gaoding-cli 1.0.0-alpha.10

package/dist/src/features/update/update-service.js

@@ -0,0 +1,194 @@
+import { spawn } from "node:child_process";
+import { realpathSync } from "node:fs";
+import { resolve } from "node:path";
+import { gt, valid } from "semver";
+import { syncBundledSkills, verifyBundledSkills } from "../skill/installer.js";
+const REGISTRY_URL = "https://registry.npmjs.org/gaoding-cli";
+export class UpdateError extends Error {
+    code;
+    nextSteps;
+    constructor(code, message, nextSteps) {
+        super(message);
+        this.code = code;
+        this.nextSteps = nextSteps;
+        this.name = "UpdateError";
+    }
+}
+export function detectInstallSource(input) {
+    const binaryPath = normalizePath(input.binaryPath);
+    const realBinaryPath = normalizePath(input.realBinaryPath);
+    const packageRoot = normalizePath(input.packageRoot);
+    const cwd = normalizePath(resolve(input.cwd));
+    const userAgent = input.env.npm_config_user_agent ?? "";
+    const npmExecPath = normalizePath(input.env.npm_execpath ?? "");
+    if (userAgent.startsWith("yarn/") || npmExecPath.includes("/yarn/")) {
+        return unsupported("Yarn 安装不支持自动更新");
+    }
+    if (containsTemporaryRunner(binaryPath) || containsTemporaryRunner(packageRoot)) {
+        return unsupported("临时运行方式不支持自动更新");
+    }
+    if (binaryPath.includes("/node_modules/.bin/")
+        || packageRoot.startsWith(`${cwd}/node_modules/`)) {
+        return unsupported("项目依赖不支持自动更新");
+    }
+    if (!isWithin(realBinaryPath, packageRoot)) {
+        return unsupported("CLI binary 与 package 不匹配");
+    }
+    if (/\/global\/[^/]+\/\.pnpm\/gaoding-cli@[^/]+\/node_modules\/gaoding-cli$/u
+        .test(packageRoot)
+        || /\/v\d+\/[0-9a-f]+-[0-9a-f]+-[0-9a-f]{16}\/node_modules\/gaoding-cli$/u
+            .test(packageRoot)
+        || /\/v\d+\/[0-9a-f]+-[0-9a-f]+-[0-9a-f]{16}\/node_modules\/gaoding-cli\/dist\/bin\/gd-cli\.js$/u
+            .test(binaryPath)) {
+        return { kind: "global", manager: "pnpm", packageRoot: input.packageRoot };
+    }
+    if (packageRoot.endsWith("/lib/node_modules/gaoding-cli")
+        || packageRoot.endsWith("/npm/node_modules/gaoding-cli")) {
+        return { kind: "global", manager: "npm", packageRoot: input.packageRoot };
+    }
+    return unsupported("无法确认 npm 或 pnpm 全局安装");
+}
+export function createUpdateService(options) {
+    const fetchPackage = options.fetch ?? globalThis.fetch;
+    const runProcess = options.runProcess ?? spawnProcess;
+    const syncSkills = options.syncSkills ?? syncBundledSkills;
+    const verifySkills = options.verifySkills ?? verifyBundledSkills;
+    const env = options.env ?? process.env;
+    return {
+        async run(signal) {
+            signal.throwIfAborted();
+            const latest = await fetchLatest(fetchPackage, signal);
+            signal.throwIfAborted();
+            const skillOptions = {
+                env,
+                ...(options.homeDirectory ? { homeDirectory: options.homeDirectory } : {})
+            };
+            if (!gt(latest, options.currentVersion)) {
+                try {
+                    await syncSkills(options.bundledSkills, skillOptions);
+                }
+                catch (error) {
+                    rethrowAbort(signal);
+                    throw new UpdateError("UPDATE_FAILED", `gd-cli ${options.currentVersion} 无需更新，但 Agent Skill 同步失败。`, ["请解决冲突后重新执行 gd-cli update。"]);
+                }
+                return { version: options.currentVersion, updated: false };
+            }
+            const binaryPath = options.binaryPath ?? process.argv[1] ?? "";
+            const source = detectInstallSource({
+                binaryPath,
+                realBinaryPath: safeRealpath(binaryPath),
+                packageRoot: options.packageRoot,
+                cwd: options.cwd ?? process.cwd(),
+                env
+            });
+            const nextSteps = manualCommands(latest);
+            if (source.kind === "unsupported") {
+                throw new UpdateError("UPDATE_FAILED", `当前安装方式不支持自动更新：${source.reason}。`, nextSteps);
+            }
+            const command = source.manager;
+            const args = source.manager === "npm"
+                ? ["install", "--global", `gaoding-cli@${latest}`]
+                : ["add", "--global", "--allow-build=gaoding-cli", `gaoding-cli@${latest}`];
+            try {
+                await runProcess(command, args, signal);
+            }
+            catch (error) {
+                rethrowAbort(signal);
+                throw new UpdateError("UPDATE_FAILED", `gd-cli 更新到 ${latest} 失败。`, nextSteps);
+            }
+            signal.throwIfAborted();
+            const targetSkills = options.bundledSkills.map((skill) => ({
+                ...skill,
+                version: latest
+            }));
+            try {
+                await verifySkills(targetSkills, skillOptions);
+            }
+            catch (error) {
+                rethrowAbort(signal);
+                throw new UpdateError("UPDATE_PARTIAL", `gd-cli 已更新到 ${latest}，但 Agent Skill 验收失败。`, ["请重新执行 gd-cli update。"]);
+            }
+            return { version: latest, updated: true };
+        }
+    };
+}
+async function fetchLatest(fetchPackage, signal) {
+    try {
+        const response = await fetchPackage(REGISTRY_URL, {
+            headers: { Accept: "application/json" },
+            redirect: "error",
+            signal
+        });
+        if (!response.ok)
+            throw new Error(`Registry status ${response.status}`);
+        const metadata = await response.json();
+        if (!metadata || typeof metadata !== "object" || Array.isArray(metadata)) {
+            throw new Error("Registry metadata invalid");
+        }
+        const tags = metadata["dist-tags"];
+        if (!tags || typeof tags !== "object" || Array.isArray(tags)) {
+            throw new Error("Registry dist-tags missing");
+        }
+        const latest = tags.latest;
+        if (typeof latest !== "string" || valid(latest.trim()) === null) {
+            throw new Error("Registry latest missing");
+        }
+        return latest.trim();
+    }
+    catch (error) {
+        rethrowAbort(signal);
+        throw new UpdateError("UPDATE_FAILED", "无法获取 gaoding-cli 最新版本。", ["请稍后重新执行 gd-cli update。"]);
+    }
+}
+function spawnProcess(command, args, signal) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(command, args, {
+            stdio: "inherit",
+            shell: false,
+            signal
+        });
+        child.once("error", reject);
+        child.once("exit", (code, exitSignal) => {
+            if (code === 0) {
+                resolvePromise();
+            }
+            else {
+                reject(new Error(code === null
+                    ? `package manager terminated by ${exitSignal ?? "unknown signal"}`
+                    : `package manager exited with ${code}`));
+            }
+        });
+    });
+}
+function manualCommands(version) {
+    return [
+        `npm install --global gaoding-cli@${version}`,
+        `pnpm add --global --allow-build=gaoding-cli gaoding-cli@${version}`
+    ];
+}
+function containsTemporaryRunner(path) {
+    return path.includes("/.npm/_npx/")
+        || path.includes("/pnpm/dlx/")
+        || path.includes("/.pnpm/dlx/");
+}
+function isWithin(path, directory) {
+    return path === directory || path.startsWith(`${directory}/`);
+}
+function normalizePath(path) {
+    return path.replace(/\\/gu, "/").replace(/\/+$/u, "");
+}
+function safeRealpath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return path;
+    }
+}
+function unsupported(reason) {
+    return { kind: "unsupported", reason };
+}
+function rethrowAbort(signal) {
+    if (signal.aborted)
+        signal.throwIfAborted();
+}

package/dist/src/platform/json-input.js

@@ -0,0 +1,64 @@
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+export class JsonInputError extends Error {
+    constructor() {
+        super("无法读取有效的 JSON。");
+        this.name = "JsonInputError";
+    }
+}
+export function createJsonInputReader(options) {
+    return {
+        async read(source, signal) {
+            signal.throwIfAborted();
+            let text;
+            try {
+                text = source === "-"
+                    ? await readStream(options.stdin, signal)
+                    : await readFile(resolve(options.cwd, source), { encoding: "utf8", signal });
+            }
+            catch {
+                if (signal.aborted)
+                    throw signal.reason;
+                throw new JsonInputError();
+            }
+            try {
+                return JSON.parse(text);
+            }
+            catch {
+                throw new JsonInputError();
+            }
+        }
+    };
+}
+function readStream(stream, signal) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        const onData = (chunk) => {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        };
+        const cleanup = () => {
+            stream.removeListener("data", onData);
+            stream.removeListener("end", onEnd);
+            stream.removeListener("error", onError);
+            signal.removeEventListener("abort", onAbort);
+        };
+        const onEnd = () => {
+            cleanup();
+            resolve(Buffer.concat(chunks).toString("utf8"));
+        };
+        const onError = () => {
+            cleanup();
+            reject(new JsonInputError());
+        };
+        const onAbort = () => {
+            cleanup();
+            reject(signal.reason);
+        };
+        stream.on("data", onData);
+        stream.once("end", onEnd);
+        stream.once("error", onError);
+        signal.addEventListener("abort", onAbort, { once: true });
+        if (signal.aborted)
+            onAbort();
+    });
+}

package/dist/src/platform/local-json-file.js

@@ -0,0 +1,59 @@
+import { randomUUID } from "node:crypto";
+import * as nodeFileSystem from "node:fs/promises";
+import { join } from "node:path";
+export class LocalFileError extends Error {
+    constructor(cause) {
+        super("无法访问本地状态文件。", { cause });
+        this.name = "LocalFileError";
+    }
+}
+export function createLocalJsonFile(options) {
+    const fileSystem = options.fileSystem ?? nodeFileSystem;
+    const path = join(options.directory, options.filename);
+    return {
+        async readText() {
+            try {
+                await fileSystem.chmod(options.directory, 0o700);
+                await fileSystem.chmod(path, 0o600);
+                return await fileSystem.readFile(path, "utf8");
+            }
+            catch (cause) {
+                if (isMissing(cause))
+                    return null;
+                throw new LocalFileError(cause);
+            }
+        },
+        async writeTextAtomically(value) {
+            const temporaryPath = join(options.directory, `${options.filename}.tmp-${randomUUID()}`);
+            let handle;
+            try {
+                await fileSystem.mkdir(options.directory, { mode: 0o700, recursive: true });
+                await fileSystem.chmod(options.directory, 0o700);
+                handle = await fileSystem.open(temporaryPath, "wx", 0o600);
+                await handle.writeFile(value, "utf8");
+                await handle.sync();
+                await handle.close();
+                handle = undefined;
+                await fileSystem.chmod(temporaryPath, 0o600);
+                await fileSystem.rename(temporaryPath, path);
+            }
+            catch (cause) {
+                await handle?.close().catch(() => undefined);
+                await fileSystem.unlink(temporaryPath).catch(() => undefined);
+                throw new LocalFileError(cause);
+            }
+        },
+        async remove() {
+            try {
+                await fileSystem.unlink(path);
+            }
+            catch (cause) {
+                if (!isMissing(cause))
+                    throw new LocalFileError(cause);
+            }
+        }
+    };
+}
+function isMissing(error) {
+    return error instanceof Error && "code" in error && error.code === "ENOENT";
+}

package/dist/src/platform/open-browser.js

@@ -0,0 +1,8 @@
+import open from "open";
+export function createBrowserOpener(openUrl = open) {
+    return {
+        async open(url) {
+            await openUrl(url.href);
+        }
+    };
+}

package/dist/src/platform/redact.js

@@ -0,0 +1,80 @@
+const REDACTED = "[REDACTED]";
+const SENSITIVE_KEYS = new Set([
+    "ak",
+    "sk",
+    "accesskey",
+    "accesskeyid",
+    "accesskeysecret",
+    "authkey",
+    "authorization",
+    "authorizecode",
+    "authorizationcode",
+    "bearer",
+    "cookie",
+    "contentid",
+    "devicecode",
+    "difytaskid",
+    "orgid",
+    "password",
+    "secret",
+    "secretkey",
+    "signature",
+    "securitytoken",
+    "ststoken",
+    "taskid",
+    "token",
+    "accesstoken",
+    "refreshtoken"
+]);
+export function redact(value) {
+    return redactValue(value, new WeakSet());
+}
+export function redactSensitiveText(value) {
+    const url = redactUrl(value);
+    if (url)
+        return url;
+    return value
+        .replace(/(authorization\s*:\s*bearer\s+)[^\s,;]+/gi, `$1${REDACTED}`)
+        .replace(/(cookie\s*:\s*)[^\r\n]+/gi, `$1${REDACTED}`)
+        .replace(/\b(ak|sk|access[_-]?key(?:[_-]?(?:id|secret))?|secret[_-]?key|auth[_-]?key|token|access[_-]?token|refresh[_-]?token|security[_-]?token|sts[_-]?token|signature|authorize[_-]?code|authorization[_-]?code|device[_-]?code|org[_-]?id|content[_-]?id|dify[_-]?task[_-]?id|task[_-]?id)\s*[:=]\s*[^\s,;}&]+/gi, `$1=${REDACTED}`);
+}
+function redactValue(value, seen) {
+    if (typeof value === "string")
+        return redactSensitiveText(value);
+    if (value === null || typeof value !== "object")
+        return value;
+    if (seen.has(value))
+        return "[Circular]";
+    seen.add(value);
+    if (value instanceof Error) {
+        return {
+            name: value.name,
+            message: redactSensitiveText(value.message)
+        };
+    }
+    if (Array.isArray(value))
+        return value.map((item) => redactValue(item, seen));
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+        key,
+        isSensitiveKey(key) ? REDACTED : redactValue(item, seen)
+    ]));
+}
+function redactUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.protocol !== "http:" && url.protocol !== "https:")
+        return undefined;
+    for (const key of [...url.searchParams.keys()]) {
+        if (isSensitiveKey(key))
+            url.searchParams.set(key, REDACTED);
+    }
+    return url.href;
+}
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEYS.has(key.toLowerCase().replaceAll(/[-_]/g, ""));
+}

package/dist/src/platform/safe-upload-file.js

@@ -0,0 +1,146 @@
+import { open, realpath, stat } from "node:fs/promises";
+import { basename, extname, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+export class LocalFileInputError extends Error {
+    constructor() {
+        super("本地文件不可用于上传。");
+        this.name = "LocalFileInputError";
+    }
+}
+const protectedSegments = new Set([
+    ".aws",
+    ".azure",
+    ".config",
+    ".docker",
+    ".gd",
+    ".gd-cli-dev",
+    ".git",
+    ".gnupg",
+    ".kube",
+    ".npm",
+    ".ssh"
+]);
+const protectedFilenames = new Set([
+    ".env",
+    ".git-credentials",
+    ".gitconfig",
+    ".npmrc",
+    ".netrc",
+    ".pypirc",
+    "credentials.json",
+    "credential.json",
+    "id_ed25519",
+    "id_rsa",
+    "known_hosts"
+]);
+const mediaTypes = {
+    avif: "image/avif",
+    bmp: "image/bmp",
+    gif: "image/gif",
+    heic: "image/heic",
+    heif: "image/heif",
+    jpeg: "image/jpeg",
+    m4v: "video/x-m4v",
+    mkv: "video/x-matroska",
+    mov: "video/quicktime",
+    mp4: "video/mp4",
+    png: "image/png",
+    svg: "image/svg+xml",
+    webm: "video/webm",
+    webp: "image/webp"
+};
+function reject() {
+    throw new LocalFileInputError();
+}
+function assertSafePath(filePath) {
+    const segments = filePath.split(sep).filter(Boolean).map((segment) => segment.toLowerCase());
+    const filename = segments.at(-1) ?? "";
+    if (protectedFilenames.has(filename) || /^\.env(?:\.|$)/.test(filename))
+        reject();
+    if (segments.some((segment) => segment.startsWith(".") || protectedSegments.has(segment))) {
+        reject();
+    }
+}
+function detectedFormat(header) {
+    if (header.length >= 3
+        && header[0] === 0xff
+        && header[1] === 0xd8
+        && header[2] === 0xff)
+        return "jpeg";
+    if (header.length >= 8
+        && header.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a])))
+        return "png";
+    if (header.length >= 6) {
+        const signature = header.subarray(0, 6).toString("ascii");
+        if (signature === "GIF87a" || signature === "GIF89a")
+            return "gif";
+    }
+    if (header.length >= 12
+        && header.subarray(0, 4).toString("ascii") === "RIFF"
+        && header.subarray(8, 12).toString("ascii") === "WEBP")
+        return "webp";
+    if (header.length >= 12 && header.subarray(4, 8).toString("ascii") === "ftyp") {
+        const brand = header.subarray(8, 12).toString("ascii");
+        if (brand === "avif" || brand === "avis")
+            return "avif";
+        if (["heic", "heix", "hevc", "hevx"].includes(brand))
+            return "heic";
+    }
+    return undefined;
+}
+async function readHeader(filePath, signal) {
+    signal.throwIfAborted();
+    const handle = await open(filePath, "r");
+    try {
+        const buffer = Buffer.alloc(32);
+        const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+        signal.throwIfAborted();
+        return buffer.subarray(0, bytesRead);
+    }
+    finally {
+        await handle.close();
+    }
+}
+export async function inspectUploadFile(input) {
+    input.signal.throwIfAborted();
+    try {
+        const requestedPath = fileURLToPath(input.url);
+        if (input.allowSensitivePath !== true)
+            assertSafePath(requestedPath);
+        const filePath = await realpath(requestedPath);
+        if (input.allowSensitivePath !== true)
+            assertSafePath(filePath);
+        const details = await stat(filePath);
+        if (!details.isFile())
+            return reject();
+        const header = await readHeader(filePath, input.signal);
+        const detected = detectedFormat(header);
+        const extension = extname(requestedPath).slice(1).toLowerCase();
+        const format = detected ?? (extension === "jpg" ? "jpeg" : extension);
+        if (format === "")
+            return reject();
+        const detectedMediaType = detected === undefined ? undefined : mediaTypes[detected];
+        if (detectedMediaType !== undefined
+            && input.claimedMediaType !== undefined
+            && input.claimedMediaType.trim().toLowerCase() !== detectedMediaType) {
+            return reject();
+        }
+        return {
+            filePath,
+            filename: basename(requestedPath),
+            format,
+            mediaType: detectedMediaType
+                ?? input.claimedMediaType
+                ?? mediaTypes[format]
+                ?? `application/${format}`,
+            size: details.size
+        };
+    }
+    catch (error) {
+        if (input.signal.aborted)
+            throw input.signal.reason;
+        if (error instanceof LocalFileInputError)
+            throw error;
+        throw new LocalFileInputError();
+    }
+}

package/dist/src/platform/signature.js

@@ -0,0 +1,19 @@
+import { createHmac } from "node:crypto";
+export function canonicalizeQuery(entries) {
+    const sorted = [...entries].sort(([left], [right]) => left.localeCompare(right));
+    return new URLSearchParams(sorted.map(([key, value]) => [key, value]))
+        .toString()
+        .replaceAll("%2C", ",");
+}
+export function createSigningString(input) {
+    return `${input.method.toUpperCase()}@${input.pathname}@${input.canonicalQuery}@${input.timestamp}`;
+}
+export function signRequest(input) {
+    return hmac(input.secretKey, createSigningString(input));
+}
+export function signBindOrganization(input) {
+    return hmac(input.secretKey, `GET@/oauth/device/bind-org@ak=${input.accessKey}&orgId=${input.organizationId}@${input.timestamp}`);
+}
+function hmac(secret, value) {
+    return createHmac("sha256", secret).update(value).digest("hex");
+}

package/dist/src/platform/signed-http-transport.js

@@ -0,0 +1,109 @@
+import { canonicalizeQuery, signRequest } from "./signature.js";
+export class RemoteRequestError extends Error {
+    status;
+    transient;
+    constructor(status, transient = false) {
+        super(status === undefined ? "无法连接稿定服务。" : `稿定服务请求失败（HTTP ${status}）。`);
+        this.name = "RemoteRequestError";
+        this.status = status;
+        this.transient = transient;
+    }
+}
+const TRANSIENT_NETWORK_CODES = new Set([
+    "ECONNRESET",
+    "ECONNREFUSED",
+    "ETIMEDOUT",
+    "EPIPE",
+    "ENOTFOUND",
+    "EAI_AGAIN",
+    "UND_ERR_SOCKET",
+    "UND_ERR_CONNECT_TIMEOUT"
+]);
+function isTransientNetworkFailure(error, seen = new WeakSet()) {
+    if (error === null || typeof error !== "object" || seen.has(error))
+        return false;
+    seen.add(error);
+    if ("code" in error
+        && typeof error.code === "string"
+        && TRANSIENT_NETWORK_CODES.has(error.code)) {
+        return true;
+    }
+    if (error instanceof AggregateError
+        && error.errors.some((item) => isTransientNetworkFailure(item, seen))) {
+        return true;
+    }
+    return "cause" in error && isTransientNetworkFailure(error.cause, seen);
+}
+export function createSignedHttpTransport(options) {
+    const baseUrl = new URL(options.baseUrl);
+    if (!baseUrl.pathname.endsWith("/"))
+        baseUrl.pathname += "/";
+    async function send(method, request, accept, body, timeout) {
+        request.signal.throwIfAborted();
+        const url = new URL(request.path.replace(/^\//, ""), baseUrl);
+        const query = canonicalizeQuery(Object.entries(request.query ?? {}));
+        url.search = query;
+        const timestamp = Math.floor(options.now().getTime() / 1000);
+        const headers = {
+            Accept: accept,
+            "X-AccessKey": request.credential.accessKey,
+            "X-Signature": signRequest({
+                method,
+                pathname: url.pathname,
+                canonicalQuery: query,
+                timestamp,
+                secretKey: request.credential.secretKey
+            }),
+            "X-Timestamp": String(timestamp)
+        };
+        if (options.channelId !== undefined)
+            headers["X-Channel-Id"] = options.channelId;
+        if (body !== undefined)
+            headers["Content-Type"] = "application/json";
+        if (request.organizationId !== undefined)
+            headers["X-Org-Id"] = request.organizationId;
+        const signal = timeout
+            ? AbortSignal.any([
+                request.signal,
+                AbortSignal.timeout(options.timeoutMs ?? 30_000)
+            ])
+            : request.signal;
+        try {
+            return await options.fetch(url, {
+                method,
+                headers,
+                ...(body === undefined ? {} : { body }),
+                signal
+            });
+        }
+        catch (error) {
+            if (request.signal.aborted)
+                throw request.signal.reason;
+            throw new RemoteRequestError(undefined, isTransientNetworkFailure(error));
+        }
+    }
+    async function json(response) {
+        if (!response.ok)
+            throw new RemoteRequestError(response.status);
+        try {
+            return await response.json();
+        }
+        catch {
+            throw new RemoteRequestError(response.status);
+        }
+    }
+    return {
+        async getJson(request) {
+            return json(await send("GET", request, "application/json", undefined, true));
+        },
+        async postJson(request) {
+            return json(await send("POST", request, "application/json", JSON.stringify(request.body), true));
+        },
+        async postStream(request) {
+            const response = await send("POST", request, request.accept, JSON.stringify(request.body), false);
+            if (!response.ok || !response.body)
+                throw new RemoteRequestError(response.status);
+            return response.body;
+        }
+    };
+}