farming-code 2.2.27 → 2.2.29

package/backend/slash-command-discovery.js

@@ -159,6 +159,7 @@ function discoverClaudeSkillCommands(commands, skillsDir, sourceLabel) {
       label: commandLabel(entry.name),
       description: `Claude skill from ${sourceLabel}`,
       source: 'skill',
+      scope: sourceLabel === 'home' ? 'Personal' : commandLabel(sourceLabel),
     });
   });
 }
@@ -180,10 +181,100 @@ function discoverClaudeCustomCommands(commands, commandsDir, sourceLabel) {
       label: commandLabel(name),
       description: `Claude custom command from ${sourceLabel}`,
       source: 'custom',
+      scope: sourceLabel === 'home' ? 'Personal' : commandLabel(sourceLabel),
     });
   });
 }
 
+function discoverClaudePluginComponents(commands, pluginPath, pluginName) {
+  discoverSkillFiles(path.join(pluginPath, 'skills')).forEach(skillFile => {
+    const skillName = path.basename(path.dirname(skillFile));
+    const metadata = parseSkillFrontMatter(skillFile);
+    addCommand(commands, {
+      command: `/${pluginName}:${skillName}`,
+      label: commandLabel(metadata.name || skillName),
+      description: metadata.description || `Claude skill from ${pluginName}`,
+      source: 'skill',
+      scope: 'Plugin',
+    });
+  });
+
+  let commandEntries = [];
+  try {
+    commandEntries = fs.readdirSync(path.join(pluginPath, 'commands'), { withFileTypes: true });
+  } catch {
+    // Plugins do not have to provide commands.
+  }
+  commandEntries.forEach(entry => {
+    if (!entry.isFile() || !entry.name.endsWith('.md')) return;
+    const commandName = entry.name.slice(0, -3);
+    if (!SAFE_COMMAND_NAME.test(commandName)) return;
+    addCommand(commands, {
+      command: `/${pluginName}:${commandName}`,
+      label: commandLabel(commandName),
+      description: `Claude command from ${pluginName}`,
+      source: 'custom',
+      scope: 'Plugin',
+    });
+  });
+}
+
+function readBoundedJson(filePath, maxBytes = 1024 * 1024) {
+  try {
+    const stats = fs.statSync(filePath);
+    if (!stats.isFile() || stats.size > maxBytes) return null;
+    const value = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+
+function addClaudePlugin(commands, pluginName, pluginPath, scope = 'Plugin') {
+  if (!SAFE_COMMAND_NAME.test(pluginName)) return;
+  const manifest = readBoundedJson(path.join(pluginPath, '.claude-plugin', 'plugin.json'));
+  addCommand(commands, {
+    command: `plugin:${pluginName}`,
+    label: String(manifest?.name || commandLabel(pluginName)).slice(0, 100),
+    description: String(manifest?.description || 'Claude Code plugin').slice(0, 500),
+    source: 'plugin',
+    scope,
+  });
+  discoverClaudePluginComponents(commands, pluginPath, pluginName);
+}
+
+function discoverClaudeInstalledPlugins(commands, homePath) {
+  const pluginsRoot = path.join(homePath, 'plugins');
+  const installed = readBoundedJson(path.join(pluginsRoot, 'installed_plugins.json'));
+  Object.entries(installed?.plugins || {}).slice(0, MAX_DISCOVERED_SKILLS).forEach(([key, rawEntries]) => {
+    const pluginName = key.split('@')[0];
+    const entries = Array.isArray(rawEntries) ? rawEntries : [];
+    const installedEntry = entries.find(entry => (
+      entry && typeof entry === 'object' && typeof entry.installPath === 'string'
+    ));
+    if (!installedEntry) return;
+    addClaudePlugin(
+      commands,
+      pluginName,
+      installedEntry.installPath,
+      String(installedEntry.scope || 'Plugin'),
+    );
+  });
+
+  let entries = [];
+  try {
+    entries = fs.readdirSync(pluginsRoot, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  entries.forEach(entry => {
+    if (!entry.isDirectory() || !SAFE_COMMAND_NAME.test(entry.name)) return;
+    const pluginPath = path.join(pluginsRoot, entry.name);
+    if (!fs.existsSync(path.join(pluginPath, '.claude-plugin', 'plugin.json'))) return;
+    addClaudePlugin(commands, entry.name, pluginPath);
+  });
+}
+
 function discoverClaudeSlashCommands({ homeDir = os.homedir(), workspace } = {}) {
   const commands = [];
   const normalizedWorkspace = normalizeWorkspace(workspace, homeDir);
@@ -249,15 +340,26 @@ function discoverPluginSkillFiles(root, depth = 0, skillFiles = []) {
 
 function pluginNameForSkillFile(skillFile, pluginsCacheDir) {
   const parts = path.relative(pluginsCacheDir, skillFile).split(path.sep);
-  if (parts[0] === 'openai-curated' && parts[1]) return parts[1];
+  if ((parts[0] === 'openai-curated' || parts[0] === 'openai-curated-remote') && parts[1]) return parts[1];
   if ((parts[0] === 'openai-primary-runtime' || parts[0] === 'openai-bundled') && parts[1]) return parts[1];
   return parts[0] || '';
 }
 
 function discoverCodexPluginSkills(commands, homeDir) {
   const pluginsCacheDir = path.join(homeDir, '.codex', 'plugins', 'cache');
+  discoverCodexPluginSkillsAt(commands, pluginsCacheDir);
+}
+
+function discoverCodexPluginSkillsAt(commands, pluginsCacheDir) {
   discoverPluginSkillFiles(pluginsCacheDir).forEach(skillFile => {
     const pluginName = pluginNameForSkillFile(skillFile, pluginsCacheDir);
+    addCommand(commands, {
+      command: `plugin:${pluginName}`,
+      label: commandLabel(pluginName),
+      description: 'Codex plugin',
+      source: 'plugin',
+      scope: 'Plugin',
+    });
     addSkillMention(commands, skillFile, {
       mentionPrefix: pluginName,
       fallbackName: path.basename(path.dirname(skillFile)),
@@ -278,6 +380,40 @@ function discoverCodexSkillMentions({ homeDir = os.homedir(), workspace } = {})
   return commands.slice(0, MAX_DISCOVERED_SKILLS);
 }
 
+function discoverAgentExtensions({
+  provider,
+  providerHomePath,
+  workspace,
+  homeDir = os.homedir(),
+} = {}) {
+  const normalizedProvider = normalizeProvider(provider);
+  const homePath = normalizeWorkspace(providerHomePath);
+  const normalizedHomeDir = normalizeWorkspace(homeDir) || os.homedir();
+  if (!normalizedProvider || !homePath) return [];
+
+  const commands = [];
+  if (normalizedProvider === 'claude') {
+    const normalizedWorkspace = normalizeWorkspace(workspace);
+    if (normalizedWorkspace) {
+      discoverClaudeSkillCommands(commands, path.join(normalizedWorkspace, '.claude', 'skills'), 'workspace');
+      discoverClaudeCustomCommands(commands, path.join(normalizedWorkspace, '.claude', 'commands'), 'workspace');
+    }
+    discoverClaudeSkillCommands(commands, path.join(homePath, 'skills'), 'home');
+    discoverClaudeCustomCommands(commands, path.join(homePath, 'commands'), 'home');
+    discoverClaudeInstalledPlugins(commands, homePath);
+    return commands.slice(0, MAX_DISCOVERED_SKILLS);
+  }
+
+  workspaceSkillRoots(workspace, normalizedHomeDir)
+    .forEach(root => discoverDirectCodexSkills(commands, root, 'Repo'));
+  discoverDirectCodexSkills(commands, path.join(normalizedHomeDir, '.agents', 'skills'), 'Personal');
+  discoverDirectCodexSkills(commands, path.join(homePath, 'skills'), 'Personal');
+  discoverDirectCodexSkills(commands, path.join(homePath, 'skills', '.system'), 'System');
+  discoverDirectCodexSkills(commands, path.join('/etc', 'codex', 'skills'), 'Admin');
+  discoverCodexPluginSkillsAt(commands, path.join(homePath, 'plugins', 'cache'));
+  return commands.slice(0, MAX_DISCOVERED_SKILLS);
+}
+
 function discoverSlashCommands({ provider, homeDir = os.homedir(), workspace } = {}) {
   const normalizedProvider = normalizeProvider(provider);
   if (normalizedProvider === 'codex') {
@@ -290,6 +426,7 @@ function discoverSlashCommands({ provider, homeDir = os.homedir(), workspace } =
 }
 
 module.exports = {
+  discoverAgentExtensions,
   discoverSlashCommands,
   discoverClaudeSlashCommands,
   discoverCodexSkillMentions,

package/backend/storage-layout.js

@@ -49,6 +49,34 @@ function usageHistoryCacheFile(configDir) {
   return path.join(historyDir(configDir), 'usage-history-v2.sqlite3');
 }
 
+function browserResourcesDir(configDir) {
+  return path.join(configDir, 'browsers');
+}
+
+function browserResourcesFile(configDir) {
+  return path.join(browserResourcesDir(configDir), 'resources.json');
+}
+
+function browserProfileDir(configDir, browserId) {
+  return path.join(browserResourcesDir(configDir), browserId, 'profile');
+}
+
+function runtimeDependenciesDir(configDir) {
+  return path.join(configDir, 'runtimes');
+}
+
+function runtimeDependenciesActiveFile(configDir) {
+  return path.join(runtimeDependenciesDir(configDir), 'active.json');
+}
+
+function runtimeDependenciesLockDir(configDir) {
+  return path.join(runtimeDependenciesDir(configDir), '.prepare.lock');
+}
+
+function farmingAgentBootstrapFile(configDir) {
+  return path.join(configDir, 'farming-agent-bootstrap.zh_cn.md');
+}
+
 function sessionIndexFile(configDir) {
   return path.join(sessionsDir(configDir), 'index.json');
 }
@@ -124,6 +152,10 @@ function farmingNetTrustFile(configDir) {
 module.exports = {
   acpCheckpointsDir,
   agentStateFile,
+  browserProfileDir,
+  browserResourcesDir,
+  browserResourcesFile,
+  farmingAgentBootstrapFile,
   farmingNetInstancesFile,
   farmingNetServerLogFile,
   farmingNetServerStateFile,
@@ -132,6 +164,9 @@ module.exports = {
   farmingNetTrustFile,
   farmingConfigDir,
   historyDir,
+  runtimeDependenciesActiveFile,
+  runtimeDependenciesDir,
+  runtimeDependenciesLockDir,
   nativePtyControllerGenerationFile,
   nativePtyControllerGenerationLockDir,
   nativePtyHostLogFile,

package/backend/update-service.js

@@ -7,6 +7,7 @@ const os = require('os');
 const path = require('path');
 const { Transform } = require('stream');
 const { pipeline } = require('stream/promises');
+const { readServerProcessIdentity } = require('./server-process-identity');
 const storageLayout = require('./storage-layout');
 
 const CACHE_TTL_MS = 5 * 60 * 1000;
@@ -789,6 +790,15 @@ class FarmingUpdateService {
     this.getNpmGlobalRoot = options.getNpmGlobalRoot
       || ((npmCommand, npmPrefix) => readNpmGlobalRoot(npmCommand, npmPrefix, this.execFile));
     this.spawn = options.spawn || childProcess.spawn;
+    this.prepareRuntimeDependencies = options.prepareRuntimeDependencies || (async (releaseDir) => {
+      if (process.env.NODE_ENV === 'test') return;
+      const managerPath = path.join(releaseDir, 'backend', 'runtime-dependency-manager.js');
+      const { prepareRuntimeDependencies } = require(managerPath);
+      await prepareRuntimeDependencies({
+        configDir: this.configDir,
+        env: { ...process.env, FARMING_CONFIG_DIR: this.configDir },
+      });
+    });
     this.latestCache = null;
     this.npmCache = null;
     this.installState = { phase: 'idle' };
@@ -1300,6 +1310,10 @@ class FarmingUpdateService {
     }
 
     const nodePath = process.env.FARMING_NODE_BIN || process.execPath;
+    const serverProcessIdentity = await readServerProcessIdentity(process.pid);
+    if (!serverProcessIdentity) {
+      throw new Error('Running Farming server process identity could not be verified');
+    }
     let helperPath;
     let payload;
     let env;
@@ -1343,6 +1357,7 @@ class FarmingUpdateService {
         stagingPrefix,
         stagingPackageRoot,
         serverPid: process.pid,
+        serverProcessIdentity,
         configDir: this.configDir,
         port: process.env.FARMING_PORT || process.env.PORT || '6694',
         basePath: process.env.FARMING_BASE_PATH || '/farming',
@@ -1483,6 +1498,16 @@ class FarmingUpdateService {
     }
     const logPath = this.installState.logPath || path.join(this.configDir, 'farming-update.log');
     const targetMethod = String(releaseMetadata.updateMethod || releaseMetadata.type || this.installMethod);
+    this.persistInstallState({
+      ...this.installState,
+      phase: 'preparing-runtimes',
+      targetMethod,
+      releaseDir,
+      installer,
+      logPath,
+    });
+    await this.prepareRuntimeDependencies(releaseDir);
+    const runtimePreparedAt = new Date(this.now()).toISOString();
     this.persistInstallState({
       ...this.installState,
       phase: 'ready-to-restart',
@@ -1490,7 +1515,8 @@ class FarmingUpdateService {
       releaseDir,
       installer,
       logPath,
-      preparedAt: new Date(this.now()).toISOString(),
+      preparedAt: runtimePreparedAt,
+      runtimePreparedAt,
     });
   }
 }

package/backend/workspace-file-router.js

@@ -4,6 +4,7 @@ const os = require('os');
 const path = require('path');
 const { inspectGitWorktree } = require('./git-worktree-info');
 const { WorkspaceFileError } = require('./workspace-file-service');
+const { PreviewSessionManager } = require('./preview-session-manager');
 const {
   GLOBAL_WORKSPACE_FILES_AGENT_ID,
   GLOBAL_WORKSPACE_FILES_ROOT,
@@ -57,6 +58,53 @@ function isSameOrDescendantPath(root, target) {
   return relative === '' || Boolean(relative) && !relative.startsWith('..') && !path.isAbsolute(relative);
 }
 
+function previewAuthorizedRootForTarget(allowedRoots, target) {
+  return allowedRoots
+    .filter(root => isSameOrDescendantPath(root, target))
+    .sort((left, right) => right.length - left.length)[0] || '';
+}
+
+function normalizePreviewAssetPath(value) {
+  const normalized = path.posix.normalize(String(value || '').replace(/\\/g, '/').replace(/^\/+/, ''));
+  if (!normalized || normalized === '.') return '';
+  if (normalized === '..' || normalized.startsWith('../') || path.posix.isAbsolute(normalized)) {
+    throw new WorkspaceFileError('preview path must stay inside the authorized root', 403);
+  }
+  return normalized;
+}
+
+function previewContentSecurityPolicy() {
+  return [
+    "default-src 'none'",
+    "script-src 'none'",
+    "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data:",
+    "font-src 'self' data:",
+    "media-src 'self' data:",
+    "connect-src 'none'",
+    "frame-src 'none'",
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'none'",
+    "frame-ancestors 'self'",
+  ].join('; ');
+}
+
+function escapeHtmlAttribute(value) {
+  return String(value || '')
+    .replace(/&/g, '&')
+    .replace(/"/g, '"')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+
+function rewritePreviewHtmlRootReferences(source, rootUrl) {
+  const safeRootUrl = escapeHtmlAttribute(rootUrl);
+  return String(source || '')
+    .replace(/(\b(?:href|src|poster)\s*=\s*["'])\/(?!\/)/gi, `$1${safeRootUrl}`)
+    .replace(/(url\(\s*["']?)\/(?!\/)/gi, `$1${safeRootUrl}`);
+}
+
 function globalUserPathToAbsolute(userPath = '') {
   const normalized = String(userPath || '')
     .trim()
@@ -222,6 +270,7 @@ function readOptionsForAgent(agentManager, agentId) {
 function createWorkspaceFileRouter(agentManager, fileService, options = {}) {
   const router = express.Router();
   const rootRegistry = options.rootRegistry || workspaceRootRegistryFor(agentManager);
+  const previewSessions = options.previewSessionManager || new PreviewSessionManager();
 
   router.use(express.json({ limit: '3mb' }));
 
@@ -287,6 +336,98 @@ function createWorkspaceFileRouter(agentManager, fileService, options = {}) {
     }
   });
 
+  router.post('/previews', async (req, res) => {
+    try {
+      const body = req.body || {};
+      const rootRef = workspaceRef(body);
+      let entryPath = String(body.path || '').trim();
+      if (!/\.html?$/i.test(entryPath)) {
+        throw new WorkspaceFileError('HTML preview requires an .html or .htm file', 415);
+      }
+
+      let authorizedRoot;
+      if (isGlobalWorkspaceFilesAgentId(rootRef)) {
+        if (body.exact === true) {
+          entryPath = assertExactExternalFileReadable(entryPath);
+          authorizedRoot = path.dirname(realPathIfPresent(globalUserPathToAbsolute(entryPath)));
+          if (authorizedRoot === path.parse(authorizedRoot).root) {
+            throw new WorkspaceFileError('external HTML preview directory cannot be the filesystem root', 403);
+          }
+        } else {
+          const authorization = assertGlobalWorkspacePathAllowed(agentManager, entryPath);
+          authorizedRoot = previewAuthorizedRootForTarget(authorization.allowedRoots, realPathIfPresent(authorization.target));
+          if (!authorizedRoot) throw new WorkspaceFileError('global file path is outside allowed workspaces', 403);
+        }
+      }
+
+      const { root, rootId } = resolveRequestRoot(body);
+      await fileService.readFile(root, entryPath, { allowedExternalRoots: [] });
+      const session = previewSessions.createStatic({
+        rootId,
+        workspaceRoot: root,
+        authorizedRoot: realPathIfPresent(authorizedRoot || root),
+        entryPath,
+        baseDirectory: path.posix.dirname(entryPath) === '.' ? '' : path.posix.dirname(entryPath),
+      });
+      res.status(201).json({
+        preview: {
+          id: session.id,
+          kind: session.kind,
+          expiresAt: session.expiresAt,
+        },
+      });
+    } catch (error) {
+      sendWorkspaceFileError(res, error);
+    }
+  });
+
+  router.get('/previews/:sessionId/:scope/*', async (req, res) => {
+    try {
+      const session = previewSessions.get(req.params.sessionId);
+      if (!session) throw new WorkspaceFileError('preview session not found or expired', 404);
+      const scope = req.params.scope;
+      if (scope !== 'base' && scope !== 'root') {
+        throw new WorkspaceFileError('preview scope is invalid', 400);
+      }
+      const assetPath = normalizePreviewAssetPath(req.params[0] || '');
+      const resourcePath = scope === 'base'
+        ? path.posix.join(session.baseDirectory, assetPath)
+        : assetPath;
+      if (!resourcePath) throw new WorkspaceFileError('preview resource path is required', 400);
+
+      const absoluteTarget = realPathIfPresent(path.resolve(session.workspaceRoot, resourcePath));
+      if (!isSameOrDescendantPath(session.authorizedRoot, absoluteTarget)) {
+        throw new WorkspaceFileError('preview path must stay inside the authorized root', 403);
+      }
+
+      const file = await fileService.readResourceFile(session.workspaceRoot, resourcePath, {
+        allowedExternalRoots: [],
+      });
+      const isHtml = /\.html?$/i.test(file.path);
+      const body = isHtml
+        ? Buffer.from(rewritePreviewHtmlRootReferences(
+          file.buffer.toString('utf8'),
+          `${req.baseUrl}/previews/${encodeURIComponent(session.id)}/root/`,
+        ))
+        : file.buffer;
+      res
+        .status(200)
+        .type(path.extname(file.path) || 'application/octet-stream')
+        .set('Cache-Control', 'no-store')
+        .set('X-Content-Type-Options', 'nosniff')
+        .set('Content-Length', String(body.length));
+      if (isHtml) res.set('Content-Security-Policy', previewContentSecurityPolicy());
+      res.send(body);
+    } catch (error) {
+      sendWorkspaceFileError(res, error);
+    }
+  });
+
+  router.delete('/previews/:sessionId', (req, res) => {
+    const deleted = previewSessions.delete(req.params.sessionId);
+    res.status(deleted ? 204 : 404).end();
+  });
+
   router.put('/file', async (req, res) => {
     try {
       const body = req.body || {};

package/backend/workspace-file-service.js

@@ -2199,6 +2199,25 @@ class WorkspaceFileService {
     };
   }
 
+  async readResourceFile(workspaceRoot, userPath, options = {}) {
+    const { target, relativePath } = await this.resolvePath(workspaceRoot, userPath, options);
+    const stat = await fsp.stat(target);
+    if (!stat.isFile()) {
+      throw new WorkspaceFileError('path must be a file', 400);
+    }
+    if (stat.size > this.maxPreviewFileSize) {
+      throw new WorkspaceFileError('file is too large to preview', 413, { size: stat.size });
+    }
+    const buffer = await fsp.readFile(target);
+    return {
+      path: relativePath,
+      buffer,
+      size: stat.size,
+      mtimeMs: stat.mtimeMs,
+      sha1: sha1(buffer),
+    };
+  }
+
   async blameCapability(workspaceRoot, userPath, options = {}) {
     const { root, target, relativePath, actualRelativePath, external } = await this.resolvePath(workspaceRoot, userPath, options);
     const capability = (available, reason = '') => ({

package/backend/workspace-root-registry.js

@@ -27,6 +27,7 @@ function canonicalWorkspacePath(value) {
 function rootIdForPath(value) {
   const canonicalPath = canonicalWorkspacePath(value);
   if (!canonicalPath) return '';
+  if (canonicalPath === GLOBAL_WORKSPACE_FILES_ROOT) return GLOBAL_WORKSPACE_ROOT_ID;
   let hash = 0xcbf29ce484222325n;
   for (const byte of Buffer.from(canonicalPath, 'utf8')) {
     hash ^= BigInt(byte);
@@ -77,15 +78,16 @@ class WorkspaceRootRegistry {
     if (current && current.canonicalPath !== canonicalPath) {
       throw new WorkspaceFileError('workspace root identity collision', 409);
     }
+    const isGlobalRoot = rootId === GLOBAL_WORKSPACE_ROOT_ID;
     const root = Object.freeze({
       rootId,
-      kind: options.kind || current?.kind || 'directory',
+      kind: isGlobalRoot ? 'global' : (options.kind || current?.kind || 'directory'),
       canonicalPath,
       repositoryId: options.repositoryId || current?.repositoryId || '',
       accessPolicy: Object.freeze({
-        readOnly: options.accessPolicy?.readOnly === true,
-        watch: options.accessPolicy?.watch !== false,
-        externalReads: options.accessPolicy?.externalReads !== false,
+        readOnly: isGlobalRoot || options.accessPolicy?.readOnly === true,
+        watch: isGlobalRoot ? false : options.accessPolicy?.watch !== false,
+        externalReads: isGlobalRoot ? false : options.accessPolicy?.externalReads !== false,
       }),
     });
     this.roots.set(rootId, root);

package/config/farming.install.env.example

@@ -13,5 +13,9 @@ FARMING_BASE_PATH=/farming
 
 # 应用内升级源在 Web Settings 中配置，并保存到 ~/.farming/settings.json。
 
+# Farming 随发行包提供默认公共 npm 镜像候选。
+# 可设置为其他 HTTPS Registry Origin，或设置为 off 关闭镜像候选。
+# FARMING_RUNTIME_NPM_MIRROR=off
+
 # 可选：按 cgroup / 系统内存自动计算 Node heap；设置为 0 表示使用 Node 默认值。
 # FARMING_NODE_MAX_OLD_SPACE_SIZE=auto