feihong-code 0.2.2 → 0.5.1

package/dist/tools/web/web.tool.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webSearchTool = exports.webFetchTool = void 0;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * P3-2 实时信息检索工具（对齐 Gemini grounding）：
+ *  - web_fetch   抓取指定 URL 的文本内容（HTML 转纯文本）
+ *  - web_search  关键词搜索（DuckDuckGo HTML 接口，零依赖；可被 FH_SEARCH_ENDPOINT 覆盖）
+ *
+ * 安全约束（与沙箱网络规则联动）：
+ *  - 执行前用 checkNetworkUrl 校验目标域名（FH_NETWORK_ALLOW/DENY 生效）
+ *  - 超时（默认 15s）、输出长度截断（默认 6KB），防失控
+ *  - 全部经 AbortController 实现超时取消
+ */
+const zod_1 = require("zod");
+const sandbox_1 = require("../sandbox");
+const logger_1 = require("../../shared/logger");
+const DEFAULT_TIMEOUT = 15000;
+const MAX_OUTPUT = 6000;
+/** 提取网络规则（缺省空规则，不限制） */
+function rulesOf(ctx) {
+    return ctx.security.networkRules ?? { networkAllow: [], networkDeny: [] };
+}
+/** 带超时的 fetch：超时/网络错误抛错 */
+async function fetchWithTimeout(url, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, { signal: controller.signal, redirect: 'follow', headers: { 'User-Agent': 'fhcode/0.4 (terminal ai agent)' } });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        return await res.text();
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** HTML → 纯文本（剥离 script/style/标签，压缩空白） */
+function htmlToText(html) {
+    return html
+        .replace(/<script[\s\S]*?<\/script>/gi, ' ')
+        .replace(/<style[\s\S]*?<\/style>/gi, ' ')
+        .replace(/<[^>]+>/g, ' ')
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+/** 从 DuckDuckGo HTML 结果页提取 (标题, URL) 列表 */
+function parseDuckDuckGoResults(html, max) {
+    const out = [];
+    // 结果链接形态：<a rel="nofollow" class="result__a" href="...">标题</a>
+    const re = /<a[^>]+class="result__a"[^>]+href="([^"]+)"[^>]*>([\s\S]*?)<\/a>/gi;
+    let m;
+    while ((m = re.exec(html)) !== null && out.length < max) {
+        const href = m[1];
+        const title = htmlToText(m[2]);
+        // DuckDuckGo 结果常为重定向链接，提取真实目标
+        let real = href;
+        const ddg = /uddg=([^&]+)/.exec(href);
+        if (ddg) {
+            try {
+                real = decodeURIComponent(ddg[1]);
+            }
+            catch {
+                real = href;
+            }
+        }
+        out.push(`${title}\n  ${real}`);
+    }
+    return out;
+}
+exports.webFetchTool = {
+    name: 'web_fetch',
+    description: '抓取指定 URL 的文本内容（HTML 转纯文本，最多 6KB；目标域名受网络白名单/黑名单约束）',
+    jsonSchema: {
+        type: 'object',
+        properties: { url: { type: 'string', description: '要抓取的 http(s) URL' } },
+        required: ['url'],
+    },
+    schema: zod_1.z.object({ url: zod_1.z.string().url() }),
+    async execute(args, ctx) {
+        const { url } = args;
+        const blocked = (0, sandbox_1.checkNetworkUrl)(rulesOf(ctx), url);
+        if (blocked) {
+            logger_1.logger.warn('web_fetch blocked by network rules', { url, reason: blocked });
+            return { ok: false, output: '', error: `[网络规则拦截] ${blocked}` };
+        }
+        try {
+            const html = await fetchWithTimeout(url, DEFAULT_TIMEOUT);
+            const text = htmlToText(html);
+            if (!text)
+                return { ok: true, output: '（页面无可见文本内容）' };
+            return { ok: true, output: text.slice(0, MAX_OUTPUT) };
+        }
+        catch (e) {
+            return { ok: false, output: '', error: `web_fetch 失败: ${e instanceof Error ? e.message : String(e)}` };
+        }
+    },
+};
+exports.webSearchTool = {
+    name: 'web_search',
+    description: '实时关键词搜索（默认 DuckDuckGo；FH_SEARCH_ENDPOINT 可指定端点），返回标题与链接',
+    jsonSchema: {
+        type: 'object',
+        properties: {
+            query: { type: 'string', description: '搜索关键词' },
+            maxResults: { type: 'number', description: '返回条数，默认 5，最多 10' },
+        },
+        required: ['query'],
+    },
+    schema: zod_1.z.object({ query: zod_1.z.string().min(1), maxResults: zod_1.z.number().int().min(1).max(10).optional() }),
+    async execute(args, ctx) {
+        const { query, maxResults = 5 } = args;
+        const endpoint = process.env.FH_SEARCH_ENDPOINT || 'https://html.duckduckgo.com/html/';
+        const blocked = (0, sandbox_1.checkNetworkUrl)(rulesOf(ctx), endpoint);
+        if (blocked) {
+            logger_1.logger.warn('web_search blocked by network rules', { endpoint, reason: blocked });
+            return { ok: false, output: '', error: `[网络规则拦截] ${blocked}` };
+        }
+        try {
+            const url = `${endpoint}?q=${encodeURIComponent(query)}`;
+            const html = await fetchWithTimeout(url, DEFAULT_TIMEOUT);
+            const results = parseDuckDuckGoResults(html, maxResults);
+            if (results.length === 0)
+                return { ok: true, output: '（无搜索结果或页面结构不匹配）' };
+            return { ok: true, output: `搜索「${query}」结果:\n` + results.join('\n') };
+        }
+        catch (e) {
+            return { ok: false, output: '', error: `web_search 失败: ${e instanceof Error ? e.message : String(e)}` };
+        }
+    },
+};
+//# sourceMappingURL=web.tool.js.map

package/dist/tools/web/web.tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"web.tool.js","sourceRoot":"","sources":["../../../src/tools/web/web.tool.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;GAYG;AACH,6BAAwB;AAExB,wCAAgE;AAChE,gDAA6C;AAE7C,MAAM,eAAe,GAAG,KAAK,CAAC;AAC9B,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,wBAAwB;AACxB,SAAS,OAAO,CAAC,GAAgB;IAC/B,OAAO,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,2BAA2B;AAC3B,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,SAAiB;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,gCAAgC,EAAE,EAAE,CAAC,CAAC;QAC7I,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,0CAA0C;AAC1C,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC;SAC3C,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC;SACzC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,2CAA2C;AAC3C,SAAS,sBAAsB,CAAC,IAAY,EAAE,GAAW;IACvD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,+DAA+D;IAC/D,MAAM,EAAE,GAAG,oEAAoE,CAAC;IAChF,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACxD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,8BAA8B;QAC9B,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC;gBACH,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEY,QAAA,YAAY,GAAS;IAChC,IAAI,EAAE,WAAW;IACjB,WAAW,EAAE,mDAAmD;IAChE,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,kBAAkB,EAAE,EAAE;QACxE,QAAQ,EAAE,CAAC,KAAK,CAAC;KAClB;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;IAC3C,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAuB,CAAC;QACxC,MAAM,OAAO,GAAG,IAAA,yBAAe,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,OAAO,EAAE,CAAC;YACZ,eAAM,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,OAAO,EAAE,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;YACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;QACzD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,iBAAiB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACzG,CAAC;IACH,CAAC;CACF,CAAC;AAEW,QAAA,aAAa,GAAS;IACjC,IAAI,EAAE,YAAY;IAClB,WAAW,EAAE,yDAAyD;IACtE,UAAU,EAAE;QACV,IAAI,EAAE,QAAQ;QACd,UAAU,EAAE;YACV,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE;YAC/C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE;SAC/D;QACD,QAAQ,EAAE,CAAC,OAAO,CAAC;KACpB;IACD,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACtG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAgB;QAClC,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,CAAC,EAAE,GAAG,IAA8C,CAAC;QACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,mCAAmC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAA,yBAAe,EAAC,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACxD,IAAI,OAAO,EAAE,CAAC;YACZ,eAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAClF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,OAAO,EAAE,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,QAAQ,MAAM,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;YACzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,KAAK,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC1G,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/web/auth.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionStore = void 0;
 exports.requireToken = requireToken;
 const crypto_1 = require("crypto");
 /** 计时安全的字符串比较，避免令牌逐字节泄露的计时攻击面 */
@@ -10,16 +11,54 @@ function safeEqual(a, b) {
         return false;
     return (0, crypto_1.timingSafeEqual)(ab, bb);
 }
+/**
+ * 内存会话存储（进程内）。
+ * Web 控制台当前为本地单用户/小团队使用，会话不落盘；
+ * 若后续需要跨进程共享，可迁移到 Redis/数据库。
+ */
+class SessionStore {
+    sessions = new Map();
+    create(phone) {
+        const token = (0, crypto_1.randomBytes)(32).toString('hex');
+        const session = { phone, token, createdAt: new Date().toISOString() };
+        this.sessions.set(token, session);
+        return token;
+    }
+    has(token) {
+        return this.sessions.has(token);
+    }
+    get(token) {
+        return this.sessions.get(token);
+    }
+    revoke(token) {
+        return this.sessions.delete(token);
+    }
+}
+exports.SessionStore = SessionStore;
 /** 返回 Express 中间件：校验 Authorization: Bearer <token> */
-function requireToken(token) {
+function requireToken(masterToken, sessions) {
     return (req, res, next) => {
         const header = req.header('authorization') || '';
         const m = /^Bearer\s+(.+)$/i.exec(header);
-        if (!m || !safeEqual(m[1], token)) {
+        if (!m) {
             res.status(401).json({ ok: false, error: 'unauthorized' });
             return;
         }
-        next();
+        const token = m[1];
+        if (safeEqual(token, masterToken)) {
+            next();
+            return;
+        }
+        if (sessions?.has(token)) {
+            const session = sessions.get(token);
+            if (session) {
+                // 通过索引签名附加用户信息，供 /api/auth/me 等后续接口读取
+                req.user = session;
+            }
+            next();
+            return;
+        }
+        res.status(401).json({ ok: false, error: 'unauthorized' });
     };
 }
 //# sourceMappingURL=auth.js.map

package/dist/web/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/web/auth.ts"],"names":[],"mappings":";;AAmBA,oCAUC;AArBD,mCAAyC;AAEzC,iCAAiC;AACjC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,sDAAsD;AACtD,SAAgB,YAAY,CAAC,KAAa;IACxC,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/web/auth.ts"],"names":[],"mappings":";;;AAwDA,oCAwBC;AAtED,mCAAsD;AAEtD,iCAAiC;AACjC,SAAS,SAAS,CAAC,CAAS,EAAE,CAAS;IACrC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,IAAA,wBAAe,EAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AASD;;;;GAIG;AACH,MAAa,YAAY;IACN,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAEvD,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAY,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AArBD,oCAqBC;AAED,sDAAsD;AACtD,SAAgB,YAAY,CAAC,WAAmB,EAAE,QAAuB;IACvE,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACjD,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,SAAS,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAClC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,OAAO,EAAE,CAAC;gBACZ,sCAAsC;gBACrC,GAAoC,CAAC,IAAI,GAAG,OAAO,CAAC;YACvD,CAAC;YACD,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC;AACJ,CAAC"}

package/dist/web/channels.js

@@ -0,0 +1,171 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageChannels = void 0;
+exports.telegramConfig = telegramConfig;
+exports.wecomKeys = wecomKeys;
+exports.allowedChannels = allowedChannels;
+exports.isChannelAllowed = isChannelAllowed;
+exports.verifyHmacSignature = verifyHmacSignature;
+exports.verifyWecomSignature = verifyWecomSignature;
+exports.formatTaskMessage = formatTaskMessage;
+/**
+ * 飞虹 Code (Muse Code 参照复刻)
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * P5-6/P6-O6 消息渠道（对齐 OpenClaw 的"多渠道消息接入"，此处作为调度通知出口）：
+ *  - Telegram 机器人：FH_CHANNEL_TELEGRAM_BOT_TOKEN + FH_CHANNEL_TELEGRAM_CHAT_ID
+ *  - 企业微信群机器人：FH_CHANNEL_WECOM_KEY（逗号分隔可多个）
+ *  - 任务状态变化时把紧凑消息推送到已启用渠道
+ * O6 安全前置：
+ *  - 出站白名单 FH_CHANNEL_ALLOW（逗号分隔，缺省全部放行；显式配置后仅白名单渠道可发）
+ *  - 入站签名校验工具（供 M3 入站 webhook 复用）：verifyHmacSignature（HMAC-SHA256）、
+ *    verifyWecomSignature（企微回调 SHA1 排序校验）
+ *
+ * 设计：
+ *  - 零依赖（全局 fetch + AbortController 超时），fire-and-forget 容错
+ *  - 未配置渠道 = 无操作（保持离线/内网无感）
+ *  - 文本消息统一由 formatTaskMessage 生成，渠道只负责投递
+ */
+const crypto_1 = require("crypto");
+const logger_1 = require("../shared/logger");
+/** 环境变量开关 */
+function telegramConfig() {
+    const token = process.env.FH_CHANNEL_TELEGRAM_BOT_TOKEN?.trim() || '';
+    const chatId = process.env.FH_CHANNEL_TELEGRAM_CHAT_ID?.trim() || '';
+    return token && chatId ? { token, chatId } : null;
+}
+function wecomKeys() {
+    return (process.env.FH_CHANNEL_WECOM_KEY || '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+/** O6：出站渠道白名单（FH_CHANNEL_ALLOW 逗号分隔；空 = 全部放行） */
+function allowedChannels() {
+    return (process.env.FH_CHANNEL_ALLOW || '')
+        .split(',')
+        .map((s) => s.trim().toLowerCase())
+        .filter(Boolean);
+}
+function isChannelAllowed(channel) {
+    const allow = allowedChannels();
+    if (allow.length === 0)
+        return true;
+    return allow.includes(channel.toLowerCase());
+}
+/**
+ * O6：HMAC-SHA256 签名校验（入站 webhook 防伪造）。
+ * 调用方约定签名头格式，如 `X-Fhcode-Signature: sha256=<hex>`。
+ */
+function verifyHmacSignature(secret, payload, signatureHex) {
+    if (!secret || !signatureHex)
+        return false;
+    const expected = (0, crypto_1.createHmac)('sha256', secret).update(payload).digest('hex');
+    const got = signatureHex.replace(/^sha256=/i, '').toLowerCase();
+    if (expected.length !== got.length)
+        return false;
+    try {
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(got, 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * O6：企业微信回调签名校验（SHA1 排序拼接 token/timestamp/nonce/echoStr）。
+ * 按企微规范：signature = sha1(sort([token, timestamp, nonce, echoStr]).join(''))。
+ */
+function verifyWecomSignature(token, timestamp, nonce, echoStr, signature) {
+    if (!token || !signature)
+        return false;
+    const sorted = [token, timestamp, nonce, echoStr].sort().join('');
+    const expected = (0, crypto_1.createHash)('sha1').update(sorted).digest('hex');
+    if (expected.length !== signature.length)
+        return false;
+    try {
+        return (0, crypto_1.timingSafeEqual)(Buffer.from(expected, 'hex'), Buffer.from(signature.toLowerCase(), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+/** 生成任务状态通知文本（渠道无关） */
+function formatTaskMessage(record, status) {
+    const emoji = { queued: '🕐', running: '⚙️', done: '✅', failed: '❌' };
+    const r = record.result;
+    const lines = [
+        `${emoji[status] ?? 'ℹ️'} [fhcode] 任务状态: ${status}`,
+        `📋 目标: ${record.goal.slice(0, 120)}`,
+        `🆔 任务: ${record.id.slice(0, 8)}`,
+    ];
+    if (r) {
+        lines.push(`⚙️ 迭代: ${r.iterations} · 成本: $${r.costUsd.toFixed(6)}`);
+    }
+    if (record.error)
+        lines.push(`⚠️ 错误: ${record.error.slice(0, 200)}`);
+    return lines.join('\n');
+}
+async function postJson(url, body, timeoutMs = 10000) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** 消息渠道聚合器：按环境变量启用 Telegram / 企业微信，投递失败仅告警 */
+class MessageChannels {
+    /** 是否配置了任何渠道 */
+    get enabled() {
+        return !!telegramConfig() || wecomKeys().length > 0;
+    }
+    /** 向所有已启用渠道推送任务状态（受 FH_CHANNEL_ALLOW 白名单约束） */
+    async notify(record, status) {
+        if (!this.enabled)
+            return;
+        const text = formatTaskMessage(record, status);
+        const tg = telegramConfig();
+        if (tg && isChannelAllowed('telegram')) {
+            await this.safe('telegram', async () => {
+                await postJson(`https://api.telegram.org/bot${tg.token}/sendMessage`, {
+                    chat_id: tg.chatId,
+                    text,
+                });
+            });
+        }
+        const keys = wecomKeys();
+        for (const key of keys) {
+            if (!isChannelAllowed('wecom'))
+                break;
+            await this.safe('wecom', async () => {
+                await postJson(`https://qyapi.weixin.qq.com/cgi-bin/webhook/send?key=${key}`, {
+                    msgtype: 'text',
+                    text: { content: text },
+                });
+            });
+        }
+    }
+    /** 单渠道投递容错 */
+    async safe(name, fn) {
+        try {
+            await fn();
+        }
+        catch (e) {
+            logger_1.logger.warn('message channel delivery failed', {
+                channel: name,
+                error: e instanceof Error ? e.message : String(e),
+            });
+        }
+    }
+}
+exports.MessageChannels = MessageChannels;
+//# sourceMappingURL=channels.js.map

package/dist/web/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/web/channels.ts"],"names":[],"mappings":";;;AAuBA,wCAIC;AAED,8BAKC;AAGD,0CAKC;AAED,4CAIC;AAMD,kDAUC;AAMD,oDAUC;AAGD,8CAaC;AAhGD;;;;;;;;;;;;;;;;;GAiBG;AACH,mCAAiE;AACjE,6CAA0C;AAG1C,aAAa;AACb,SAAgB,cAAc;IAC5B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACtE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrE,OAAO,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,SAAgB,SAAS;IACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;SAC5C,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,iDAAiD;AACjD,SAAgB,eAAe;IAC7B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC;SACxC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAgB,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAc,EAAE,OAAwB,EAAE,YAAqB;IACjG,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,KAAa,EAAE,SAAiB,EAAE,KAAa,EAAE,OAAe,EAAE,SAAiB;IACtH,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,IAAA,wBAAe,EAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uBAAuB;AACvB,SAAgB,iBAAiB,CAAC,MAAkB,EAAE,MAAc;IAClE,MAAM,KAAK,GAA2B,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IAC9F,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACxB,MAAM,KAAK,GAAG;QACZ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,IAAI,mBAAmB,MAAM,EAAE;QACnD,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;QACrC,UAAU,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;KAClC,CAAC;IACF,IAAI,CAAC,EAAE,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,UAAU,WAAW,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAa,EAAE,SAAS,GAAG,KAAK;IACnE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,8CAA8C;AAC9C,MAAa,eAAe;IAC1B,gBAAgB;IAChB,IAAI,OAAO;QACT,OAAO,CAAC,CAAC,cAAc,EAAE,IAAI,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,+CAA+C;IAC/C,KAAK,CAAC,MAAM,CAAC,MAAkB,EAAE,MAAc;QAC7C,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO;QAC1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE/C,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;QAC5B,IAAI,EAAE,IAAI,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,IAAI,EAAE;gBACrC,MAAM,QAAQ,CAAC,+BAA+B,EAAE,CAAC,KAAK,cAAc,EAAE;oBACpE,OAAO,EAAE,EAAE,CAAC,MAAM;oBAClB,IAAI;iBACL,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;gBAAE,MAAM;YACtC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClC,MAAM,QAAQ,CAAC,wDAAwD,GAAG,EAAE,EAAE;oBAC5E,OAAO,EAAE,MAAM;oBACf,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;iBACxB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,cAAc;IACN,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,EAAuB;QACtD,IAAI,CAAC;YACH,MAAM,EAAE,EAAE,CAAC;QACb,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,eAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC7C,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AA5CD,0CA4CC"}