jishushell 0.4.10 → 0.4.24-beta.2

package/dist/services/agent-apps/installers/registry-probe.js

@@ -0,0 +1,183 @@
+/**
+ * OCI / Docker Registry v2 digest lookups via curl.
+ *
+ * We shell out to curl instead of using Node's built-in `fetch` because:
+ *   - Node's fetch (undici) ships a 10 s TCP connect timeout that isn't
+ *     configurable without pulling undici in as a direct dep, and the TLS
+ *     handshake to ghcr.io from edge devices on slow international links
+ *     routinely exceeds that (9–15 s measured from a Pi in mainland China).
+ *   - curl's `--max-time` is wall-clock and reliable.
+ *   - curl is already present on every target platform.
+ *
+ * The call chain implements the standard OCI distribution bearer-token flow:
+ *   1. GET  <realm>?service=...&scope=...            → bearer token
+ *   2. HEAD /v2/<repository>/manifests/<reference>   → docker-content-digest
+ *
+ * Well-known public registries (GHCR, Docker Hub, Quay) always require a
+ * token, so we skip the throwaway unauthenticated probe for them — that
+ * alone saves ~10 s per image on slow WAN links.
+ */
+import { execFile } from "child_process";
+import { promisify } from "util";
+const execFileAsync = promisify(execFile);
+const KNOWN_BEARER_REGISTRIES = new Set([
+    "ghcr.io",
+    "registry-1.docker.io",
+    "docker.io",
+    "quay.io",
+]);
+/** Accept header covering all manifest / index media types. */
+const MANIFEST_ACCEPT = [
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+].join(", ");
+/**
+ * Parse a docker image reference into `{ registry, repository, reference }`.
+ * Handles: "ghcr.io/owner/name:tag", "owner/name:tag" (defaults to Docker
+ * Hub), "name" (defaults to "library/<name>:latest"). Returns null for
+ * digest-pinned refs (no lookup is needed) or malformed strings.
+ */
+export function parseImageRef(image) {
+    if (image.includes("@"))
+        return null;
+    const trimmed = image.trim();
+    if (!trimmed)
+        return null;
+    const firstSlash = trimmed.indexOf("/");
+    const firstSegment = firstSlash === -1 ? "" : trimmed.slice(0, firstSlash);
+    const hasRegistry = firstSegment.includes(".") ||
+        firstSegment.includes(":") ||
+        firstSegment === "localhost";
+    let registry;
+    let rest;
+    if (hasRegistry) {
+        registry = firstSegment;
+        rest = trimmed.slice(firstSlash + 1);
+    }
+    else {
+        registry = "registry-1.docker.io";
+        rest = trimmed.includes("/") ? trimmed : `library/${trimmed}`;
+    }
+    const colon = rest.lastIndexOf(":");
+    let repository;
+    let reference;
+    if (colon === -1 || rest.indexOf("/", colon) !== -1) {
+        repository = rest;
+        reference = "latest";
+    }
+    else {
+        repository = rest.slice(0, colon);
+        reference = rest.slice(colon + 1);
+    }
+    if (!/^[a-z0-9][a-z0-9._\-/]{0,254}$/.test(repository))
+        return null;
+    if (!/^[A-Za-z0-9._\-]{1,128}$/.test(reference))
+        return null;
+    return { registry, repository, reference };
+}
+/**
+ * Fetch the current remote digest (sha256 hex, without the "sha256:" prefix)
+ * for a fully-resolved image reference. Returns null when the registry is
+ * unreachable, the image is private without an auth token we can obtain, or
+ * any other probe failure.
+ */
+export async function fetchRemoteDigest(ref) {
+    const manifestUrl = `https://${ref.registry}/v2/${ref.repository}/manifests/${ref.reference}`;
+    if (KNOWN_BEARER_REGISTRIES.has(ref.registry)) {
+        const token = await fetchBearerToken(`https://${ref.registry}/token`, ref.registry, `repository:${ref.repository}:pull`);
+        if (!token)
+            return null;
+        return headDigestWithAuth(manifestUrl, token);
+    }
+    // Unknown registry: try unauthenticated first, then follow the challenge.
+    const unauth = await curlHead(manifestUrl, { Accept: MANIFEST_ACCEPT });
+    if (unauth.ok) {
+        const d = extractDigest(unauth.headers);
+        if (d)
+            return d;
+    }
+    const challenge = unauth.headers["www-authenticate"] || "";
+    const parsed = parseBearerChallenge(challenge);
+    if (!parsed)
+        return null;
+    const token = await fetchBearerToken(parsed.realm, parsed.service || "", parsed.scope || `repository:${ref.repository}:pull`);
+    if (!token)
+        return null;
+    return headDigestWithAuth(manifestUrl, token);
+}
+async function headDigestWithAuth(manifestUrl, token) {
+    const resp = await curlHead(manifestUrl, {
+        Accept: MANIFEST_ACCEPT,
+        Authorization: `Bearer ${token}`,
+    });
+    return resp.ok ? extractDigest(resp.headers) : null;
+}
+async function fetchBearerToken(realm, service, scope) {
+    const url = new URL(realm);
+    url.searchParams.set("service", service);
+    url.searchParams.set("scope", scope);
+    try {
+        const { stdout } = await execFileAsync("curl", [
+            "--silent", "--fail-with-body", "--show-error",
+            "--max-time", "20",
+            url.toString(),
+        ], { timeout: 25_000, encoding: "utf-8" });
+        const body = JSON.parse(stdout);
+        return body.token || body.access_token || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function curlHead(url, headers) {
+    const args = [
+        "--silent", "--show-error", "--head",
+        "--max-time", "20",
+        "--write-out", "\n__STATUS__%{http_code}\n",
+    ];
+    for (const [k, v] of Object.entries(headers)) {
+        args.push("-H", `${k}: ${v}`);
+    }
+    args.push(url);
+    try {
+        const { stdout } = await execFileAsync("curl", args, {
+            timeout: 25_000,
+            encoding: "utf-8",
+            maxBuffer: 1 * 1024 * 1024,
+        });
+        const statusMatch = stdout.match(/__STATUS__(\d{3})/);
+        const statusCode = statusMatch ? parseInt(statusMatch[1], 10) : 0;
+        const parsed = {};
+        for (const raw of stdout.split(/\r?\n/)) {
+            if (!raw || raw.startsWith("HTTP/") || raw.startsWith("__STATUS__"))
+                continue;
+            const idx = raw.indexOf(":");
+            if (idx > 0) {
+                parsed[raw.slice(0, idx).trim().toLowerCase()] = raw.slice(idx + 1).trim();
+            }
+        }
+        return { ok: statusCode >= 200 && statusCode < 400, statusCode, headers: parsed };
+    }
+    catch {
+        return { ok: false, statusCode: 0, headers: {} };
+    }
+}
+function extractDigest(headers) {
+    const m = headers["docker-content-digest"]?.match(/^sha256:([a-f0-9]{64})$/);
+    return m ? m[1] : null;
+}
+function parseBearerChallenge(header) {
+    if (!/^\s*Bearer\b/i.test(header))
+        return null;
+    const realm = /realm="([^"]+)"/i.exec(header)?.[1];
+    if (!realm)
+        return null;
+    return {
+        realm,
+        service: /service="([^"]+)"/i.exec(header)?.[1],
+        scope: /scope="([^"]+)"/i.exec(header)?.[1],
+    };
+}
+//# sourceMappingURL=registry-probe.js.map

package/dist/services/agent-apps/installers/registry-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-probe.js","sourceRoot":"","sources":["../../../../src/services/agent-apps/installers/registry-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAEjC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,SAAS;IACT,sBAAsB;IACtB,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,eAAe,GAAG;IACtB,yCAAyC;IACzC,4CAA4C;IAC5C,2DAA2D;IAC3D,sDAAsD;CACvD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAQb;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAE1B,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3E,MAAM,WAAW,GACf,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1B,YAAY,KAAK,WAAW,CAAC;IAE/B,IAAI,QAAgB,CAAC;IACrB,IAAI,IAAY,CAAC;IACjB,IAAI,WAAW,EAAE,CAAC;QAChB,QAAQ,GAAG,YAAY,CAAC;QACxB,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC;IACvC,CAAC;SAAM,CAAC;QACN,QAAQ,GAAG,sBAAsB,CAAC;QAClC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,UAAkB,CAAC;IACvB,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,UAAU,GAAG,IAAI,CAAC;QAClB,SAAS,GAAG,QAAQ,CAAC;IACvB,CAAC;SAAM,CAAC;QACN,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAa;IACnD,MAAM,WAAW,GAAG,WAAW,GAAG,CAAC,QAAQ,OAAO,GAAG,CAAC,UAAU,cAAc,GAAG,CAAC,SAAS,EAAE,CAAC;IAE9F,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,WAAW,GAAG,CAAC,QAAQ,QAAQ,EAC/B,GAAG,CAAC,QAAQ,EACZ,cAAc,GAAG,CAAC,UAAU,OAAO,CACpC,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,OAAO,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,0EAA0E;IAC1E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAClC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,OAAO,IAAI,EAAE,EACpB,MAAM,CAAC,KAAK,IAAI,cAAc,GAAG,CAAC,UAAU,OAAO,CACpD,CAAC;IACF,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,kBAAkB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,WAAmB,EACnB,KAAa;IAEb,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;QACvC,MAAM,EAAE,eAAe;QACvB,aAAa,EAAE,UAAU,KAAK,EAAE;KACjC,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAAa,EACb,OAAe,EACf,KAAa;IAEb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACzC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CACpC,MAAM,EACN;YACE,UAAU,EAAE,kBAAkB,EAAE,cAAc;YAC9C,YAAY,EAAE,IAAI;YAClB,GAAG,CAAC,QAAQ,EAAE;SACf,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,CACvC,CAAC;QACF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA8C,CAAC;QAC7E,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,OAA+B;IAE/B,MAAM,IAAI,GAAa;QACrB,UAAU,EAAE,cAAc,EAAE,QAAQ;QACpC,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE,4BAA4B;KAC5C,CAAC;IACF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE;YACnD,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;SAC3B,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;gBAAE,SAAS;YAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC7B,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAA+B;IACpD,MAAM,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7E,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACzB,CAAC;AAED,SAAS,oBAAoB,CAC3B,MAAc;IAEd,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO;QACL,KAAK;QACL,OAAO,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;KAC5C,CAAC;AACJ,CAAC"}

package/dist/services/agent-apps/installers/shell-script.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Installer strategy for shell-script-driven agent apps (Ollama and any other
+ * system tool shipped as a `curl | bash` installer).
+ *
+ * Responsibilities:
+ *   - probe installed version + binary size via `probeCommand`
+ *   - probe update availability via GitHub Releases (when `githubRepo` set)
+ *   - install: fetch script → optional sha256 verify → `sudo -n bash`
+ *   - uninstall: stop+disable systemd unit + rm binary + rm extraCleanup
+ *
+ * Heavy ops stream progress through the shared task-registry so the UI
+ * picks them up via `/api/setup/tasks/:id`, identical to adapter installs.
+ */
+import type { AgentAppSource, InstallStartResult } from "../types.js";
+type ShellScriptSource = Extract<AgentAppSource, {
+    kind: "shell-script";
+}>;
+export declare function probeShellScriptStatus(source: ShellScriptSource): Promise<{
+    installed: boolean;
+    version?: string;
+} | null>;
+export declare function probeShellScriptSizeMB(source: ShellScriptSource): Promise<number | null>;
+/**
+ * Read-only cache lookup used by `buildCardView`. Returns null (UI stays
+ * neutral) until the user clicks "检查更新" at least once, which kicks off
+ * the network probe via `refreshShellScriptUpdateCache`.
+ *
+ * Intentionally NOT falling back to an on-demand probe here — the catalog
+ * endpoint is polled every 5 s and the GitHub Releases API is slow + rate-
+ * limited. See docs/agent-apps-design.md "update checks only on explicit
+ * click".
+ */
+export declare function readShellScriptUpdateAvailable(appId: string): boolean | null;
+export declare function getShellScriptUpdateCacheLastCheckedAt(): number | null;
+/**
+ * Compare installed version vs GitHub Releases latest tag. Writes the
+ * result to the cache and returns it. Called by `checkAllAgentAppUpdates`;
+ * not called from the catalog hot path.
+ */
+export declare function refreshShellScriptUpdateCache(appId: string, source: ShellScriptSource): Promise<boolean | null>;
+export declare function findRunningShellScriptTask(appId: string): {
+    id: string;
+    kind: "install" | "uninstall";
+} | undefined;
+export declare function startShellScriptInstall(appId: string, source: ShellScriptSource): Promise<InstallStartResult>;
+export declare function startShellScriptUninstall(appId: string, source: ShellScriptSource): Promise<InstallStartResult>;
+export {};