luckytri 1.0.0 → 1.0.2

package/server/paths.js

@@ -1,102 +1,102 @@
-import { existsSync, realpathSync } from "node:fs";
-import { homedir } from "node:os";
-import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { fileURLToPath } from "node:url";
-
-// Code and static assets belong to the package; all mutable state belongs to
-// an instance. Neither is ever resolved against the caller's working directory.
-export const PACKAGE_ROOT = fileURLToPath(new URL("../", import.meta.url));
-export const SOURCE_CHECKOUT = existsSync(join(PACKAGE_ROOT, ".git"));
-
-export function defaultHome({
-  platform = process.platform,
-  env = process.env,
-  userHome = homedir(),
-} = {}) {
-  if (platform === "win32")
-    return join(
-      env.LOCALAPPDATA && isAbsolute(env.LOCALAPPDATA)
-        ? env.LOCALAPPDATA
-        : join(userHome, "AppData", "Local"),
-      "LuckyTri",
-    );
-  if (platform === "darwin")
-    return join(userHome, "Library", "Application Support", "LuckyTri");
-  return join(
-    env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME)
-      ? env.XDG_DATA_HOME
-      : join(userHome, ".local", "share"),
-    "luckytri",
-  );
-}
-
-function inside(file, directory) {
-  const part = relative(directory, file);
-  return (
-    !part ||
-    (part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part))
-  );
-}
-
-// Resolve through existing ancestors as well: a symlink must not route user
-// data back into node_modules, where an npm update would delete it.
-function canonical(file) {
-  if (existsSync(file)) return realpathSync(file);
-  const parent = dirname(file);
-  return parent === file
-    ? file
-    : join(canonical(parent), relative(parent, file));
-}
-
-export function runtimePaths(env = process.env) {
-  if (env.LUCKYTRI_HOME && !isAbsolute(env.LUCKYTRI_HOME))
-    throw Error(
-      "LUCKYTRI_HOME / --home 必须是绝对路径 (must be an absolute path)",
-    );
-  const home = canonical(
-    resolve(
-      env.LUCKYTRI_HOME ||
-        (SOURCE_CHECKOUT ? PACKAGE_ROOT : defaultHome({ env })),
-    ),
-  );
-  const data = canonical(join(home, "data"));
-  const config = canonical(join(home, ".env"));
-  const log = canonical(join(data, "launcher.log"));
-  const knowledge = canonical(join(data, "knowledge"));
-  const plugins = canonical(join(data, "plugins"));
-  const database =
-    env.DB_PATH === ":memory:"
-      ? ":memory:"
-      : canonical(resolve(home, env.DB_PATH || join("data", "friend.db")));
-  const backups = canonical(
-    resolve(home, env.BACKUP_DIR || join(dirname(database), "backups")),
-  );
-  if (!SOURCE_CHECKOUT) {
-    for (const file of [
-      home,
-      config,
-      data,
-      database,
-      backups,
-      log,
-      knowledge,
-      plugins,
-    ])
-      if (file !== ":memory:" && inside(file, canonical(PACKAGE_ROOT)))
-        throw Error(
-          "用户数据不能存放在 npm 安装目录内 (user data cannot live inside the npm package)",
-        );
-  }
-  return {
-    package: PACKAGE_ROOT,
-    home,
-    config,
-    data,
-    database,
-    backups,
-    log,
-    knowledge,
-    plugins,
-    public: join(PACKAGE_ROOT, "public"),
-  };
-}
+import { existsSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// Code and static assets belong to the package; all mutable state belongs to
+// an instance. Neither is ever resolved against the caller's working directory.
+export const PACKAGE_ROOT = fileURLToPath(new URL("../", import.meta.url));
+export const SOURCE_CHECKOUT = existsSync(join(PACKAGE_ROOT, ".git"));
+
+export function defaultHome({
+  platform = process.platform,
+  env = process.env,
+  userHome = homedir(),
+} = {}) {
+  if (platform === "win32")
+    return join(
+      env.LOCALAPPDATA && isAbsolute(env.LOCALAPPDATA)
+        ? env.LOCALAPPDATA
+        : join(userHome, "AppData", "Local"),
+      "LuckyTri",
+    );
+  if (platform === "darwin")
+    return join(userHome, "Library", "Application Support", "LuckyTri");
+  return join(
+    env.XDG_DATA_HOME && isAbsolute(env.XDG_DATA_HOME)
+      ? env.XDG_DATA_HOME
+      : join(userHome, ".local", "share"),
+    "luckytri",
+  );
+}
+
+function inside(file, directory) {
+  const part = relative(directory, file);
+  return (
+    !part ||
+    (part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part))
+  );
+}
+
+// Resolve through existing ancestors as well: a symlink must not route user
+// data back into node_modules, where an npm update would delete it.
+function canonical(file) {
+  if (existsSync(file)) return realpathSync(file);
+  const parent = dirname(file);
+  return parent === file
+    ? file
+    : join(canonical(parent), relative(parent, file));
+}
+
+export function runtimePaths(env = process.env) {
+  if (env.LUCKYTRI_HOME && !isAbsolute(env.LUCKYTRI_HOME))
+    throw Error(
+      "LUCKYTRI_HOME / --home 必须是绝对路径 (must be an absolute path)",
+    );
+  const home = canonical(
+    resolve(
+      env.LUCKYTRI_HOME ||
+        (SOURCE_CHECKOUT ? PACKAGE_ROOT : defaultHome({ env })),
+    ),
+  );
+  const data = canonical(join(home, "data"));
+  const config = canonical(join(home, ".env"));
+  const log = canonical(join(data, "launcher.log"));
+  const knowledge = canonical(join(data, "knowledge"));
+  const plugins = canonical(join(data, "plugins"));
+  const database =
+    env.DB_PATH === ":memory:"
+      ? ":memory:"
+      : canonical(resolve(home, env.DB_PATH || join("data", "friend.db")));
+  const backups = canonical(
+    resolve(home, env.BACKUP_DIR || join(dirname(database), "backups")),
+  );
+  if (!SOURCE_CHECKOUT) {
+    for (const file of [
+      home,
+      config,
+      data,
+      database,
+      backups,
+      log,
+      knowledge,
+      plugins,
+    ])
+      if (file !== ":memory:" && inside(file, canonical(PACKAGE_ROOT)))
+        throw Error(
+          "用户数据不能存放在 npm 安装目录内 (user data cannot live inside the npm package)",
+        );
+  }
+  return {
+    package: PACKAGE_ROOT,
+    home,
+    config,
+    data,
+    database,
+    backups,
+    log,
+    knowledge,
+    plugins,
+    public: join(PACKAGE_ROOT, "public"),
+  };
+}

package/server/plugins/api.js

@@ -1,204 +1,204 @@
-import { createReadStream, existsSync, statSync } from "node:fs";
-import { join, normalize } from "node:path";
-import { PERMISSIONS } from "./permissions.js";
-
-const SANDBOX =
-  "sandbox allow-scripts allow-forms; default-src 'none'; img-src data: https:; style-src 'unsafe-inline' *; script-src 'unsafe-inline' *; connect-src 'none'";
-
-function safeFile(root, requestPath) {
-  const relative = normalize(requestPath).replace(/^(\.\.[/\\])+/, "");
-  const file = join(root, relative);
-  if (!file.startsWith(root) || !existsSync(file) || !statSync(file).isFile())
-    return "";
-  return file;
-}
-
-export function mountPlugins(app, plugins) {
-  if (!plugins) return;
-  app.get("/api/plugins", (req, res) => {
-    res.json({ plugins: plugins.list(), permissions: PERMISSIONS });
-  });
-  app.get("/api/plugins/market", async (req, res) => {
-    try {
-      res.json(await plugins.install.catalog());
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/market/stage", async (req, res) => {
-    try {
-      res.json(await plugins.install.stageRegistry(req.body));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/import/url", async (req, res) => {
-    try {
-      res.json(await plugins.install.stageUrl(req.body));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/import/github", async (req, res) => {
-    try {
-      res.json(await plugins.install.stageGithub(req.body.repository));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/import/dir", (req, res) => {
-    try {
-      res.json(plugins.install.stageDir(req.body.dir));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/import/commit", (req, res) => {
-    try {
-      res.json(plugins.install.commit(req.body.token));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/sources", (req, res) => {
-    try {
-      plugins.install.saveRegistry(req.body.url);
-      res.json({ ok: true });
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.delete("/api/plugins/sources/:source", (req, res) => {
-    plugins.install.removeRegistry(req.params.source);
-    res.json({ ok: true });
-  });
-  app.post("/api/plugins/:id/rollback", (req, res) => {
-    try {
-      res.json(plugins.install.rollback(req.params.id));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.delete("/api/plugins/:id", async (req, res) => {
-    try {
-      res.json(
-        await plugins.install.remove(req.params.id, { data: !!req.body?.data }),
-      );
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/:id/grant", (req, res) => {
-    try {
-      res.json(plugins.grant(req.params.id, req.body.permissions || []));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/:id/enable", async (req, res) => {
-    try {
-      res.json(await plugins.enable(req.params.id));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/:id/disable", async (req, res) => {
-    try {
-      res.json(await plugins.disable(req.params.id));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.get("/api/plugins/:id/settings", (req, res) => {
-    try {
-      res.json(plugins.settings(req.params.id));
-    } catch (error) {
-      res.status(404).json({ error: error.message });
-    }
-  });
-  app.put("/api/plugins/:id/settings", (req, res) => {
-    try {
-      res.json(
-        plugins.saveSettings(req.params.id, req.body.values || req.body),
-      );
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.get("/api/plugins/:id/log", (req, res) => {
-    const rows = plugins.db
-      .prepare(
-        "SELECT id,time,kind,level,message FROM plugin_events WHERE plugin_id=? ORDER BY id DESC LIMIT 80",
-      )
-      .all(req.params.id);
-    res.json({ events: rows });
-  });
-  app.get("/api/plugins/actions/pending", (req, res) => {
-    res.json({ actions: plugins.chat.capabilities.pending() });
-  });
-  app.post("/api/plugins/actions/:action/approve", async (req, res) => {
-    try {
-      res.json(await plugins.chat.capabilities.approve(req.params.action));
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.post("/api/plugins/actions/:action/reject", (req, res) => {
-    try {
-      res.json(
-        plugins.chat.capabilities.reject(req.params.action, req.body.reason),
-      );
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.use("/api/plugins/:id/x", async (req, res) => {
-    try {
-      const path = req.path && req.path !== "/" ? req.path : "/";
-      const result = await plugins.handleHttp(
-        req.params.id,
-        req.method,
-        path,
-        req.body,
-      );
-      if (result == null)
-        return res.status(404).json({ error: "插件接口不存在" });
-      res.json(result && typeof result === "object" ? result : { result });
-    } catch (error) {
-      res.status(400).json({ error: error.message });
-    }
-  });
-  app.use("/hook/:id", async (req, res) => {
-    try {
-      const path = req.path && req.path !== "/" ? req.path : "/";
-      const route = plugins.routes.find(
-        (item) => item.id === req.params.id && item.open && item.path === path,
-      );
-      if (!route) return res.status(404).end();
-      const result = await plugins.handleHttp(
-        req.params.id,
-        req.method,
-        path,
-        req.body || {},
-      );
-      res.json(result && typeof result === "object" ? result : { result });
-    } catch {
-      res.status(400).end();
-    }
-  });
-  app.use("/plugin-ui/:id", (req, res) => {
-    const row = plugins.list().find((item) => item.id === req.params.id);
-    const page = row?.manifest.contributes?.page;
-    if (!row?.enabled || !page) return res.status(404).end();
-    const root = join(row.path, "ui");
-    const relative = req.path.replace(/^\//, "") || "index.html";
-    const file = safeFile(root, relative);
-    if (!file) return res.status(404).end();
-    if (file.endsWith(".html")) {
-      res.setHeader("Content-Security-Policy", SANDBOX);
-      res.setHeader("Cache-Control", "no-store");
-    }
-    res.setHeader("Access-Control-Allow-Origin", "*");
-    createReadStream(file).pipe(res);
-  });
-}
+import { createReadStream, existsSync, statSync } from "node:fs";
+import { join, normalize } from "node:path";
+import { PERMISSIONS } from "./permissions.js";
+
+const SANDBOX =
+  "sandbox allow-scripts allow-forms; default-src 'none'; img-src data: https:; style-src 'unsafe-inline' *; script-src 'unsafe-inline' *; connect-src 'none'";
+
+function safeFile(root, requestPath) {
+  const relative = normalize(requestPath).replace(/^(\.\.[/\\])+/, "");
+  const file = join(root, relative);
+  if (!file.startsWith(root) || !existsSync(file) || !statSync(file).isFile())
+    return "";
+  return file;
+}
+
+export function mountPlugins(app, plugins) {
+  if (!plugins) return;
+  app.get("/api/plugins", (req, res) => {
+    res.json({ plugins: plugins.list(), permissions: PERMISSIONS });
+  });
+  app.get("/api/plugins/market", async (req, res) => {
+    try {
+      res.json(await plugins.install.catalog());
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/market/stage", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageRegistry(req.body));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/url", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageUrl(req.body));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/github", async (req, res) => {
+    try {
+      res.json(await plugins.install.stageGithub(req.body.repository));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/dir", (req, res) => {
+    try {
+      res.json(plugins.install.stageDir(req.body.dir));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/import/commit", (req, res) => {
+    try {
+      res.json(plugins.install.commit(req.body.token));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/sources", (req, res) => {
+    try {
+      plugins.install.saveRegistry(req.body.url);
+      res.json({ ok: true });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.delete("/api/plugins/sources/:source", (req, res) => {
+    plugins.install.removeRegistry(req.params.source);
+    res.json({ ok: true });
+  });
+  app.post("/api/plugins/:id/rollback", (req, res) => {
+    try {
+      res.json(plugins.install.rollback(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.delete("/api/plugins/:id", async (req, res) => {
+    try {
+      res.json(
+        await plugins.install.remove(req.params.id, { data: !!req.body?.data }),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/grant", (req, res) => {
+    try {
+      res.json(plugins.grant(req.params.id, req.body.permissions || []));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/enable", async (req, res) => {
+    try {
+      res.json(await plugins.enable(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/:id/disable", async (req, res) => {
+    try {
+      res.json(await plugins.disable(req.params.id));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.get("/api/plugins/:id/settings", (req, res) => {
+    try {
+      res.json(plugins.settings(req.params.id));
+    } catch (error) {
+      res.status(404).json({ error: error.message });
+    }
+  });
+  app.put("/api/plugins/:id/settings", (req, res) => {
+    try {
+      res.json(
+        plugins.saveSettings(req.params.id, req.body.values || req.body),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.get("/api/plugins/:id/log", (req, res) => {
+    const rows = plugins.db
+      .prepare(
+        "SELECT id,time,kind,level,message FROM plugin_events WHERE plugin_id=? ORDER BY id DESC LIMIT 80",
+      )
+      .all(req.params.id);
+    res.json({ events: rows });
+  });
+  app.get("/api/plugins/actions/pending", (req, res) => {
+    res.json({ actions: plugins.chat.capabilities.pending() });
+  });
+  app.post("/api/plugins/actions/:action/approve", async (req, res) => {
+    try {
+      res.json(await plugins.chat.capabilities.approve(req.params.action));
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.post("/api/plugins/actions/:action/reject", (req, res) => {
+    try {
+      res.json(
+        plugins.chat.capabilities.reject(req.params.action, req.body.reason),
+      );
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.use("/api/plugins/:id/x", async (req, res) => {
+    try {
+      const path = req.path && req.path !== "/" ? req.path : "/";
+      const result = await plugins.handleHttp(
+        req.params.id,
+        req.method,
+        path,
+        req.body,
+      );
+      if (result == null)
+        return res.status(404).json({ error: "插件接口不存在" });
+      res.json(result && typeof result === "object" ? result : { result });
+    } catch (error) {
+      res.status(400).json({ error: error.message });
+    }
+  });
+  app.use("/hook/:id", async (req, res) => {
+    try {
+      const path = req.path && req.path !== "/" ? req.path : "/";
+      const route = plugins.routes.find(
+        (item) => item.id === req.params.id && item.open && item.path === path,
+      );
+      if (!route) return res.status(404).end();
+      const result = await plugins.handleHttp(
+        req.params.id,
+        req.method,
+        path,
+        req.body || {},
+      );
+      res.json(result && typeof result === "object" ? result : { result });
+    } catch {
+      res.status(400).end();
+    }
+  });
+  app.use("/plugin-ui/:id", (req, res) => {
+    const row = plugins.list().find((item) => item.id === req.params.id);
+    const page = row?.manifest.contributes?.page;
+    if (!row?.enabled || !page) return res.status(404).end();
+    const root = join(row.path, "ui");
+    const relative = req.path.replace(/^\//, "") || "index.html";
+    const file = safeFile(root, relative);
+    if (!file) return res.status(404).end();
+    if (file.endsWith(".html")) {
+      res.setHeader("Content-Security-Policy", SANDBOX);
+      res.setHeader("Cache-Control", "no-store");
+    }
+    res.setHeader("Access-Control-Allow-Origin", "*");
+    createReadStream(file).pipe(res);
+  });
+}