msdevflow 0.6.0

package/skill/msdevflow/scripts/openlibing_ci.py

@@ -0,0 +1,574 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import argparse
+import importlib
+import json
+import os
+import re
+import shutil
+import stat
+import subprocess
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from pathlib import Path
+from typing import Any, Callable
+
+BASE_URL = "https://www.openlibing.com"
+FAILURE_STATUSES = {"FAILED", "FAILURE", "ERROR"}
+
+if os.name == "nt":
+    sys.stdout.reconfigure(encoding="utf-8")
+    sys.stderr.reconfigure(encoding="utf-8")
+ERROR_PATTERN = re.compile(
+    r"\[\s*FAILED\s*\]|Finished:\s*FAILURE|Expected:|Actual:|Assertion|"
+    r"Segmentation fault|script returned exit code|:\d+(?::\d+)?:\s*(?:fatal\s+)?error:",
+    re.IGNORECASE,
+)
+
+
+class OpenLibingAuthRequired(RuntimeError):
+    pass
+
+
+class OpenLibingBrowserRequired(OpenLibingAuthRequired):
+    def __init__(self, message: str, oauth_url: str) -> None:
+        super().__init__(message)
+        self.oauth_url = oauth_url
+
+
+def oauth_authorization_url(base_url: str = BASE_URL) -> str:
+    return f"{base_url.rstrip('/')}/gateway/oauth2/authorization/gitcode"
+
+
+def find_browser() -> str | None:
+    candidates = [
+        os.getenv("OPENLIBING_BROWSER_PATH", ""),
+        os.path.expandvars(r"%PROGRAMFILES%\Google\Chrome\Application\chrome.exe"),
+        os.path.expandvars(r"%PROGRAMFILES(X86)%\Google\Chrome\Application\chrome.exe"),
+        os.path.expandvars(r"%LOCALAPPDATA%\Google\Chrome\Application\chrome.exe"),
+        os.path.expandvars(r"%PROGRAMFILES%\Microsoft\Edge\Application\msedge.exe"),
+        os.path.expandvars(r"%PROGRAMFILES(X86)%\Microsoft\Edge\Application\msedge.exe"),
+        os.path.expandvars(r"%LOCALAPPDATA%\Microsoft\Edge\Application\msedge.exe"),
+        "/usr/bin/google-chrome",
+        "/usr/bin/google-chrome-stable",
+        "/usr/bin/chromium",
+        "/usr/bin/chromium-browser",
+        "/usr/bin/microsoft-edge",
+        "/usr/bin/microsoft-edge-stable",
+        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome",
+        "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge",
+    ]
+    return next((path for path in candidates if path and Path(path).is_file()), None)
+
+
+def default_profile_dir() -> Path:
+    configured = os.getenv("OPENLIBING_PROFILE_DIR")
+    return Path(configured).expanduser() if configured else Path.home() / ".claude" / "openlibing-browser-profile"
+
+
+PROFILE_MARKER = ".msdevflow-openlibing-profile"
+PROFILE_MARKER_CONTENT = "managed-by=msdevflow\n"
+LEGACY_PROFILE_MARKERS = {
+    ".gitcode-e2e-openlibing-profile": {
+        "managed-by=gitcode-e2e-workflow\n",
+        PROFILE_MARKER_CONTENT,
+    },
+}
+PROFILE_METADATA = "session.json"
+
+
+def profile_marker(profile_dir: Path) -> Path:
+    return profile_dir / PROFILE_MARKER
+
+
+def valid_marker(marker: Path, accepted_contents: set[str]) -> bool:
+    try:
+        return marker.is_file() and marker.read_text(encoding="utf-8") in accepted_contents
+    except OSError:
+        return False
+
+
+def managed_profile_marker(profile_dir: Path) -> Path | None:
+    marker = profile_marker(profile_dir)
+    if valid_marker(marker, {PROFILE_MARKER_CONTENT}):
+        return marker
+    return next((
+        profile_dir / name
+        for name, contents in LEGACY_PROFILE_MARKERS.items()
+        if valid_marker(profile_dir / name, contents)
+    ), None)
+
+
+def prepare_profile_dir(profile_dir: Path) -> None:
+    existing_marker = managed_profile_marker(profile_dir)
+    if profile_dir.is_dir() and existing_marker is None and any(profile_dir.iterdir()):
+        raise OpenLibingAuthRequired("拒绝使用：非空目录不是由 msdevflow 管理的 openLiBing profile。")
+    profile_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+    if os.name != "nt":
+        profile_dir.chmod(stat.S_IRWXU)
+    marker = profile_marker(profile_dir)
+    marker.write_text(PROFILE_MARKER_CONTENT, encoding="utf-8")
+    if os.name != "nt":
+        marker.chmod(stat.S_IRUSR | stat.S_IWUSR)
+    for legacy_name, contents in LEGACY_PROFILE_MARKERS.items():
+        legacy_marker = profile_dir / legacy_name
+        if valid_marker(legacy_marker, contents):
+            legacy_marker.unlink()
+
+
+def write_profile_metadata(profile_dir: Path, browser_path: str | None) -> None:
+    metadata = profile_dir / PROFILE_METADATA
+    previous: dict[str, Any] = {}
+    if metadata.is_file():
+        try:
+            previous = json.loads(metadata.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            previous = {}
+    now = int(time.time())
+    metadata.write_text(json.dumps({
+        "created_at": previous.get("created_at", now),
+        "last_used_at": now,
+        "browser": Path(browser_path).name if browser_path else "playwright-chromium",
+        "stores": "gitcode-browser-session; openlibing-storage-cleared-after-use",
+    }, ensure_ascii=False, indent=2), encoding="utf-8")
+    if os.name != "nt":
+        metadata.chmod(stat.S_IRUSR | stat.S_IWUSR)
+
+
+def profile_status(profile_dir: Path) -> dict[str, Any]:
+    managed = managed_profile_marker(profile_dir) is not None
+    result: dict[str, Any] = {
+        "profile_dir": str(profile_dir),
+        "exists": profile_dir.is_dir(),
+        "managed": managed,
+        "cookie_values_read": False,
+    }
+    metadata = profile_dir / PROFILE_METADATA
+    if managed and metadata.is_file():
+        try:
+            result["metadata"] = json.loads(metadata.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            result["metadata"] = "unavailable"
+    return result
+
+
+def clear_profile_dir(profile_dir: Path) -> None:
+    resolved = profile_dir.resolve()
+    if managed_profile_marker(resolved) is None:
+        raise RuntimeError("拒绝删除：目录不是由 msdevflow 管理的 openLiBing profile。")
+    shutil.rmtree(resolved)
+
+
+def clear_openlibing_storage(context: Any, page: Any, base_url: str) -> None:
+    page.goto("about:blank")
+    host = urllib.parse.urlparse(base_url).hostname or "openlibing.com"
+    context.clear_cookies(domain=re.compile(rf"(^|\.){re.escape(host)}$"))
+    try:
+        cdp = context.new_cdp_session(page)
+        cdp.send("Storage.clearDataForOrigin", {
+            "origin": base_url,
+            "storageTypes": "all",
+        })
+        cdp.detach()
+    except Exception:
+        # Cookie removal is mandatory; non-Cookie storage cleanup is best-effort.
+        pass
+    if context.cookies([base_url]):
+        raise OpenLibingAuthRequired("无法从持久 profile 清除 openLiBing Cookie，已拒绝保存会话。")
+
+
+def oauth_requirements_file() -> Path:
+    return Path(__file__).with_name("requirements.txt")
+
+
+def ensure_playwright() -> None:
+    try:
+        importlib.import_module("playwright.sync_api")
+        return
+    except ImportError:
+        requirements = oauth_requirements_file()
+        if not requirements.is_file():
+            raise OpenLibingAuthRequired("缺少 openLiBing OAuth 依赖清单，无法自动安装 Playwright。")
+        result = subprocess.run(
+            [sys.executable, "-m", "pip", "install", "-r", str(requirements)],
+            check=False,
+        )
+        if result.returncode != 0:
+            raise OpenLibingAuthRequired("自动安装 Playwright 失败。")
+        importlib.invalidate_caches()
+        try:
+            importlib.import_module("playwright.sync_api")
+        except ImportError as error:
+            raise OpenLibingAuthRequired("Playwright 安装完成但当前 Python 无法导入。") from error
+
+
+def playwright_chromium_path() -> Path:
+    from playwright.sync_api import sync_playwright
+
+    with sync_playwright() as playwright:
+        return Path(playwright.chromium.executable_path)
+
+
+def ensure_playwright_browser(base_url: str = BASE_URL) -> str | None:
+    executable = find_browser()
+    if executable:
+        return executable
+    try:
+        if playwright_chromium_path().is_file():
+            return None
+    except Exception:
+        pass
+    raise OpenLibingBrowserRequired(
+        "没有可由 Playwright 控制的 Chrome/Edge。请复制 oauth_url 到浏览器继续登录；本次固定 run 尚未验证。",
+        oauth_authorization_url(base_url),
+    )
+
+
+def interactive_oauth_login(
+    base_url: str = BASE_URL,
+    timeout_seconds: int = 300,
+    profile_dir: Path | None = None,
+    persistent: bool = True,
+) -> str:
+    ensure_playwright()
+    executable = ensure_playwright_browser(base_url)
+    from playwright.sync_api import sync_playwright
+
+    selected_profile = (profile_dir or default_profile_dir()).resolve()
+    if persistent:
+        try:
+            prepare_profile_dir(selected_profile)
+        except OSError as error:
+            raise OpenLibingAuthRequired("无法准备专用浏览器 profile。") from error
+    with sync_playwright() as playwright:
+        launch_options: dict[str, Any] = {"headless": False}
+        if executable:
+            launch_options["executable_path"] = executable
+        browser = None
+        try:
+            if persistent:
+                context = playwright.chromium.launch_persistent_context(
+                    user_data_dir=str(selected_profile),
+                    **launch_options,
+                )
+            else:
+                browser = playwright.chromium.launch(**launch_options)
+                context = browser.new_context()
+        except Exception as error:
+            raise OpenLibingBrowserRequired(
+                "Playwright 无法启动可见浏览器。请复制 oauth_url 到浏览器继续登录；本次固定 run 尚未验证。",
+                oauth_authorization_url(base_url),
+            ) from error
+        page = context.pages[0] if context.pages else context.new_page()
+        deadline = time.monotonic() + timeout_seconds
+        next_progress = time.monotonic()
+        token = ""
+        try:
+            print(
+                "请在打开的浏览器中完成 GitCode 登录，并在授权页手动点击授权。专用 profile 会保存 GitCode 浏览器会话；openLiBing token 不会持久化。",
+                file=sys.stderr,
+            )
+            page.goto(oauth_authorization_url(base_url), wait_until="domcontentloaded", timeout=45_000)
+            while time.monotonic() < deadline:
+                for cookie in context.cookies([base_url]):
+                    if cookie.get("name") == "token":
+                        token = str(cookie.get("value", ""))
+                        break
+                if token:
+                    break
+                if time.monotonic() >= next_progress:
+                    current = urllib.parse.urlparse(page.url)
+                    stage = "waiting-user-consent" if current.netloc == "gitcode.com" and current.path.startswith("/oauth/authorize") else "waiting-openlibing-callback"
+                    print(f"{stage}：{current.scheme}://{current.netloc}{current.path}", file=sys.stderr)
+                    next_progress = time.monotonic() + 15
+                page.wait_for_timeout(1000)
+            if not token:
+                raise OpenLibingAuthRequired("OAuth 登录超时，未获得 openLiBing 会话。")
+            if persistent:
+                write_profile_metadata(selected_profile, executable)
+            clear_openlibing_storage(context, page, base_url)
+        finally:
+            context.close()
+            if browser is not None:
+                browser.close()
+    return token
+
+
+class OpenLibingReadClient:
+    def __init__(
+        self,
+        base_url: str = BASE_URL,
+        allow_oauth: bool = False,
+        oauth_login: Callable[[], str] | None = None,
+    ) -> None:
+        self.base_url = base_url.rstrip("/")
+        self.allow_oauth = allow_oauth
+        self.oauth_login = oauth_login or (lambda: interactive_oauth_login(self.base_url))
+        self._token = ""
+        self.auth_path = "anonymous-read"
+
+    def _request(self, method: str, path: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
+        headers = {
+            "Accept": "application/json",
+            "Content-Type": "application/json",
+            "User-Agent": "msdevflow/openlibing-read",
+        }
+        if self._token:
+            headers["Csrf-Token-Open-Li-Bing"] = self._token
+        request = urllib.request.Request(
+            self.base_url + path,
+            data=json.dumps(payload).encode() if payload is not None else None,
+            headers=headers,
+            method=method,
+        )
+        with urllib.request.urlopen(request, timeout=60) as response:
+            return json.loads(response.read().decode())
+
+    def request(self, method: str, path: str, payload: dict[str, Any] | None = None) -> dict[str, Any]:
+        try:
+            return self._request(method, path, payload)
+        except urllib.error.HTTPError as error:
+            if error.code not in (401, 403) or self._token:
+                raise
+            if not self.allow_oauth:
+                raise OpenLibingAuthRequired(
+                    "openLiBing 只读接口要求认证。经用户确认后使用 --oauth，或连接已部署的 BFF/Adapter。"
+                ) from error
+            self._token = self.oauth_login()
+            self.auth_path = "interactive-oauth"
+            return self._request(method, path, payload)
+
+    def authenticate(self) -> None:
+        self._token = self.oauth_login()
+        self.auth_path = "interactive-oauth"
+
+    def detail(self, project_id: str, pipeline_id: str, run_id: str) -> dict[str, Any]:
+        query = urllib.parse.urlencode({
+            "projectId": project_id,
+            "pipelineId": pipeline_id,
+            "pipelineRunId": run_id,
+        })
+        return self.request(
+            "GET",
+            f"/gateway/openlibing-cicd/project/pipeline/pipeline-run/detail?{query}",
+        )
+
+    def logs(
+        self,
+        project_id: str,
+        pipeline_id: str,
+        run_id: str,
+        job_run_id: str,
+        step_run_id: str,
+        limit: int,
+    ) -> str:
+        response = self.request(
+            "POST",
+            "/gateway/openlibing-cicd/project/pipeline/exec-log",
+            {
+                "projectId": project_id,
+                "pipelineId": pipeline_id,
+                "pipelineRunId": run_id,
+                "jobRunId": job_run_id,
+                "stepRunId": step_run_id,
+                "sort": "desc",
+                "limit": limit,
+                "startOffset": 0,
+                "endOffset": 0,
+            },
+        )
+        return str((response.get("data") or {}).get("log", ""))
+
+
+def failed_steps(detail: dict[str, Any]) -> list[dict[str, str]]:
+    failures: list[dict[str, str]] = []
+    for stage in (detail.get("data") or {}).get("stages", []):
+        for job in stage.get("jobs", []):
+            job_failed = str(job.get("status", "")).upper() in FAILURE_STATUSES
+            for step in job.get("steps", []):
+                step_failed = str(step.get("status", "")).upper() in FAILURE_STATUSES
+                if job_failed or step_failed:
+                    failures.append({
+                        "stage": str(stage.get("name", "")),
+                        "job": str(job.get("name", "")),
+                        "job_status": str(job.get("status", "")),
+                        "job_run_id": str(job.get("id", "")),
+                        "step": str(step.get("name", "")),
+                        "step_status": str(step.get("status", "")),
+                        "step_run_id": str(step.get("id", "")),
+                    })
+    return failures
+
+
+def error_excerpt(log: str, context: int = 3) -> list[str]:
+    lines = log.splitlines()
+    selected: set[int] = set()
+    for index, line in enumerate(lines):
+        if ERROR_PATTERN.search(line):
+            selected.update(range(max(0, index - context), min(len(lines), index + context + 1)))
+    return [lines[index] for index in sorted(selected)][-120:]
+
+
+def oauth_login_for_args(args: argparse.Namespace) -> Callable[[], str]:
+    return lambda: interactive_oauth_login(
+        profile_dir=Path(args.profile_dir).expanduser() if args.profile_dir else None,
+        persistent=not args.temporary_session,
+    )
+
+
+def diagnose(args: argparse.Namespace) -> int:
+    client = OpenLibingReadClient(
+        allow_oauth=args.oauth,
+        oauth_login=oauth_login_for_args(args),
+    )
+    detail = client.detail(args.project_id, args.pipeline_id, args.run_id)
+    failures = failed_steps(detail)
+    result: dict[str, Any] = {
+        "auth_path": client.auth_path,
+        "run": {
+            "id": str((detail.get("data") or {}).get("id", args.run_id)),
+            "number": (detail.get("data") or {}).get("run_number"),
+            "status": (detail.get("data") or {}).get("status"),
+        },
+        "failures": [],
+    }
+    for failure in failures:
+        log = client.logs(
+            args.project_id,
+            args.pipeline_id,
+            args.run_id,
+            failure["job_run_id"],
+            failure["step_run_id"],
+            args.limit,
+        )
+        result["failures"].append({**failure, "error_excerpt": error_excerpt(log)})
+    result["auth_path"] = client.auth_path
+    print(json.dumps(result, ensure_ascii=False, indent=2))
+    return 0
+
+
+def login_check(args: argparse.Namespace) -> int:
+    client = OpenLibingReadClient(
+        allow_oauth=True,
+        oauth_login=oauth_login_for_args(args),
+    )
+    client.authenticate()
+    detail = client.detail(args.project_id, args.pipeline_id, args.run_id)
+    data = detail.get("data") or {}
+    print(json.dumps({
+        "auth_path": client.auth_path,
+        "authenticated": True,
+        "run": {
+            "id": str(data.get("id", args.run_id)),
+            "number": data.get("run_number"),
+            "status": data.get("status"),
+        },
+        "token_output": "redacted",
+        "token_persistence": "process-memory-only",
+        "browser_session": "temporary" if args.temporary_session else "persistent-dedicated-profile",
+        "profile_dir": None if args.temporary_session else str(
+            Path(args.profile_dir).expanduser() if args.profile_dir else default_profile_dir()
+        ),
+    }, ensure_ascii=False, indent=2))
+    return 0
+
+
+def session_status(args: argparse.Namespace) -> int:
+    selected = Path(args.profile_dir).expanduser() if args.profile_dir else default_profile_dir()
+    print(json.dumps(profile_status(selected.resolve()), ensure_ascii=False, indent=2))
+    return 0
+
+
+def session_clear(args: argparse.Namespace) -> int:
+    selected = Path(args.profile_dir).expanduser() if args.profile_dir else default_profile_dir()
+    if not args.yes:
+        print(json.dumps({
+            "error": "confirmation-required",
+            "profile_dir": str(selected),
+            "message": "清除专用浏览器会话需要 --yes。",
+        }, ensure_ascii=False))
+        return 4
+    clear_profile_dir(selected)
+    print(json.dumps({"cleared": True, "profile_dir": str(selected)}, ensure_ascii=False))
+    return 0
+
+
+def add_profile_arguments(command: argparse.ArgumentParser) -> None:
+    command.add_argument(
+        "--profile-dir",
+        default="",
+        help="Dedicated browser profile directory (default: ~/.claude/openlibing-browser-profile)",
+    )
+    command.add_argument(
+        "--temporary-session",
+        action="store_true",
+        help="Do not persist the dedicated GitCode browser session",
+    )
+
+
+def add_run_arguments(command: argparse.ArgumentParser) -> None:
+    command.add_argument("--project-id", required=True)
+    command.add_argument("--pipeline-id", required=True)
+    command.add_argument("--run-id", required=True)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Safe openLiBing read-only CI diagnostics")
+    subparsers = parser.add_subparsers(dest="command", required=True)
+    command = subparsers.add_parser("diagnose", help="Read run detail and failed step logs")
+    add_run_arguments(command)
+    add_profile_arguments(command)
+    command.add_argument("--limit", type=int, default=5000)
+    command.add_argument(
+        "--oauth",
+        action="store_true",
+        help="On 401/403, open a local browser for interactive OAuth; never prints or stores token",
+    )
+    login_command = subparsers.add_parser(
+        "login-check",
+        help="Force an interactive OAuth login, then verify it with a read-only run request",
+    )
+    add_run_arguments(login_command)
+    add_profile_arguments(login_command)
+    status_command = subparsers.add_parser(
+        "session-status",
+        help="Show dedicated profile metadata without reading cookie values",
+    )
+    status_command.add_argument("--profile-dir", default="")
+    clear_command = subparsers.add_parser(
+        "session-clear",
+        help="Delete a managed dedicated browser profile",
+    )
+    clear_command.add_argument("--profile-dir", default="")
+    clear_command.add_argument("--yes", action="store_true")
+    args = parser.parse_args()
+    try:
+        if args.command == "login-check":
+            return login_check(args)
+        if args.command == "session-status":
+            return session_status(args)
+        if args.command == "session-clear":
+            return session_clear(args)
+        return diagnose(args)
+    except OpenLibingBrowserRequired as error:
+        print(json.dumps({
+            "error": "browser-required",
+            "message": str(error),
+            "oauth_url": error.oauth_url,
+            "verification": "not-completed",
+        }, ensure_ascii=False))
+        return 5
+    except OpenLibingAuthRequired as error:
+        print(json.dumps({"error": "openlibing-auth-required", "message": str(error)}, ensure_ascii=False))
+        return 3
+    except urllib.error.HTTPError as error:
+        print(json.dumps({"error": "openlibing-http-error", "status": error.code}, ensure_ascii=False))
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skill/msdevflow/scripts/requirements.txt

@@ -0,0 +1 @@
+playwright>=1.54,<2