huaweicloud-devkit 1.0.2-next.2 → 1.0.2-next.3

package/plugins/huaweicloud-core/src/proxy/proxy-config.mjs

@@ -1,87 +1,87 @@
-import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { homedir } from 'node:os';
-
-function baseHome() {
-  return process.env.HUAWEICLOUD_HOME || homedir();
-}
-
-export function proxyConfigPath() {
-  return join(baseHome(), '.config', 'huaweicloud', 'proxy.json');
-}
-
-export function readProxyConfig() {
-  const path = proxyConfigPath();
-  if (!existsSync(path)) return null;
-  try {
-    return JSON.parse(readFileSync(path, 'utf8'));
-  } catch {
-    return null;
-  }
-}
-
-export function writeProxyConfig(config = {}) {
-  const path = proxyConfigPath();
-  mkdirSync(dirname(path), { recursive: true });
-  const payload = {
-    https_proxy: String(config.https_proxy || ''),
-    http_proxy: String(config.http_proxy || ''),
-    no_proxy: String(config.no_proxy || ''),
-  };
-  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8' });
-  return path;
-}
-
-export function clearProxyConfig() {
-  const path = proxyConfigPath();
-  if (!existsSync(path)) return false;
-  rmSync(path);
-  return true;
-}
-
-function shouldBypassProxy(hostname, noProxyList) {
-  if (!noProxyList.length) return false;
-  const lower = hostname.toLowerCase();
-  for (const pattern of noProxyList) {
-    const p = pattern.trim().toLowerCase();
-    if (!p) continue;
-    if (p === lower) return true;
-    if (p === '*') return true;
-    if (p.startsWith('.') && lower.endsWith(p)) return true;
-    if (lower.endsWith('.' + p)) return true;
-  }
-  return false;
-}
-
-export function getProxySettings(targetUrl) {
-  const envHttps = process.env.HTTPS_PROXY || process.env.https_proxy || '';
-  const envHttp = process.env.HTTP_PROXY || process.env.http_proxy || '';
-  const envNoProxy = process.env.NO_PROXY || process.env.no_proxy || '';
-
-  const fileConfig = readProxyConfig();
-
-  const https_proxy = envHttps || (fileConfig?.https_proxy || '');
-  const http_proxy = envHttp || (fileConfig?.http_proxy || '');
-  const no_proxy = envNoProxy || (fileConfig?.no_proxy || '');
-
-  if (!https_proxy && !http_proxy) return null;
-
-  const noProxyList = no_proxy.split(',').map((s) => s.trim()).filter(Boolean);
-
-  if (targetUrl) {
-    const parsed = new URL(targetUrl);
-    if (shouldBypassProxy(parsed.hostname, noProxyList)) return null;
-    const isHttps = parsed.protocol === 'https:';
-    const proxyUrl = isHttps ? https_proxy : http_proxy;
-    if (!proxyUrl) return null;
-    return { proxyUrl, noProxyList, targetProtocol: parsed.protocol };
-  }
-
-  return { https_proxy, http_proxy, no_proxy, noProxyList };
-}
-
-export function getProxyUrlForTarget(targetUrl) {
-  const settings = getProxySettings(targetUrl);
-  if (!settings) return null;
-  return settings.proxyUrl || null;
-}
+import { existsSync, readFileSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { homedir } from 'node:os';
+
+function baseHome() {
+  return process.env.HUAWEICLOUD_HOME || homedir();
+}
+
+export function proxyConfigPath() {
+  return join(baseHome(), '.config', 'huaweicloud', 'proxy.json');
+}
+
+export function readProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+export function writeProxyConfig(config = {}) {
+  const path = proxyConfigPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const payload = {
+    https_proxy: String(config.https_proxy || ''),
+    http_proxy: String(config.http_proxy || ''),
+    no_proxy: String(config.no_proxy || ''),
+  };
+  writeFileSync(path, JSON.stringify(payload, null, 2), { encoding: 'utf8' });
+  return path;
+}
+
+export function clearProxyConfig() {
+  const path = proxyConfigPath();
+  if (!existsSync(path)) return false;
+  rmSync(path);
+  return true;
+}
+
+function shouldBypassProxy(hostname, noProxyList) {
+  if (!noProxyList.length) return false;
+  const lower = hostname.toLowerCase();
+  for (const pattern of noProxyList) {
+    const p = pattern.trim().toLowerCase();
+    if (!p) continue;
+    if (p === lower) return true;
+    if (p === '*') return true;
+    if (p.startsWith('.') && lower.endsWith(p)) return true;
+    if (lower.endsWith('.' + p)) return true;
+  }
+  return false;
+}
+
+export function getProxySettings(targetUrl) {
+  const envHttps = process.env.HTTPS_PROXY || process.env.https_proxy || '';
+  const envHttp = process.env.HTTP_PROXY || process.env.http_proxy || '';
+  const envNoProxy = process.env.NO_PROXY || process.env.no_proxy || '';
+
+  const fileConfig = readProxyConfig();
+
+  const https_proxy = envHttps || (fileConfig?.https_proxy || '');
+  const http_proxy = envHttp || (fileConfig?.http_proxy || '');
+  const no_proxy = envNoProxy || (fileConfig?.no_proxy || '');
+
+  if (!https_proxy && !http_proxy) return null;
+
+  const noProxyList = no_proxy.split(',').map((s) => s.trim()).filter(Boolean);
+
+  if (targetUrl) {
+    const parsed = new URL(targetUrl);
+    if (shouldBypassProxy(parsed.hostname, noProxyList)) return null;
+    const isHttps = parsed.protocol === 'https:';
+    const proxyUrl = isHttps ? https_proxy : http_proxy;
+    if (!proxyUrl) return null;
+    return { proxyUrl, noProxyList, targetProtocol: parsed.protocol };
+  }
+
+  return { https_proxy, http_proxy, no_proxy, noProxyList };
+}
+
+export function getProxyUrlForTarget(targetUrl) {
+  const settings = getProxySettings(targetUrl);
+  if (!settings) return null;
+  return settings.proxyUrl || null;
+}

package/plugins/huaweicloud-core/src/risk-rule-engine.mjs

@@ -1,137 +1,137 @@
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const defaultRulesPath = join(__dirname, '..', 'safety', 'rules', 'cloud-risk-rules.json');
-
-const SEVERITY_RANK = {
-  deny: 3,
-  warn: 2,
-  info: 1,
-};
-
-export function loadRiskRules(options = {}) {
-  const path = options.path || defaultRulesPath;
-  return JSON.parse(readFileSync(path, 'utf8'));
-}
-
-function redactEvidence(text) {
-  return String(text)
-    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
-    .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
-}
-
-function normalizeText(value) {
-  if (typeof value === 'string') return value;
-  return JSON.stringify(value, null, 2);
-}
-
-function evaluationContext(stage, input) {
-  if (stage === 'command') {
-    const command = normalizeText(input.command || input.text || '');
-    return { text: command, command };
-  }
-  if (stage === 'artifact') {
-    const path = String(input.path || '');
-    const content = normalizeText(input.content || '');
-    return { text: `${path}\n${content}`, path, content };
-  }
-  if (stage === 'deploy_plan') {
-    const plan = normalizeText(input.plan || input.text || input);
-    return { text: plan, plan };
-  }
-  return { text: normalizeText(input) };
-}
-
-function conditionMatches(condition, context) {
-  const field = condition.field || 'text';
-  const value = Object.hasOwn(context, field) ? context[field] : context.text;
-  return new RegExp(condition.regex, 'ims').test(String(value || ''));
-}
-
-function ruleMatches(rule, context) {
-  const match = rule.match || {};
-  const all = match.all;
-  const any = match.any;
-  const none = match.none;
-  if (Array.isArray(all) && !all.every((condition) => conditionMatches(condition, context))) {
-    return false;
-  }
-  if (Array.isArray(any) && !any.some((condition) => conditionMatches(condition, context))) {
-    return false;
-  }
-  if (Array.isArray(none) && none.some((condition) => conditionMatches(condition, context))) {
-    return false;
-  }
-  return Array.isArray(all) || Array.isArray(any);
-}
-
-function excerpt(text) {
-  const compact = redactEvidence(String(text).replace(/\s+/g, ' ').trim());
-  if (compact.length <= 240) return compact;
-  return `${compact.slice(0, 237)}...`;
-}
-
-function evaluate(stage, inputs, options = {}) {
-  const catalog = options.catalog || loadRiskRules(options);
-  const items = Array.isArray(inputs) ? inputs : [inputs];
-  const findings = [];
-
-  for (const input of items) {
-    const context = evaluationContext(stage, input || {});
-    for (const rule of catalog.rules) {
-      if (!rule.stages.includes(stage)) continue;
-      if (!ruleMatches(rule, context)) continue;
-      findings.push({
-        ruleId: rule.id,
-        title: rule.title,
-        category: rule.category,
-        severity: rule.severity,
-        message: rule.message,
-        remediation: rule.remediation,
-        source: input?.path || stage,
-        evidence: excerpt(context.text),
-      });
-    }
-  }
-
-  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
-  const hasDeny = findings.some((finding) => finding.severity === 'deny');
-  const hasWarn = findings.some((finding) => finding.severity === 'warn');
-  return {
-    decision: hasDeny ? 'deny' : hasWarn ? 'warn' : 'allow',
-    findings,
-  };
-}
-
-export function evaluateCommandRisk(command, options = {}) {
-  return evaluate('command', { command }, options);
-}
-
-export function evaluateArtifacts(artifacts, options = {}) {
-  return evaluate('artifact', Array.isArray(artifacts) ? artifacts : [], options);
-}
-
-export function evaluateDeployPlan(plan, options = {}) {
-  return evaluate('deploy_plan', { plan }, options);
-}
-
-export function mergeRiskDecision(base, risk) {
-  if (!risk || !risk.findings?.length) return base;
-  if (risk.decision === 'deny') {
-    const topFinding = risk.findings[0];
-    return {
-      ...base,
-      decision: 'deny',
-      risk: topFinding.category,
-      reason: topFinding.message,
-      blockedByRiskRule: true,
-      findings: risk.findings,
-    };
-  }
-  return {
-    ...base,
-    warnings: [...(base.warnings || []), ...risk.findings],
-  };
-}
+import { readFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const defaultRulesPath = join(__dirname, '..', 'safety', 'rules', 'cloud-risk-rules.json');
+
+const SEVERITY_RANK = {
+  deny: 3,
+  warn: 2,
+  info: 1,
+};
+
+export function loadRiskRules(options = {}) {
+  const path = options.path || defaultRulesPath;
+  return JSON.parse(readFileSync(path, 'utf8'));
+}
+
+function redactEvidence(text) {
+  return String(text)
+    .replace(/((?:access[_-]?key|secret[_-]?key|security[_-]?token|x[_-]?auth[_-]?token|authorization|password|passwd|adminPass|credential)\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;]+)/gi, '$1<redacted>')
+    .replace(/(AK|SK)\s*[:=]\s*("[^"]*"|'[^']*'|[^\s,;]+)/g, '$1=<redacted>');
+}
+
+function normalizeText(value) {
+  if (typeof value === 'string') return value;
+  return JSON.stringify(value, null, 2);
+}
+
+function evaluationContext(stage, input) {
+  if (stage === 'command') {
+    const command = normalizeText(input.command || input.text || '');
+    return { text: command, command };
+  }
+  if (stage === 'artifact') {
+    const path = String(input.path || '');
+    const content = normalizeText(input.content || '');
+    return { text: `${path}\n${content}`, path, content };
+  }
+  if (stage === 'deploy_plan') {
+    const plan = normalizeText(input.plan || input.text || input);
+    return { text: plan, plan };
+  }
+  return { text: normalizeText(input) };
+}
+
+function conditionMatches(condition, context) {
+  const field = condition.field || 'text';
+  const value = Object.hasOwn(context, field) ? context[field] : context.text;
+  return new RegExp(condition.regex, 'ims').test(String(value || ''));
+}
+
+function ruleMatches(rule, context) {
+  const match = rule.match || {};
+  const all = match.all;
+  const any = match.any;
+  const none = match.none;
+  if (Array.isArray(all) && !all.every((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  if (Array.isArray(any) && !any.some((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  if (Array.isArray(none) && none.some((condition) => conditionMatches(condition, context))) {
+    return false;
+  }
+  return Array.isArray(all) || Array.isArray(any);
+}
+
+function excerpt(text) {
+  const compact = redactEvidence(String(text).replace(/\s+/g, ' ').trim());
+  if (compact.length <= 240) return compact;
+  return `${compact.slice(0, 237)}...`;
+}
+
+function evaluate(stage, inputs, options = {}) {
+  const catalog = options.catalog || loadRiskRules(options);
+  const items = Array.isArray(inputs) ? inputs : [inputs];
+  const findings = [];
+
+  for (const input of items) {
+    const context = evaluationContext(stage, input || {});
+    for (const rule of catalog.rules) {
+      if (!rule.stages.includes(stage)) continue;
+      if (!ruleMatches(rule, context)) continue;
+      findings.push({
+        ruleId: rule.id,
+        title: rule.title,
+        category: rule.category,
+        severity: rule.severity,
+        message: rule.message,
+        remediation: rule.remediation,
+        source: input?.path || stage,
+        evidence: excerpt(context.text),
+      });
+    }
+  }
+
+  findings.sort((a, b) => SEVERITY_RANK[b.severity] - SEVERITY_RANK[a.severity]);
+  const hasDeny = findings.some((finding) => finding.severity === 'deny');
+  const hasWarn = findings.some((finding) => finding.severity === 'warn');
+  return {
+    decision: hasDeny ? 'deny' : hasWarn ? 'warn' : 'allow',
+    findings,
+  };
+}
+
+export function evaluateCommandRisk(command, options = {}) {
+  return evaluate('command', { command }, options);
+}
+
+export function evaluateArtifacts(artifacts, options = {}) {
+  return evaluate('artifact', Array.isArray(artifacts) ? artifacts : [], options);
+}
+
+export function evaluateDeployPlan(plan, options = {}) {
+  return evaluate('deploy_plan', { plan }, options);
+}
+
+export function mergeRiskDecision(base, risk) {
+  if (!risk || !risk.findings?.length) return base;
+  if (risk.decision === 'deny') {
+    const topFinding = risk.findings[0];
+    return {
+      ...base,
+      decision: 'deny',
+      risk: topFinding.category,
+      reason: topFinding.message,
+      blockedByRiskRule: true,
+      findings: risk.findings,
+    };
+  }
+  return {
+    ...base,
+    warnings: [...(base.warnings || []), ...risk.findings],
+  };
+}