
+  if (options.uninstall) {
+    await rm(linkPath, { recursive: true, force: true })
+  } else {
+    await mkdir(dirname(linkPath), { recursive: true })
+    await rm(linkPath, { recursive: true, force: true })
+    // Windows 上没有管理员权限建目录符号链接会失败，junction 不需要额外权限。
+    await symlink(PROJECT, linkPath, process.platform === 'win32' ? 'junction' : 'dir')
+  }
+
+  console.log('')
+  if (options.uninstall) {
+    console.log('已卸载。重启 DSH 之后设置页里的这一块就没了。')
+  } else {
+    console.log('装好了。接下来：')
+    console.log('  1. 重启 DSH 桌面端（插件只在启动时加载）')
+    console.log('  2. 打开 设置 → workbuddy2api-hub，确认地址是 http://127.0.0.1:8788、密码是 admin')
+    console.log('  3. 点「测试连接」，再点「立即同步」')
+    console.log('  4. 模型会出现在 设置 → 模型 里，provider 名为 workbuddy2api-hub')
+    console.log('')
+    console.log('前置条件：本地 workbuddy2api-hub 服务已经跑起来（默认 http://127.0.0.1:8788）。')
+  }
+  return 0
+}
+
+main()
+  .then((code) => {
+    process.exitCode = code
+  })
+  .catch((error) => {
+    console.error(`安装脚本出错：${error?.message ?? error}`)
+    process.exitCode = 1
+  })