hob-bot 0.0.0-stage → 1.0.2

package/server/src/config.ts

@@ -0,0 +1,123 @@
+import { randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { hashPassword, isPasswordHash } from "./password.ts";
+import type { ThinkingLevel } from "../../shared/types.ts";
+
+export type { ThinkingLevel };
+
+/**
+ * 启动用的配置（HOB_HOME/config.json）。界面能改的东西都在 settings.json，
+ * 这里只留启动项：端口、host、密码哈希和 cookie 签名密钥。模型在设置 → 模型里。
+ */
+export interface HobConfig {
+  host: string;
+  port: number;
+  /** scrypt 哈希，见 password.ts；明文密码在首次启动时转成它 */
+  passwordHash: string;
+  cookieSecret: string;
+}
+
+export const DEFAULT_CONFIG: Omit<HobConfig, "passwordHash" | "cookieSecret"> = {
+  host: "127.0.0.1",
+  port: 30148,
+};
+
+export function expandHome(path: string): string {
+  return path.startsWith("~/") ? join(homedir(), path.slice(2)) : path;
+}
+
+export function resolveHome(env: NodeJS.ProcessEnv = process.env): string {
+  return expandHome(env.HOB_HOME?.trim() || join(homedir(), ".hob"));
+}
+
+/** 引擎目录（凭据、资源、记忆）：Hob 自己管，放在 HOB_HOME 里。 */
+export function engineDir(home: string): string {
+  return join(home, "engine");
+}
+
+/** 本地记忆插件的目录（插件在模块加载时就读这个环境变量）。 */
+export function memoryDir(home: string): string {
+  return join(home, "memory");
+}
+
+/** Lore 连接的目录：Hob 自己的 config.json 在这里，不碰其他 Lore 客户端的那份。 */
+export function loreDir(home: string): string {
+  return join(home, "lore");
+}
+
+const CONFIG_FILE = "config.json";
+/** 搬进 settings.json 之后不再写回去的旧键。 */
+export const LEGACY_MODEL_KEYS = ["routerModel", "routerThinking", "workerModel", "workerThinking"];
+
+
+/** 里面有密码哈希和 cookieSecret：只给自己读写（和 secrets.json 一样 0600）。 */
+function writeAtomic(path: string, text: string): void {
+  const tmp = `${path}.${process.pid}.tmp`;
+  writeFileSync(tmp, text, { mode: 0o600 });
+  renameSync(tmp, path);
+}
+
+/**
+ * 读 HOB_HOME/config.json；首次启动时创建（cookieSecret 随机生成）。
+ * 密码存哈希：文件里还是明文 password，或者用了 HOB_PASSWORD，就转成哈希写回。
+ */
+export function loadConfig(home: string, env: NodeJS.ProcessEnv = process.env): HobConfig {
+  mkdirSync(home, { recursive: true });
+  const file = join(home, CONFIG_FILE);
+  const stored: Record<string, unknown> = existsSync(file)
+    ? (JSON.parse(readFileSync(file, "utf8")) as Record<string, unknown>)
+    : {};
+  const plain = typeof stored.password === "string" ? stored.password.trim() : "";
+  const fromEnv = (env.HOB_PASSWORD ?? "").trim();
+  const storedHash = typeof stored.passwordHash === "string" ? stored.passwordHash.trim() : "";
+  const passwordHash = isPasswordHash(storedHash)
+    ? storedHash
+    : plain || fromEnv
+      ? hashPassword(plain || fromEnv)
+      : "";
+  if (!passwordHash) {
+    throw new Error(
+      `没有设置密码：请在 ${file} 里填 password（会转成哈希），或启动时设置 HOB_PASSWORD。`,
+    );
+  }
+  const needWrite = !isPasswordHash(storedHash) || !stored.cookieSecret || hasLegacyModelKeys(home);
+  const config: HobConfig = {
+    host: (env.HOB_HOST ?? (typeof stored.host === "string" ? stored.host : "") ?? "").trim() || DEFAULT_CONFIG.host,
+    port: Number(stored.port) > 0 ? Number(stored.port) : DEFAULT_CONFIG.port,
+    passwordHash,
+    cookieSecret:
+      typeof stored.cookieSecret === "string" && stored.cookieSecret ? stored.cookieSecret : randomBytes(32).toString("hex"),
+  };
+  if (needWrite) writeConfig(home, config);
+  return config;
+}
+
+function hasLegacyModelKeys(home: string): boolean {
+  try {
+    const stored = JSON.parse(readFileSync(join(home, CONFIG_FILE), "utf8")) as Record<string, unknown>;
+    return LEGACY_MODEL_KEYS.some((key) => key in stored);
+  } catch {
+    return false;
+  }
+}
+
+/** 只写已知字段：搬走的旧键（模型、theme、timezone、maxJobs…）不留在文件里。 */
+export function writeConfig(home: string, config: HobConfig): void {
+  mkdirSync(home, { recursive: true });
+  const out = {
+    host: config.host,
+    port: config.port,
+    passwordHash: config.passwordHash,
+    cookieSecret: config.cookieSecret,
+  };
+  writeAtomic(join(home, CONFIG_FILE), `${JSON.stringify(out, null, 2)}\n`);
+}
+
+/** 改密码：写回 config.json。 */
+export function setPassword(home: string, config: HobConfig, password: string): HobConfig {
+  const next: HobConfig = { ...config, passwordHash: hashPassword(password) };
+  writeConfig(home, next);
+  return next;
+}

package/server/src/cron-text.ts

@@ -0,0 +1,49 @@
+const WEEKDAYS = ["日", "一", "二", "三", "四", "五", "六"];
+
+function time(hour: string, minute: string): string {
+  return `${hour.padStart(2, "0")}:${minute.padStart(2, "0")}`;
+}
+
+function weekday(token: string): string | undefined {
+  const map: Record<string, string> = { "0": "日", "7": "日", "1": "一", "2": "二", "3": "三", "4": "四", "5": "五", "6": "六" };
+  return map[token];
+}
+
+/**
+ * cron 转中文：覆盖常见的每天 / 每周 / 每月 / 每隔几分钟，认不出的原样返回。
+ * 只处理 5 段表达式（分 时 日 月 周）。
+ */
+export function cronToChinese(expression: string): string {
+  const parts = expression.trim().split(/\s+/);
+  if (parts.length !== 5) return expression;
+  const [minute, hour, day, month, dow] = parts;
+  const at = /^\d+$/.test(minute) && /^\d+$/.test(hour) ? time(hour, minute) : undefined;
+
+  if (minute.startsWith("*/") && hour === "*" && day === "*" && month === "*" && dow === "*") {
+    return `每 ${minute.slice(2)} 分钟`;
+  }
+  if (minute === "0" && hour === "*" && day === "*" && month === "*" && dow === "*") return "每小时整点";
+  if (!at) return expression;
+
+  if (day === "L" && month === "*" && dow === "*") return `每月最后一天 ${at}`;
+  if (/^\d+$/.test(day) && month === "*" && dow === "*") return `每月 ${day} 日 ${at}`;
+  if (day === "*" && month === "*") {
+    if (dow === "*") return `每天 ${at}`;
+    if (/^\d+$/.test(dow)) {
+      const name = weekday(dow);
+      return name ? `每周${name} ${at}` : expression;
+    }
+    const range = dow.match(/^(\d)-(\d)$/);
+    if (range) {
+      const from = weekday(range[1]);
+      const to = weekday(range[2]);
+      if (from && to) return `每周${from}到${to} ${at}`;
+    }
+    const list = dow.split(",");
+    if (list.length > 1 && list.every((item) => /^\d$/.test(item))) {
+      const names = list.map((item) => WEEKDAYS[Number(item) % 7]);
+      return `每周${names.join("、")} ${at}`;
+    }
+  }
+  return expression;
+}

package/server/src/delegations.ts

@@ -0,0 +1,113 @@
+import { readFileSync } from "node:fs";
+import type { Delegation } from "../../shared/types.ts";
+import { newId } from "./ids.ts";
+import type { HobRuntime } from "./runtime.ts";
+
+/** 转交状态由目标回合、任务和审批共同决定；判定和标记回流不跨异步边界。 */
+export class DelegationManager {
+  recovering = false;
+
+  constructor(private readonly runtime: HobRuntime) {
+    runtime.bus.subscribe((event) => {
+      if (this.recovering) return;
+      if (event.type === "job" && event.job.delegationId) this.update(event.job.delegationId);
+      if (event.type === "approval") {
+        for (const delegation of runtime.store.delegations()) {
+          if (delegation.approvalIds?.includes(event.approval.id) || (event.approval.jobId && delegation.jobIds.includes(event.approval.jobId))) this.update(delegation.id);
+        }
+      }
+    });
+  }
+
+  async start(to: string, text: string): Promise<Delegation> {
+    const target = this.runtime.store.assistant(to);
+    if (!target || to === "hob") throw new Error("目标助手不存在或不能转交给自己。");
+    const delegation: Delegation = { id: newId("dg-"), from: "hob", to, text, createdAt: new Date().toISOString(), status: "running", jobIds: [], approvalIds: [] };
+    this.runtime.store.saveDelegation(delegation);
+    await this.runtime.router.addItem("hob", { kind: "delegation", delegationId: delegation.id });
+    try {
+      await this.runtime.router.addForwarded(to, text, delegation.id);
+    } catch (error) {
+      this.turnEnded(delegation.id, error instanceof Error ? error.message : String(error), true);
+      throw error;
+    }
+    this.runtime.bus.emit({ type: "delegation", delegation });
+    void this.runtime.router.relay(to, text, delegation.id).catch((error: unknown) => {
+      this.turnEnded(delegation.id, error instanceof Error ? error.message : String(error), true);
+    });
+    return delegation;
+  }
+
+  addJob(id: string, jobId: string): void {
+    const record = this.runtime.store.delegation(id);
+    if (!record || record.jobIds.includes(jobId)) return;
+    this.runtime.store.saveDelegation({ ...record, jobIds: [...record.jobIds, jobId] });
+  }
+
+  addApproval(id: string, approvalId: string): void {
+    const record = this.runtime.store.delegation(id);
+    if (!record) return;
+    this.runtime.store.saveDelegation({ ...record, approvalIds: [...(record.approvalIds ?? []), approvalId] });
+    this.update(id);
+  }
+
+  turnEnded(id: string, reply: string, failed = false): void {
+    const record = this.runtime.store.delegation(id);
+    if (!record || record.turnFinished) return;
+    this.runtime.store.saveDelegation({ ...record, reply, turnFinished: true, ...(failed ? { turnFailed: true } : {}) });
+    this.update(id);
+  }
+
+  returnToHob(id: string, text: string, reason: string): void {
+    const record = this.runtime.store.delegation(id);
+    if (!record || record.turnFinished) throw new Error("转交已结束，无法退回");
+    this.runtime.store.saveDelegation({ ...record, status: "returned", reply: `退回：${reason}`, returnedText: text, turnFinished: true });
+    this.update(id);
+  }
+
+  update(id: string): void {
+    const { store, bus, router } = this.runtime;
+    const record = store.delegation(id);
+    if (!record || record.reportedAt || record.status === "interrupted") return;
+    const jobs = record.jobIds.map((jobId) => store.job(jobId));
+    const waiting = jobs.some((job) => job?.status === "waiting") || store.approvals().some((approval) => approval.status === "pending" && (record.approvalIds?.includes(approval.id) || (approval.jobId && record.jobIds.includes(approval.jobId))));
+    const active = jobs.some((job) => job && ["queued", "running", "waiting"].includes(job.status));
+    const failed = record.turnFailed || jobs.some((job) => !job || job.status === "stuck" || job.status === "failed");
+    const status = record.status === "returned" ? "returned" : waiting ? "waiting" : !record.turnFinished || active ? "running" : failed ? "stuck" : "done";
+    const complete = record.turnFinished && !active && !waiting;
+    const now = new Date().toISOString();
+    const next: Delegation = { ...record, status, ...(complete ? { endedAt: now, reportedAt: now } : {}) };
+    store.saveDelegation(next);
+    bus.emit({ type: "delegation", delegation: next });
+    if (complete) {
+      const reports = jobs.map((job) => {
+        if (!job) return "任务记录丢失";
+        let report = job.summary ?? job.statusReason ?? "无报告";
+        if (job.reportPath) {
+          try { report = readFileSync(job.reportPath, "utf8"); }
+          catch (error) { report = `报告读取失败：${error instanceof Error ? error.message : String(error)}；摘要：${report}`; }
+        }
+        return `任务「${job.title}」${job.status}：${report.length > 6000 ? `${report.slice(0, 6000)}…（报告过长已截断，完整内容在任务详情）` : report}`;
+      });
+      const name = store.assistant(record.to)?.name ?? record.to;
+      const message = record.status === "returned"
+        ? `转交给「${name}」的事已退回：${record.reply}。原请求：${record.text}\n交回内容：${record.returnedText ?? record.text}\n「${name}」已退回过一次，别再转给它。`
+        : `转交给「${name}」的事已结束：${record.reply || "（没有回复）"}`;
+      void router.event(record.from, `${message}\n${reports.join("\n")}`).catch(() => undefined);
+    }
+  }
+
+  recover(): void {
+    this.recovering = false;
+    for (const record of this.runtime.store.delegations()) {
+      if (record.reportedAt || !["running", "waiting", "returned"].includes(record.status)) continue;
+      if (record.jobIds.some((id) => { const job = this.runtime.store.job(id); return job && ["running", "queued", "waiting"].includes(job.status); })) continue;
+      const now = new Date().toISOString();
+      const next: Delegation = { ...record, status: "interrupted", endedAt: now, reportedAt: now };
+      this.runtime.store.saveDelegation(next);
+      this.runtime.bus.emit({ type: "delegation", delegation: next });
+      const name = this.runtime.store.assistant(record.to)?.name ?? record.to;
+      void this.runtime.router.event(record.from, `转交给「${name}」的事因服务重启中断`).catch(() => undefined);
+    }
+  }
+}

package/server/src/files.ts

@@ -0,0 +1,142 @@
+// /api/files 的取文件规则：路径先解开符号链接，再判断能不能给页面看。
+import { closeSync, openSync, readSync, readdirSync, realpathSync, statSync } from "node:fs";
+import { basename, join, relative, resolve, sep } from "node:path";
+import { fileKind, isTextKind, mimeOf } from "../../shared/files.ts";
+import type { FileKind, JobFileEntry, JobFilesView } from "../../shared/types.ts";
+
+/** 数据目录根上不对页面开放的文件：Hob 自己的凭据和内部状态（连同它们的临时文件、备份）。 */
+const DENY_ROOT_FILE = /^(secrets|config|settings|push)\.json/i;
+/** 数据目录根上不对页面开放的目录：引擎目录（凭据、bin）和 Lore 连接。 */
+const DENY_ROOT_DIRS = new Set(["engine", "lore"]);
+/** 备份文件一律不给（凭据的备份也在里面）。 */
+const DENY_ANY_FILE = /\.bak/i;
+
+/** 预览面板最多拉 1 MB 文本。 */
+export const MAX_TEXT_BYTES = 1024 * 1024;
+
+/** 任务工作目录里最多列 200 个文件。 */
+const MAX_JOB_FILES = 200;
+/** 递归太深的目录不进去（产出文件不该有这么深）。 */
+const MAX_DEPTH = 8;
+const SKIP_DIRS = new Set(["node_modules", ".git"]);
+
+export interface FileInfo {
+  path: string;
+  name: string;
+  size: number;
+  modifiedAt: string;
+  kind: FileKind;
+  text: boolean;
+  mime: string;
+  page?: boolean;
+}
+
+export type Lookup = { ok: true; info: FileInfo } | { ok: false; status: 403 | 404; error: string };
+
+function denied(root: string, path: string): boolean {
+  const rel = relative(root, path);
+  const parts = rel.split(sep);
+  if (DENY_ROOT_DIRS.has(parts[0] ?? "")) return true;
+  // 根上的凭据文件（含 settings.json.1234.tmp 这种原子写临时文件）
+  if (parts.length === 1 && DENY_ROOT_FILE.test(parts[0] ?? "")) return true;
+  return DENY_ANY_FILE.test(basename(path));
+}
+
+/** 开头几个字节里有没有 NUL 或控制字符：没有就当文本。 */
+export function looksText(bytes: Uint8Array): boolean {
+  const head = bytes.subarray(0, 4096);
+  let bad = 0;
+  for (const byte of head) {
+    if (byte === 0) return false;
+    if (byte < 9 || (byte > 13 && byte < 32)) bad += 1;
+  }
+  return bad <= head.length * 0.01;
+}
+
+function headOf(path: string): Uint8Array {
+  const buffer = Buffer.alloc(4096);
+  let fd: number | undefined;
+  try {
+    fd = openSync(path, "r");
+    const read = readSync(fd, buffer, 0, buffer.length, 0);
+    return buffer.subarray(0, read);
+  } catch {
+    return new Uint8Array();
+  } finally {
+    if (fd !== undefined) closeSync(fd);
+  }
+}
+
+/**
+ * 解析一个路径：realpath 后必须还在数据目录里（符号链接指出去就是 403），
+ * 凭据和内部状态文件不开放，不是普通文件当 404。
+ */
+export function lookupFile(home: string, requested: string): Lookup {
+  const root = realpathSync(resolve(home));
+  let path: string;
+  let size: number;
+  let modifiedAt: string;
+  try {
+    path = realpathSync(resolve(requested));
+    const stats = statSync(path);
+    if (!stats.isFile()) return { ok: false, status: 404, error: "文件不存在" };
+    size = stats.size;
+    modifiedAt = stats.mtime.toISOString();
+  } catch {
+    return { ok: false, status: 404, error: "文件不存在" };
+  }
+  if (!path.startsWith(`${root}${sep}`)) return { ok: false, status: 403, error: "只允许读 Hob 自己的文件" };
+  if (denied(root, path)) return { ok: false, status: 403, error: "这个文件不对页面开放" };
+  const name = basename(path);
+  const kind = fileKind(name) ?? (looksText(headOf(path)) ? "text" : "other");
+  const text = isTextKind(kind);
+  return {
+    ok: true,
+    info: { path, name, size, modifiedAt, kind, text, mime: mimeOf(name), ...(/^pages[/\\][0-9a-f-]{36}\.html$/i.test(relative(root, path)) ? { page: true } : {}) },
+  };
+}
+
+function walk(dir: string, base: string, depth: number, out: JobFileEntry[]): boolean {
+  if (depth > MAX_DEPTH) return false;
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return false;
+  }
+  for (const entry of entries) {
+    // 符号链接不跟：可能指到目录外面，也可能绕成环
+    if (entry.isSymbolicLink()) continue;
+    const path = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      if (SKIP_DIRS.has(entry.name)) continue;
+      if (walk(path, base, depth + 1, out)) return true;
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    let stats;
+    try {
+      stats = statSync(path);
+    } catch {
+      continue;
+    }
+    out.push({
+      path,
+      rel: relative(base, path),
+      name: entry.name,
+      size: stats.size,
+      modifiedAt: stats.mtime.toISOString(),
+      kind: fileKind(entry.name) ?? (looksText(headOf(path)) ? "text" : "other"),
+    });
+    if (out.length >= MAX_JOB_FILES + 1) return true;
+  }
+  return false;
+}
+
+/** 任务工作目录里的文件：递归、修改时间倒序、最多 200 个，跳过 node_modules 和 .git。 */
+export function listJobFiles(workDir: string): JobFilesView {
+  const all: JobFileEntry[] = [];
+  walk(workDir, workDir, 0, all);
+  all.sort((a, b) => b.modifiedAt.localeCompare(a.modifiedAt));
+  return { files: all.slice(0, MAX_JOB_FILES), hasMore: all.length > MAX_JOB_FILES };
+}