feihong-code 0.2.1

package/dist/tools/safe-path.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.safeJoin = safeJoin;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 路径安全：工具只能在工作区范围内操作，防止 ../ 穿越越权
+ */
+const path_1 = require("path");
+const fs_1 = require("fs");
+const errors_1 = require("../shared/errors");
+/**
+ * 若路径已存在则规范化符号链接（realpath），否则原样返回。
+ * 用于对已存在的文件/目录做符号链接逃逸检测，而新建文件场景不受影响。
+ */
+function canonicalIfExists(p) {
+    try {
+        return (0, fs_1.realpathSync)(p);
+    }
+    catch {
+        return p;
+    }
+}
+/** 将 target 解析为绝对路径，并校验未超出 base（防 ../ 穿越 + 符号链接逃逸） */
+function safeJoin(base, target) {
+    const absBase = canonicalIfExists((0, path_1.resolve)(base));
+    const rawTarget = (0, path_1.isAbsolute)(target) ? (0, path_1.resolve)(target) : (0, path_1.resolve)(absBase, target);
+    const absTarget = canonicalIfExists(rawTarget);
+    const rel = (0, path_1.relative)(absBase, absTarget);
+    if (rel.startsWith('..') || (rel !== '' && (0, path_1.isAbsolute)(rel))) {
+        throw new errors_1.SecurityError(`路径越权: ${target} 超出工作区 ${base}`);
+    }
+    return absTarget;
+}
+//# sourceMappingURL=safe-path.js.map

package/dist/tools/safe-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-path.js","sourceRoot":"","sources":["../../src/tools/safe-path.ts"],"names":[],"mappings":";;AAuBA,4BASC;AAhCD;;;;;GAKG;AACH,+BAAqD;AACrD,2BAAkC;AAClC,6CAAiD;AAEjD;;;GAGG;AACH,SAAS,iBAAiB,CAAC,CAAS;IAClC,IAAI,CAAC;QACH,OAAO,IAAA,iBAAY,EAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,sDAAsD;AACtD,SAAgB,QAAQ,CAAC,IAAY,EAAE,MAAc;IACnD,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,IAAA,iBAAU,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,IAAA,eAAQ,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,IAAI,IAAA,iBAAU,EAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,sBAAa,CAAC,SAAS,MAAM,UAAU,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/search/grep.tool.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.grepTool = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 工具：递归文本搜索
+ */
+const zod_1 = require("zod");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const safe_path_1 = require("../safe-path");
+const MAX_DEPTH = 8;
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', 'out', '.workbuddy']);
+async function walk(dir, depth, pattern, base, hits) {
+    if (depth > MAX_DEPTH)
+        return;
+    let entries;
+    try {
+        entries = await (0, promises_1.readdir)(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const e of entries) {
+        const abs = (0, path_1.join)(dir, e.name);
+        if (e.isDirectory()) {
+            if (SKIP_DIRS.has(e.name))
+                continue;
+            await walk(abs, depth + 1, pattern, base, hits);
+        }
+        else if (e.isFile()) {
+            try {
+                const content = await (0, promises_1.readFile)(abs, 'utf8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    if (pattern.test(lines[i])) {
+                        hits.push(`${(0, path_1.relative)(base, abs)}:${i + 1}: ${lines[i].trim().slice(0, 200)}`);
+                    }
+                }
+            }
+            catch {
+                // 二进制/无法读取的文件忽略
+            }
+        }
+    }
+}
+exports.grepTool = {
+    name: 'grep',
+    description: '在工作区内递归搜索匹配文本（忽略 node_modules/.git 等），返回 file:line:content',
+    jsonSchema: {
+        type: 'object',
+        properties: {
+            pattern: { type: 'string', description: '正则模式' },
+            path: { type: 'string', description: '搜索起始目录，默认工作区根' },
+        },
+        required: ['pattern'],
+    },
+    schema: zod_1.z.object({ pattern: zod_1.z.string().min(1), path: zod_1.z.string().min(1).optional() }),
+    async execute(args, ctx) {
+        try {
+            const { pattern, path } = args;
+            let regex;
+            try {
+                regex = new RegExp(pattern, 'i');
+            }
+            catch {
+                return { ok: false, output: '', error: `无效的正则表达式: "${pattern}"` };
+            }
+            const base = (0, safe_path_1.safeJoin)(ctx.cwd, path ?? '.');
+            const hits = [];
+            await walk(base, 0, regex, base, hits);
+            return { ok: true, output: hits.length ? hits.slice(0, 50).join('\n') : '无匹配' };
+        }
+        catch (err) {
+            return { ok: false, output: '', error: `grep 搜索失败: ${err instanceof Error ? err.message : String(err)}` };
+        }
+    },
+};
+//# sourceMappingURL=grep.tool.js.map

package/dist/tools/search/grep.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grep.tool.js","sourceRoot":"","sources":["../../../src/tools/search/grep.tool.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAAwB;AACxB,0CAAgD;AAChD,+BAAsC;AAEtC,4CAAwC;AAExC,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AAE1F,KAAK,UAAU,IAAI,CACjB,GAAW,EACX,KAAa,EACb,OAAe,EACf,IAAY,EACZ,IAAc;IAEd,IAAI,KAAK,GAAG,SAAS;QAAE,OAAO;IAC9B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACpB,IAAI,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACpC,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBACtC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,IAAA,eAAQ,EAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;oBACjF,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAEY,QAAA,QAAQ,GAAS;IAC5B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,4DAA4D;IACzE,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE;YAChD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,eAAe,EAAE;SACvD;QACD,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpF,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAA0C,CAAC;YACrE,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,OAAO,GAAG,EAAE,CAAC;YACpE,CAAC;YACD,MAAM,IAAI,GAAG,IAAA,oBAAQ,EAAC,GAAG,CAAC,GAAG,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC;YAC5C,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;QAClF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QAC5G,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/tools/shell/exec.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommand = runCommand;
+exports.sanitizeManagedCommand = sanitizeManagedCommand;
+exports.commandHead = commandHead;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 命令执行辅助（跨平台，spawn shell）
+ */
+const child_process_1 = require("child_process");
+function runCommand(cmd, cwd, timeoutMs = 120000) {
+    return new Promise((resolve) => {
+        const child = (0, child_process_1.spawn)(cmd, { cwd, shell: true, timeout: timeoutMs });
+        let stdout = '';
+        let stderr = '';
+        child.stdout?.on('data', (d) => (stdout += d.toString()));
+        child.stderr?.on('data', (d) => (stderr += d.toString()));
+        // spawn 启动失败时只会触发 error 且不再触发 close，必须在此 resolve，否则调用方 await 永久挂起
+        child.on('error', (e) => {
+            stderr += e.message;
+            resolve({ code: 1, stdout, stderr });
+        });
+        child.on('close', (code) => resolve({ code: code ?? 1, stdout, stderr }));
+    });
+}
+/**
+ * 受管命令约束（run_tests / build_check 等）：仅允许包管理器脚本，
+ * 禁止 shell 注入元字符与危险子命令，杜绝任意命令执行（沙箱逃逸）。
+ */
+const MANAGED_INJECTION_RE = /[;&|`$(){}<>!]|&&|\|\||\b(alias|eval|exec|source)\b/;
+const MANAGED_DANGEROUS_RE = /\b(rm\s+-rf|curl|wget|sh\s+-c|bash\s+-c|eval|nc\b|telnet|mkfs)\b/i;
+const MANAGED_PKG_RE = /^(npm|pnpm|yarn|bun)(\s|$)/;
+function sanitizeManagedCommand(raw, fallback = 'npm test') {
+    const cmd = (raw ?? fallback).trim();
+    if (MANAGED_INJECTION_RE.test(cmd))
+        return null;
+    if (!MANAGED_PKG_RE.test(cmd))
+        return null;
+    if (MANAGED_DANGEROUS_RE.test(cmd))
+        return null;
+    return cmd;
+}
+/** 取命令首词（用于白名单校验） */
+function commandHead(cmd) {
+    const m = cmd.trim().match(/^(\S+)/);
+    return m ? m[1] : '';
+}
+//# sourceMappingURL=exec.js.map

package/dist/tools/shell/exec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/tools/shell/exec.ts"],"names":[],"mappings":";;AAcA,gCAcC;AAUD,wDAMC;AAGD,kCAGC;AAlDD;;;;;GAKG;AACH,iDAAsC;AAQtC,SAAgB,UAAU,CAAC,GAAW,EAAE,GAAW,EAAE,SAAS,GAAG,MAAM;IACrE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAA,qBAAK,EAAC,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACnE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC1D,kEAAkE;QAClE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC;YACpB,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACvC,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAG,qDAAqD,CAAC;AACnF,MAAM,oBAAoB,GAAG,mEAAmE,CAAC;AACjG,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,SAAgB,sBAAsB,CAAC,GAAY,EAAE,QAAQ,GAAG,UAAU;IACxE,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qBAAqB;AACrB,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACvB,CAAC"}

package/dist/tools/shell/run-shell.tool.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runShellTool = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 工具：执行 shell 命令（白名单 + 审批）
+ */
+const zod_1 = require("zod");
+const exec_1 = require("./exec");
+/** Shell 注入元字符 — 命中则需额外审批 */
+const SHELL_INJECTION_RE = /[;&|`$(){}<>!]|&&|\|\||\b(alias|eval|exec|source)\b/;
+exports.runShellTool = {
+    name: 'run_shell',
+    description: '执行 shell 命令（受白名单约束，需审批时会被拦截）',
+    jsonSchema: {
+        type: 'object',
+        properties: { command: { type: 'string', description: '要执行的完整命令' } },
+        required: ['command'],
+    },
+    schema: zod_1.z.object({ command: zod_1.z.string().min(1) }),
+    async execute(args, ctx) {
+        const { command } = args;
+        const head = (0, exec_1.commandHead)(command);
+        // 白名单检查（仅当配置了白名单时约束首词）
+        if (ctx.security.shellAllowlist.length > 0) {
+            if (!ctx.security.shellAllowlist.includes(head)) {
+                return { ok: false, output: '', error: `命令不在白名单: ${head}` };
+            }
+        }
+        // 注入元字符校验独立于白名单，始终执行（防止白名单关闭后命令注入逃逸）
+        if (SHELL_INJECTION_RE.test(command)) {
+            return { ok: false, output: '', error: `命令含 shell 注入风险，已被拦截: ${command.slice(0, 100)}` };
+        }
+        if (ctx.security.requireApproval) {
+            const approved = ctx.approve ? await ctx.approve(`run_shell: ${command}`) : false;
+            if (!approved)
+                return { ok: false, output: '', error: '已拒绝执行（需审批）' };
+        }
+        const res = await (0, exec_1.runCommand)(command, ctx.cwd);
+        return {
+            ok: res.code === 0,
+            output: `${res.stdout}${res.stderr}`.slice(0, 4000),
+            error: res.code === 0 ? undefined : `exit code ${res.code}`,
+        };
+    },
+};
+//# sourceMappingURL=run-shell.tool.js.map

package/dist/tools/shell/run-shell.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-shell.tool.js","sourceRoot":"","sources":["../../../src/tools/shell/run-shell.tool.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAAwB;AAExB,iCAAiD;AAEjD,6BAA6B;AAC7B,MAAM,kBAAkB,GAAG,qDAAqD,CAAC;AAEpE,QAAA,YAAY,GAAS;IAChC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,8BAA8B;IAC3C,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE;QACpE,QAAQ,EAAE,CAAC,SAAS,CAAC;KACtB;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,MAAM,EAAE,OAAO,EAAE,GAAG,IAA2B,CAAC;QAChD,MAAM,IAAI,GAAG,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC;QAClC,uBAAuB;QACvB,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,IAAI,EAAE,EAAE,CAAC;YAC9D,CAAC;QACH,CAAC;QACD,qCAAqC;QACrC,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,wBAAwB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;QAC3F,CAAC;QACD,IAAI,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YAClF,IAAI,CAAC,QAAQ;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;YAClB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACnD,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE;SAC5D,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/tools/tool.interface.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toDefinition = toDefinition;
+/** 工具 → 模型可见的工具定义 */
+function toDefinition(tool) {
+    return { name: tool.name, description: tool.description, parameters: tool.jsonSchema };
+}
+//# sourceMappingURL=tool.interface.js.map

package/dist/tools/tool.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.interface.js","sourceRoot":"","sources":["../../src/tools/tool.interface.ts"],"names":[],"mappings":";;AA0DA,oCAEC;AAHD,qBAAqB;AACrB,SAAgB,YAAY,CAAC,IAAU;IACrC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACzF,CAAC"}

package/dist/tools/tool.registry.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ToolRegistry = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 工具注册表：注册、查找、执行（含 zod 校验 + 错误归一）
+ */
+const logger_1 = require("../shared/logger");
+const tool_interface_1 = require("./tool.interface");
+class ToolRegistry {
+    tools = new Map();
+    register(tool) {
+        if (this.tools.has(tool.name)) {
+            logger_1.logger.warn('tool overwritten', { name: tool.name });
+        }
+        this.tools.set(tool.name, tool);
+    }
+    has(name) {
+        return this.tools.has(name);
+    }
+    get(name) {
+        return this.tools.get(name);
+    }
+    list() {
+        return [...this.tools.values()];
+    }
+    /** 模型可见的工具定义列表 */
+    definitions() {
+        return this.list().map(tool_interface_1.toDefinition);
+    }
+    /** 执行工具（自动 zod 校验入参，错误归一为 ToolResult） */
+    async execute(name, rawArgs, ctx) {
+        const tool = this.tools.get(name);
+        if (!tool) {
+            return { ok: false, output: '', error: `未知工具: ${name}` };
+        }
+        const parsed = tool.schema.safeParse(rawArgs);
+        if (!parsed.success) {
+            return { ok: false, output: '', error: `参数校验失败: ${parsed.error.message}` };
+        }
+        const args = parsed.data;
+        // M4：企业守卫前置（策略 → 审批 → 审计）。未注入 guard 时行为不变。
+        if (ctx.guard) {
+            let verdict;
+            try {
+                verdict = await ctx.guard.check(name, args);
+            }
+            catch (e) {
+                // 审计写入失败等异常一律按拒绝处理：宁可不做，不可无痕
+                const msg = e instanceof Error ? e.message : String(e);
+                logger_1.logger.error('工具守卫校验异常，已拒绝执行', { tool: name, error: msg });
+                return { ok: false, output: '', error: `守卫校验失败，操作被拒绝: ${msg}` };
+            }
+            if (!verdict.allowed) {
+                logger_1.logger.warn('工具调用被守卫拒绝', { tool: name, reason: verdict.reason });
+                return { ok: false, output: '', error: verdict.reason };
+            }
+            // 守卫已是唯一权威闸门（策略 + 审批 + 审计都已完成），
+            // 此处关闭工具内的二次审批与白名单硬拦截，避免重复弹审批 / 决策打架。
+            ctx = { ...ctx, security: { shellAllowlist: [], requireApproval: false } };
+        }
+        try {
+            return await tool.execute(args, ctx);
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            logger_1.logger.error('tool execution failed', { tool: name, error: msg });
+            return { ok: false, output: '', error: msg };
+        }
+    }
+}
+exports.ToolRegistry = ToolRegistry;
+//# sourceMappingURL=tool.registry.js.map

package/dist/tools/tool.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.registry.js","sourceRoot":"","sources":["../../src/tools/tool.registry.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6CAA0C;AAE1C,qDAAgD;AAGhD,MAAa,YAAY;IACN,KAAK,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEjD,QAAQ,CAAC,IAAU;QACjB,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,eAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,kBAAkB;IAClB,WAAW;QACT,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,6BAAY,CAAC,CAAC;IACvC,CAAC;IAED,yCAAyC;IACzC,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,OAAgB,EAAE,GAAgB;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QAC3D,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,WAAW,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAA+B,CAAC;QAEpD,2CAA2C;QAC3C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,IAAI,OAAO,CAAC;YACZ,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,6BAA6B;gBAC7B,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvD,eAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,GAAG,EAAE,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBACrB,eAAM,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;YAC1D,CAAC;YACD,gCAAgC;YAChC,sCAAsC;YACtC,GAAG,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACvD,eAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC;CACF;AAnED,oCAmEC"}

package/dist/tools/verify/build-check.tool.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCheckTool = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 工具：构建检查
+ */
+const zod_1 = require("zod");
+const exec_1 = require("../shell/exec");
+exports.buildCheckTool = {
+    name: 'build_check',
+    description: '执行构建检查（默认 npm run build）',
+    jsonSchema: {
+        type: 'object',
+        properties: { command: { type: 'string', description: '构建命令，默认 npm run build' } },
+    },
+    schema: zod_1.z.object({ command: zod_1.z.string().min(1).optional() }),
+    async execute(args, ctx) {
+        const cmd = (0, exec_1.sanitizeManagedCommand)(args.command, 'npm run build');
+        if (!cmd) {
+            return {
+                ok: false,
+                output: '',
+                error: '仅允许 npm/pnpm/yarn/bun 的 test 或 build 等脚本，且禁止命令注入字符（; & | ` $ 等）与危险命令',
+            };
+        }
+        const res = await (0, exec_1.runCommand)(cmd, ctx.cwd);
+        return {
+            ok: res.code === 0,
+            output: `${res.stdout}${res.stderr}`.slice(0, 4000),
+            error: res.code === 0 ? undefined : `exit code ${res.code}`,
+        };
+    },
+};
+//# sourceMappingURL=build-check.tool.js.map

package/dist/tools/verify/build-check.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-check.tool.js","sourceRoot":"","sources":["../../../src/tools/verify/build-check.tool.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAAwB;AAExB,wCAAmE;AAEtD,QAAA,cAAc,GAAS;IAClC,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,0BAA0B;IACvC,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,EAAE;KAClF;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,MAAM,GAAG,GAAG,IAAA,6BAAsB,EAAC,IAAI,CAAC,OAA6B,EAAE,eAAe,CAAC,CAAC;QACxF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,sEAAsE;aAC9E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;YAClB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACnD,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE;SAC5D,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/tools/verify/test-run.tool.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runTestsTool = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 工具：运行测试套件
+ */
+const zod_1 = require("zod");
+const exec_1 = require("../shell/exec");
+exports.runTestsTool = {
+    name: 'run_tests',
+    description: '运行项目测试套件（默认 npm test）',
+    jsonSchema: {
+        type: 'object',
+        properties: { command: { type: 'string', description: '测试命令，默认 npm test' } },
+    },
+    schema: zod_1.z.object({ command: zod_1.z.string().min(1).optional() }),
+    async execute(args, ctx) {
+        const cmd = (0, exec_1.sanitizeManagedCommand)(args.command, 'npm test');
+        if (!cmd) {
+            return {
+                ok: false,
+                output: '',
+                error: '仅允许 npm/pnpm/yarn/bun 的 test 或 build 等脚本，且禁止命令注入字符（; & | ` $ 等）与危险命令',
+            };
+        }
+        const res = await (0, exec_1.runCommand)(cmd, ctx.cwd);
+        return {
+            ok: res.code === 0,
+            output: `${res.stdout}${res.stderr}`.slice(0, 4000),
+            error: res.code === 0 ? undefined : `exit code ${res.code}`,
+        };
+    },
+};
+//# sourceMappingURL=test-run.tool.js.map

package/dist/tools/verify/test-run.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-run.tool.js","sourceRoot":"","sources":["../../../src/tools/verify/test-run.tool.ts"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH,6BAAwB;AAExB,wCAAmE;AAEtD,QAAA,YAAY,GAAS;IAChC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,uBAAuB;IACpC,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;KAC7E;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,MAAM,GAAG,GAAG,IAAA,6BAAsB,EAAC,IAAI,CAAC,OAA6B,EAAE,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,sEAAsE;aAC9E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAA,iBAAU,EAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC;YAClB,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;YACnD,KAAK,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,IAAI,EAAE;SAC5D,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/web/auth.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireToken = requireToken;
+const crypto_1 = require("crypto");
+/** 计时安全的字符串比较，避免令牌逐字节泄露的计时攻击面 */
+function safeEqual(a, b) {
+    const ab = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ab.length !== bb.length)
+        return false;
+    return (0, crypto_1.timingSafeEqual)(ab, bb);
+}
+/** 返回 Express 中间件：校验 Authorization: Bearer <token> */
+function requireToken(token) {
+    return (req, res, next) => {
+        const header = req.header('authorization') || '';
+        const m = /^Bearer\s+(.+)$/i.exec(header);
+        if (!m || !safeEqual(m[1], token)) {
+            res.status(401).json({ ok: false, error: 'unauthorized' });
+            return;
+        }
+        next();
+    };
+}
+//# sourceMappingURL=auth.js.map

package/dist/web/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/web/auth.ts"],"names":[],"mappings":";;AAmBA,oCAUC;AArBD,mCAAyC;AAEzC,iCAAiC;AACjC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/web/public/index.html

@@ -0,0 +1,39 @@
+<!DOCTYPE html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>飞虹 Code · Web 控制台</title>
+    <style>
+      :root { --brand: #c0392b; --ink: #1f2937; --muted: #6b7280; --bg: #f7f8fa; }
+      * { box-sizing: border-box; }
+      body { margin: 0; font-family: -apple-system, "Segoe UI", "PingFang SC", "Microsoft YaHei", sans-serif;
+             background: var(--bg); color: var(--ink); }
+      header { background: var(--brand); color: #fff; padding: 14px 20px; font-weight: 600; letter-spacing: .5px; }
+      main { max-width: 760px; margin: 40px auto; padding: 0 20px; }
+      .card { background: #fff; border: 1px solid #e5e7eb; border-radius: 10px; padding: 24px; }
+      h1 { font-size: 20px; margin: 0 0 12px; }
+      p { color: var(--muted); line-height: 1.7; }
+      code { background: #f1f3f5; padding: 2px 6px; border-radius: 4px; color: var(--brand); }
+      .sig { margin-top: 28px; font-size: 12px; color: #9ca3af; border-top: 1px dashed #e5e7eb; padding-top: 14px; }
+      .badge { display: inline-block; background: #e8f5e9; color: #2e7d32; border-radius: 999px;
+               padding: 2px 10px; font-size: 12px; margin-bottom: 12px; }
+    </style>
+  </head>
+  <body>
+    <header>飞虹 Code · Web 控制台</header>
+    <main>
+      <div class="card">
+        <span class="badge">M5 骨架就绪</span>
+        <h1>飞虹 Code Web 控制台（M5 建设中）</h1>
+        <p>
+          S1 服务骨架 + Bearer 令牌鉴权 + <code>GET /api/health</code> 已打通。
+          观测 API（租户 / 策略 / 审计链 / 会话 / 配额）将在 <strong>S2</strong> 接入，
+          可视化仪表盘将在 <strong>S3</strong> 填充。
+        </p>
+        <p>本页为占位页，S3 上线后由完整仪表盘替换。</p>
+        <p class="sig">晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹</p>
+      </div>
+    </main>
+  </body>
+</html>

package/dist/web/server.js

@@ -0,0 +1,60 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startWebServer = startWebServer;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * M5 Web 控制台：自包含 Express 服务骨架。
+ * S1：服务骨架 + 鉴权 + /api/health（占位；S2 扩展观测 API，S3 填充仪表盘）。
+ */
+const express_1 = __importDefault(require("express"));
+const crypto_1 = require("crypto");
+const path_1 = require("path");
+const auth_1 = require("./auth");
+const version_1 = require("../cli/version");
+const enterprise_1 = require("../enterprise");
+/**
+ * 启动 Web 控制台。
+ * - 端口：opts.port > FH_WEB_PORT > 8080
+ * - 令牌：opts.token > FH_WEB_TOKEN > 自动生成（仅本次会话有效，fail-closed）
+ */
+function startWebServer(opts = {}) {
+    const port = opts.port ?? Number(process.env.FH_WEB_PORT ?? 8080);
+    let token = opts.token ?? process.env.FH_WEB_TOKEN ?? '';
+    if (!token) {
+        token = (0, crypto_1.randomBytes)(24).toString('hex');
+        console.log(`[飞虹 Code] Web 控制台令牌已自动生成（FH_WEB_TOKEN）: ${token}`);
+    }
+    const app = (0, express_1.default)();
+    // M8 修复：限制请求体大小，防止超大 payload 触发内存耗尽（DoS 面）
+    app.use(express_1.default.json({ limit: '1mb' }));
+    // 静态仪表盘（S3 填充；S1 占位页）
+    const publicDir = (0, path_1.join)(__dirname, 'public');
+    app.use(express_1.default.static(publicDir));
+    // 鉴权：全部 /api 需 Bearer token（静态资源除外）
+    app.use('/api', (0, auth_1.requireToken)(token));
+    app.get('/api/health', (_req, res) => {
+        res.json({
+            ok: true,
+            product: version_1.PRODUCT,
+            version: version_1.VERSION,
+            signature: version_1.SIGNATURE,
+            enterprise: (0, enterprise_1.isEnterpriseEnabled)(),
+            time: new Date().toISOString(),
+        });
+    });
+    const server = app.listen(port, () => {
+        console.log(`[飞虹 Code] Web 控制台已启动: http://localhost:${port}`);
+    });
+    return {
+        port,
+        token,
+        url: `http://localhost:${port}`,
+        close: () => server.close(),
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/web/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/web/server.ts"],"names":[],"mappings":";;;;;AA+BA,wCAwCC;AAvED;;;;;;GAMG;AACH,sDAA+D;AAC/D,mCAAqC;AACrC,+BAA4B;AAC5B,iCAAsC;AACtC,4CAA6D;AAC7D,8CAAoD;AAcpD;;;;GAIG;AACH,SAAgB,cAAc,CAAC,OAAqB,EAAE;IACpD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;IAClE,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAO,GAAE,CAAC;IACtB,2CAA2C;IAC3C,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAExC,sBAAsB;IACtB,MAAM,SAAS,GAAG,IAAA,WAAI,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,iBAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IAEnC,oCAAoC;IACpC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,IAAA,mBAAY,EAAC,KAAK,CAAC,CAAC,CAAC;IAErC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACtD,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,iBAAO;YAChB,OAAO,EAAE,iBAAO;YAChB,SAAS,EAAE,mBAAS;YACpB,UAAU,EAAE,IAAA,gCAAmB,GAAE;YACjC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QACnC,OAAO,CAAC,GAAG,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,KAAK;QACL,GAAG,EAAE,oBAAoB,IAAI,EAAE;QAC/B,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;KAC5B,CAAC;AACJ,CAAC"}