feihong-code 7.6.0 → 8.0.0

package/dist/tools/docker-sandbox.js

@@ -0,0 +1,212 @@
+"use strict";
+/**
+ * 飞虹 Code — Docker 沙盒执行层（v8.0）
+ * 晋江市飞虹智科技企业管理有限公司 · 飞扬企源研发中心 · 负责人：吴赐虹
+ *
+ * 对齐 sandbox.ts 的 'container' 沙箱模式：
+ *  - shell 命令在 Docker 容器内执行（docker run 挂载工作区）
+ *  - 镜像由 FH_SANDBOX_IMAGE 配置，默认 node:22-alpine
+ *  - 网络受限：默认禁用（--network none），可 FH_SANDBOX_NETWORK=true 开启
+ *  - 资源受限：内存/CPU 上限可配置
+ *  - 只读挂载模式可选（防止容器内修改宿主文件）
+ *
+ * 设计：
+ *  - 惰性拉取镜像（首次运行时 docker pull）
+ *  - 每次执行创建一次性容器（--rm），执行完自动销毁
+ *  - 超时强杀（docker kill）
+ *  - 不依赖 dockerode（减少依赖），用子进程调用 docker CLI
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerSandbox = void 0;
+exports.getDockerSandbox = getDockerSandbox;
+exports.resetDockerSandbox = resetDockerSandbox;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const DEFAULT_OPTIONS = {
+    image: 'node:22-alpine',
+    workspaceDir: process.cwd(),
+    mountPoint: '/workspace',
+    memoryLimit: '512m',
+    cpuLimit: '1',
+    networkEnabled: false,
+    readOnly: true,
+    timeoutMs: 60000,
+};
+class DockerSandbox {
+    options;
+    debugEnabled;
+    imageReady = false;
+    constructor(options = {}) {
+        this.options = { ...DEFAULT_OPTIONS, ...options };
+        this.debugEnabled = options.debug || false;
+        if (process.env.FH_SANDBOX_IMAGE)
+            this.options.image = process.env.FH_SANDBOX_IMAGE;
+        if (process.env.FH_SANDBOX_NETWORK === 'true')
+            this.options.networkEnabled = true;
+        if (process.env.FH_SANDBOX_READONLY === 'false')
+            this.options.readOnly = false;
+        // 确保工作区目录存在
+        if (!(0, fs_1.existsSync)(this.options.workspaceDir)) {
+            (0, fs_1.mkdirSync)(this.options.workspaceDir, { recursive: true });
+        }
+    }
+    debug(...args) {
+        if (this.debugEnabled)
+            console.log('[DockerSandbox]', ...args);
+    }
+    /** 检查 Docker CLI 与 daemon 是否均可用（docker info 而非 --version，确保 daemon 在运行） */
+    static async isDockerAvailable() {
+        try {
+            const { stdout } = await execFileAsync('docker', ['info', '--format', '{{.ServerVersion}}']);
+            return /^\d+\.\d+\.\d+/.test(stdout.trim());
+        }
+        catch {
+            return false;
+        }
+    }
+    /** 确保镜像已存在（首次执行自动拉取） */
+    async ensureImage() {
+        if (this.imageReady)
+            return;
+        this.debug(`检查镜像 ${this.options.image}...`);
+        try {
+            const { stdout } = await execFileAsync('docker', ['image', 'inspect', this.options.image]);
+            if (stdout) {
+                this.imageReady = true;
+                return;
+            }
+        }
+        catch { /* 镜像不存在，需要拉取 */ }
+        this.debug(`拉取镜像 ${this.options.image}...`);
+        await new Promise((resolve, reject) => {
+            const proc = (0, child_process_1.spawn)('docker', ['pull', this.options.image], { stdio: this.debugEnabled ? 'inherit' : 'ignore' });
+            proc.on('close', (code) => {
+                if (code === 0) {
+                    this.imageReady = true;
+                    resolve();
+                }
+                else
+                    reject(new Error(`镜像拉取失败（exit ${code}）: ${this.options.image}`));
+            });
+            proc.on('error', reject);
+        });
+    }
+    /** 在 Docker 容器中执行命令 */
+    async execute(command, options = {}) {
+        const start = Date.now();
+        const dockerAvailable = await DockerSandbox.isDockerAvailable();
+        if (!dockerAvailable) {
+            return {
+                success: false, exitCode: -1, stdout: '', stderr: 'Docker 不可用：请安装并启动 Docker Desktop',
+                timedOut: false, durationMs: Date.now() - start,
+            };
+        }
+        try {
+            await this.ensureImage();
+        }
+        catch (e) {
+            return {
+                success: false, exitCode: -1, stdout: '',
+                stderr: `镜像准备失败: ${e instanceof Error ? e.message : String(e)}`,
+                timedOut: false, durationMs: Date.now() - start,
+            };
+        }
+        // 构造 docker run 参数
+        const dockerArgs = ['run', '--rm'];
+        dockerArgs.push('--name', `fh-sandbox-${Date.now()}`);
+        dockerArgs.push('-m', this.options.memoryLimit);
+        dockerArgs.push('--cpus', this.options.cpuLimit);
+        dockerArgs.push('--network', this.options.networkEnabled ? 'bridge' : 'none');
+        dockerArgs.push('--workdir', this.options.mountPoint);
+        dockerArgs.push('--mount', `type=bind,source=${this.options.workspaceDir},target=${this.options.mountPoint},readonly=${this.options.readOnly}`);
+        if (options.workdir)
+            dockerArgs.push('--workdir', options.workdir);
+        // 环境变量
+        for (const [k, v] of Object.entries(options.env || {})) {
+            dockerArgs.push('-e', `${k}=${v}`);
+        }
+        // 危险命令拒绝列表（纵深防御，即使容器内也拦截）
+        const DANGEROUS_PATTERNS = [
+            /rm\s+-rf\s+\/(?!workspace)/, // 删除根目录（排除 workspace）
+            /mkfs/, // 格式化
+            /dd\s+if=.*of=\/dev/, // 写入块设备
+            /:\(\)\s*\{\s*:\|:&\s*\};:/, // fork 炸弹
+        ];
+        for (const pat of DANGEROUS_PATTERNS) {
+            if (pat.test(command)) {
+                return {
+                    success: false, exitCode: -1, stdout: '',
+                    stderr: `危险命令被容器沙盒拦截: ${pat}`,
+                    timedOut: false, durationMs: Date.now() - start,
+                };
+            }
+        }
+        // 容器内执行命令（用 sh -c）
+        dockerArgs.push(this.options.image);
+        dockerArgs.push('/bin/sh', '-c', command);
+        this.debug('docker run 参数:', dockerArgs.join(' '));
+        return new Promise((resolve) => {
+            const proc = (0, child_process_1.spawn)('docker', dockerArgs, { stdio: ['ignore', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            let timedOut = false;
+            proc.stdout.on('data', (d) => { stdout += d.toString(); });
+            proc.stderr.on('data', (d) => { stderr += d.toString(); });
+            const timer = setTimeout(() => {
+                timedOut = true;
+                // 超时强杀：通过容器名 kill
+                const containerName = dockerArgs[dockerArgs.indexOf('--name') + 1];
+                (0, child_process_1.execFile)('docker', ['kill', containerName], () => { });
+                proc.kill('SIGKILL');
+            }, this.options.timeoutMs);
+            proc.on('close', (code) => {
+                clearTimeout(timer);
+                resolve({
+                    success: code === 0,
+                    exitCode: code ?? -1,
+                    stdout,
+                    stderr,
+                    timedOut,
+                    durationMs: Date.now() - start,
+                });
+            });
+            proc.on('error', (e) => {
+                clearTimeout(timer);
+                resolve({
+                    success: false, exitCode: -1, stdout, stderr: `执行失败: ${e.message}`,
+                    timedOut, durationMs: Date.now() - start,
+                });
+            });
+        });
+    }
+    /** 便捷：在容器中运行脚本文件 */
+    async runScript(scriptPath, options = {}) {
+        const absPath = (0, path_1.join)(this.options.workspaceDir, scriptPath);
+        if (!(0, fs_1.existsSync)(absPath)) {
+            return {
+                success: false, exitCode: -1, stdout: '', stderr: `脚本不存在: ${scriptPath}`,
+                timedOut: false, durationMs: 0,
+            };
+        }
+        return this.execute(`node ${this.options.mountPoint}/${scriptPath}`, options);
+    }
+    /** 获取沙盒配置信息 */
+    getConfig() {
+        return { ...this.options };
+    }
+}
+exports.DockerSandbox = DockerSandbox;
+/** 全局单例 */
+let sandboxInstance = null;
+function getDockerSandbox(options) {
+    if (!sandboxInstance)
+        sandboxInstance = new DockerSandbox(options);
+    return sandboxInstance;
+}
+function resetDockerSandbox() {
+    sandboxInstance = null;
+}
+//# sourceMappingURL=docker-sandbox.js.map

package/dist/tools/docker-sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-sandbox.js","sourceRoot":"","sources":["../../src/tools/docker-sandbox.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;GAgBG;;;AAmOH,4CAGC;AAED,gDAEC;AAxOD,iDAAgD;AAChD,+BAAiC;AACjC,2BAA2C;AAC3C,+BAA4B;AAE5B,MAAM,aAAa,GAAG,IAAA,gBAAS,EAAC,wBAAQ,CAAC,CAAC;AAiC1C,MAAM,eAAe,GAAkD;IACrE,KAAK,EAAE,gBAAgB;IACvB,YAAY,EAAE,OAAO,CAAC,GAAG,EAAE;IAC3B,UAAU,EAAE,YAAY;IACxB,WAAW,EAAE,MAAM;IACnB,QAAQ,EAAE,GAAG;IACb,cAAc,EAAE,KAAK;IACrB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF,MAAa,aAAa;IAChB,OAAO,CAAgD;IACvD,YAAY,CAAU;IACtB,UAAU,GAAG,KAAK,CAAC;IAE3B,YAAY,UAAgC,EAAE;QAC5C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,eAAe,EAAE,GAAG,OAAO,EAAE,CAAC;QAClD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;QAE3C,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACpF,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;QAClF,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC;QAE/E,YAAY;QACZ,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YAC3C,IAAA,cAAS,EAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,GAAG,IAAe;QAC9B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,GAAG,IAAI,CAAC,CAAC;IACjE,CAAC;IAED,2EAA2E;IAC3E,MAAM,CAAC,KAAK,CAAC,iBAAiB;QAC5B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC,CAAC;YAC7F,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO;QAE5B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;gBACvB,OAAO;YACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAE5B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAChH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;oBAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;;oBACjD,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,KAAK,CAAC,OAAO,CAAC,OAAe,EAAE,UAA8D,EAAE;QAC7F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,eAAe,GAAG,MAAM,aAAa,CAAC,iBAAiB,EAAE,CAAC;QAChE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,kCAAkC;gBACpF,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAChD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO;gBACL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,EAAE,WAAW,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;gBAC/D,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAChD,CAAC;QACJ,CAAC;QAED,mBAAmB;QACnB,MAAM,UAAU,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC7C,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAChD,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC9E,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,IAAI,CAAC,OAAO,CAAC,YAAY,WAAW,IAAI,CAAC,OAAO,CAAC,UAAU,aAAa,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QAEhJ,IAAI,OAAO,CAAC,OAAO;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAEnE,OAAO;QACP,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,0BAA0B;QAC1B,MAAM,kBAAkB,GAAG;YACzB,4BAA4B,EAAO,sBAAsB;YACzD,MAAM,EAA8B,MAAM;YAC1C,oBAAoB,EAAgB,QAAQ;YAC5C,2BAA2B,EAAS,UAAU;SAC/C,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACtB,OAAO;oBACL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBACxC,MAAM,EAAE,gBAAgB,GAAG,EAAE;oBAC7B,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAChD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,mBAAmB;QACnB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnD,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAC/C,MAAM,IAAI,GAAG,IAAA,qBAAK,EAAC,QAAQ,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAChF,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3D,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,kBAAkB;gBAClB,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBACnE,IAAA,wBAAQ,EAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACtD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACvB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAE3B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC;oBACN,OAAO,EAAE,IAAI,KAAK,CAAC;oBACnB,QAAQ,EAAE,IAAI,IAAI,CAAC,CAAC;oBACpB,MAAM;oBACN,MAAM;oBACN,QAAQ;oBACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBAC/B,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;gBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC;oBACN,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE;oBAClE,QAAQ,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;iBACzC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,oBAAoB;IACpB,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,UAA8D,EAAE;QAClG,MAAM,OAAO,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAA,eAAU,EAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,UAAU,EAAE;gBACxE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,UAAU,EAAE,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;IAED,eAAe;IACf,SAAS;QACP,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;IAC7B,CAAC;CACF;AA3KD,sCA2KC;AAED,WAAW;AACX,IAAI,eAAe,GAAyB,IAAI,CAAC;AAEjD,SAAgB,gBAAgB,CAAC,OAA8B;IAC7D,IAAI,CAAC,eAAe;QAAE,eAAe,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;IACnE,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,SAAgB,kBAAkB;IAChC,eAAe,GAAG,IAAI,CAAC;AACzB,CAAC"}

package/dist/web/public/favicon.svg

@@ -0,0 +1,11 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 64 64" width="64" height="64">
+  <defs>
+    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+      <stop offset="0%" style="stop-color:#4F46E5;stop-opacity:1" />
+      <stop offset="100%" style="stop-color:#7C3AED;stop-opacity:1" />
+    </linearGradient>
+  </defs>
+  <rect width="64" height="64" rx="12" fill="url(#bg)"/>
+  <path d="M20 22 L20 42 L28 42 L28 30 L36 42 L44 42 L44 22 L36 22 L36 34 L28 22 Z" fill="white"/>
+  <circle cx="48" cy="18" r="4" fill="#10B981"/>
+</svg>

package/dist/web/public/index.html

@@ -4,7 +4,10 @@
   <meta charset="UTF-8" />
   <meta name="viewport" content="width=device-width, initial-scale=1.0" />
   <title data-i18n="app.title_login">飞虹 Code 控制台 / fhcode Console</title>
-  <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><rect width='100' height='100' rx='20' fill='%231a1a2e'/><text x='50' y='68' font-size='52' font-family='monospace' font-weight='bold' fill='%2300d4aa' text-anchor='middle'>&lt;/&gt;</text></svg>" />
+  <link rel="icon" type="image/svg+xml" href="favicon.svg" />
+  <link rel="apple-touch-icon" href="favicon.svg" />
+  <meta name="theme-color" content="#4F46E5" />
+  <meta name="description" content="飞虹 Code — 终端 AI 编程智能体" />
     <link rel="stylesheet" href="css/style.css">
   <!-- Monaco Editor AMD Loader（代码编辑器内核，VSCode 同款） -->
   <script src="vendor/monaco/vs/loader.js"></script>

package/dist/web/public/robots.txt

@@ -0,0 +1,14 @@
+# robots.txt for 飞虹 Code (feihong-code)
+# https://github.com/feihong-code/feihong-code
+
+User-agent: *
+Allow: /
+Disallow: /api/
+Disallow: /admin/
+Disallow: /dashboard/
+
+# Sitemap
+# Sitemap: https://feihong-code.com/sitemap.xml
+
+# Crawl-delay
+Crawl-delay: 1

package/dist/web/server.js

@@ -85,6 +85,9 @@ const wechat_bridge_1 = require("../integrations/wechat-bridge");
 const feishu_bridge_1 = require("../integrations/feishu-bridge");
 const yuanbao_bridge_1 = require("../integrations/yuanbao-bridge");
 const collaboration_1 = require("../integrations/collaboration");
+// v8.0：SQLite 数据存储 + Honcho 云端记忆（本地部署）
+const sqlite_store_1 = require("../shared/sqlite-store");
+const honcho_store_1 = require("../memory/honcho-store");
 /**
  * 启动 Web 控制台。
  * - 端口：opts.port > FH_WEB_PORT > 8080
@@ -160,6 +163,21 @@ function startWebServer(opts = {}) {
     const yuanbaoConfig = (0, yuanbao_bridge_1.initYuanbaoBridge)();
     // 公开健康检查（仅暴露版本/状态等观测信息，无敏感数据）
     app.get('/api/health', (_req, res) => {
+        let storage = null;
+        let honcho = null;
+        try {
+            storage = (0, sqlite_store_1.getStore)().health();
+        }
+        catch (e) {
+            storage = { ok: false, backend: 'error', dbFile: '' };
+        }
+        try {
+            const h = (0, honcho_store_1.getHonchoStore)().health();
+            honcho = { ok: h.ok, backend: h.backend };
+        }
+        catch {
+            honcho = { ok: false, backend: 'unavailable' };
+        }
         res.json({
             ok: true,
             product: version_1.PRODUCT,
@@ -170,6 +188,9 @@ function startWebServer(opts = {}) {
             wechat: (0, wechat_bridge_1.isWechatEnabled)(wechatConfig) ? wechatConfig.mode : 'disabled',
             feishu: (0, feishu_bridge_1.isFeishuEnabled)(feishuConfig) ? 'enabled' : 'disabled',
             yuanbao: (0, yuanbao_bridge_1.isYuanbaoEnabled)(yuanbaoConfig) ? 'enabled' : 'disabled',
+            // v8.0：SQLite 数据存储 + Honcho 云端记忆状态
+            storage,
+            honcho,
             time: new Date().toISOString(),
         });
     });
@@ -323,6 +344,55 @@ function startWebServer(opts = {}) {
         const history = (0, auto_summarize_1.getSummaryHistory)(memoryConfig, limit);
         res.json({ ok: true, history });
     });
+    // ===== v8.0：SQLite 数据存储 + Honcho 云端记忆 API =====
+    app.get('/api/storage/stats', (_req, res) => {
+        try {
+            const stats = (0, sqlite_store_1.getStore)().stats();
+            res.json({ ok: true, ...stats });
+        }
+        catch (e) {
+            res.status(500).json({ ok: false, error: e.message });
+        }
+    });
+    app.get('/api/honcho/context', (_req, res) => {
+        try {
+            const honcho = (0, honcho_store_1.getHonchoStore)();
+            res.json({
+                ok: true,
+                profile: honcho.getUserProfile(),
+                memories: honcho.listMemories(10),
+                contextPrompt: honcho.buildContextPrompt(),
+            });
+        }
+        catch (e) {
+            res.status(500).json({ ok: false, error: e.message });
+        }
+    });
+    app.post('/api/honcho/remember', (req, res) => {
+        try {
+            const body = (req.body || {});
+            if (!body.content) {
+                res.status(400).json({ ok: false, error: 'content required' });
+                return;
+            }
+            (0, honcho_store_1.getHonchoStore)().rememberFact(body.content, body.importance);
+            res.json({ ok: true });
+        }
+        catch (e) {
+            res.status(500).json({ ok: false, error: e.message });
+        }
+    });
+    app.get('/api/honcho/recall', (req, res) => {
+        try {
+            const q = typeof req.query.q === 'string' ? req.query.q : '';
+            const limit = typeof req.query.limit === 'string' ? parseInt(req.query.limit) || 5 : 5;
+            const result = (0, honcho_store_1.getHonchoStore)().recall(q, limit);
+            res.json({ ok: true, ...result });
+        }
+        catch (e) {
+            res.status(500).json({ ok: false, error: e.message });
+        }
+    });
     app.post('/api/auth/clear-first-login', (req, res) => {
         const header = req.header('authorization') || '';
         const m = /^Bearer\s+(.+)$/i.exec(header);