newmark-agent 0.4.4 → 0.4.6

package/dist/main.js

@@ -55,6 +55,7 @@ const cli_discovery_1 = require("./cli-discovery");
 const config_1 = require("./core/config");
 const memoryLab_1 = require("./core/memoryLab");
 const installUpdate_1 = require("./core/installUpdate");
+const mobilePairing_1 = require("./core/mobilePairing");
 const terminalTakeover_1 = require("./tools/terminalTakeover");
 const nativeBash_1 = require("./core/nativeBash");
 const nativeTools_1 = require("./tools/nativeTools");
@@ -3472,6 +3473,7 @@ else {
                         },
                     configuredAgentBackend: agent.config.getBool('agent', 'run_in_wsl') ? 'wsl' : 'windows',
                     agentBackendRestartRequired: (agent.config.getBool('agent', 'run_in_wsl') ? 'wsl' : 'windows') !== activeAgentBackendMode,
+                    remoteTouchEnabled: agent.config.getBool('remote', 'touch_enabled'),
                     wslAvailable: wslDistros.length > 0,
                     wslDistros,
                 };
@@ -4784,6 +4786,15 @@ else {
                 return { servers: mcpManager.list(), discovered };
             });
             electron_1.ipcMain.handle('dsh:discover', async () => (0, dshCompatibility_1.discoverDshCompatibility)(root));
+            electron_1.ipcMain.handle('dsh:installBundle', async (_event, manifestPath) => {
+                return (0, dshCompatibility_1.installDshBundle)(root, String(manifestPath || ''));
+            });
+            electron_1.ipcMain.handle('dsh:uninstallBundle', async (_event, name) => {
+                return (0, dshCompatibility_1.uninstallDshBundle)(root, String(name || ''));
+            });
+            electron_1.ipcMain.handle('dsh:setBundleEnabled', async (_event, name, enabled) => {
+                return (0, dshCompatibility_1.setDshBundleEnabled)(root, String(name || ''), enabled === true);
+            });
             electron_1.ipcMain.handle('mcp:upsert', async (_event, input) => {
                 if (!mcpManager)
                     return { ok: false, error: 'MCP manager is unavailable.' };
@@ -4855,6 +4866,21 @@ else {
             electron_1.ipcMain.handle('update:version', async () => {
                 return { ok: true, version: (0, installUpdate_1.currentAppVersion)(), root };
             });
+            electron_1.ipcMain.handle('mobile:pairingQr', async () => {
+                const qr = await (0, mobilePairing_1.pairingQrDataUrl)(root);
+                return {
+                    ok: true,
+                    url: qr.session.url,
+                    dataUrl: qr.dataUrl,
+                    pairingId: qr.session.pairingId,
+                    expiresAt: qr.session.expiresAt,
+                    tokenFile: (0, mobilePairing_1.pairingTokenPath)(root),
+                    tailscaleIpv4: (0, mobilePairing_1.tailscaleIpv4)(),
+                };
+            });
+            electron_1.ipcMain.handle('mobile:pairingStatus', async () => {
+                return { ok: true, status: (0, mobilePairing_1.pairingStatus)(root) };
+            });
             electron_1.ipcMain.handle('update:checkGithub', async (_event, input = {}) => {
                 return (0, installUpdate_1.checkGitHubUpdate)(String(input.repo || ''), String(input.tag || ''), String(input.asset || ''));
             });
@@ -4884,6 +4910,29 @@ else {
                     setTimeout(() => electron_1.app.quit(), 150);
                 return result;
             });
+            electron_1.ipcMain.handle('update:planMsi', async (_event, input = {}) => {
+                return (0, installUpdate_1.planManagedMsiInstall)(String(input.msiPath || ''), {
+                    stopConfirmed: input.stopConfirmed === true,
+                    removeLegacyConfirmed: input.removeLegacyConfirmed === true,
+                    uninstallPrevious: input.uninstallPrevious !== false,
+                    allowElevate: input.allowElevate !== false,
+                    excludeRoots: Array.isArray(input.excludeRoots) ? input.excludeRoots.map(String) : undefined,
+                    logDir: typeof input.logDir === 'string' ? input.logDir : undefined,
+                });
+            });
+            electron_1.ipcMain.handle('update:executeMsi', async (_event, input = {}) => {
+                const result = (0, installUpdate_1.executeManagedMsiInstall)(String(input.msiPath || ''), {
+                    stopConfirmed: input.stopConfirmed === true,
+                    removeLegacyConfirmed: input.removeLegacyConfirmed === true,
+                    uninstallPrevious: input.uninstallPrevious !== false,
+                    allowElevate: input.allowElevate !== false,
+                    excludeRoots: Array.isArray(input.excludeRoots) ? input.excludeRoots.map(String) : undefined,
+                    logDir: typeof input.logDir === 'string' ? input.logDir : undefined,
+                });
+                if (result.ok)
+                    setTimeout(() => electron_1.app.quit(), 150);
+                return result;
+            });
             electron_1.ipcMain.handle('github:gh', async (_event, argv = []) => {
                 const safeArgs = Array.isArray(argv) ? argv.map(String).filter(a => a.length < 400) : [];
                 try {

package/dist/preload.js

@@ -124,6 +124,9 @@ contextBridge.exposeInMainWorld('api', {
     refreshSkills: () => ipcRenderer.invoke('skills:refresh'),
     listMcpServers: () => ipcRenderer.invoke('mcp:list'),
     discoverDshCompatibility: () => ipcRenderer.invoke('dsh:discover'),
+    installDshBundle: (manifestPath) => ipcRenderer.invoke('dsh:installBundle', manifestPath),
+    uninstallDshBundle: (name) => ipcRenderer.invoke('dsh:uninstallBundle', name),
+    setDshBundleEnabled: (name, enabled) => ipcRenderer.invoke('dsh:setBundleEnabled', name, enabled),
     upsertMcpServer: (input) => ipcRenderer.invoke('mcp:upsert', input),
     setMcpServerEnabled: (id, enabled) => ipcRenderer.invoke('mcp:setEnabled', id, enabled),
     removeMcpServer: (id) => ipcRenderer.invoke('mcp:remove', id),
@@ -134,6 +137,8 @@ contextBridge.exposeInMainWorld('api', {
     memoryLabUpdate: (input) => ipcRenderer.invoke('memoryLab:update', input),
     memoryLabReindex: () => ipcRenderer.invoke('memoryLab:reindex'),
     updateVersion: () => ipcRenderer.invoke('update:version'),
+    mobilePairingQr: () => ipcRenderer.invoke('mobile:pairingQr'),
+    mobilePairingStatus: () => ipcRenderer.invoke('mobile:pairingStatus'),
     updateCheckGithub: (input) => ipcRenderer.invoke('update:checkGithub', input),
     updateApplyGithub: (input) => ipcRenderer.invoke('update:applyGithub', input),
     updateInstallLocal: (input) => ipcRenderer.invoke('update:installLocal', input),

package/dist/server.js

@@ -37,6 +37,7 @@ exports.runServer = runServer;
 const http = __importStar(require("http"));
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const os = __importStar(require("os"));
 const uiPreferences_1 = require("./core/uiPreferences");
 const child_process_1 = require("child_process");
 const agent_1 = require("./core/agent");
@@ -45,10 +46,76 @@ const config_1 = require("./core/config");
 const flow_1 = require("./core/flow");
 const workspaceFileRouter_1 = require("./core/workspaceFileRouter");
 const nativeBash_1 = require("./core/nativeBash");
+const installUpdate_1 = require("./core/installUpdate");
+const mobilePairing_1 = require("./core/mobilePairing");
 const PORT = 47890;
 let agent = null;
 let automation = null;
 let workspaceFileRouter = null;
+let mobileToken = '';
+let appRoot = '';
+function mobileAuthorized(req) {
+    if (!mobileToken)
+        return false;
+    const bearer = String(req.headers.authorization || '');
+    if (bearer.startsWith('Bearer '))
+        return bearer.slice('Bearer '.length).trim() === mobileToken;
+    try {
+        const url = new URL(req.url || '/', `http://localhost:${PORT}`);
+        const queryToken = url.searchParams.get('token') || '';
+        return queryToken === mobileToken;
+    }
+    catch {
+        return false;
+    }
+}
+function mobileJson(res, data, code = 200) {
+    const body = JSON.stringify(data);
+    res.writeHead(code, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Access-Control-Allow-Origin': '*',
+    });
+    res.end(body);
+}
+function handleMobileEvents(req, res) {
+    if (agent && !agent.config.getBool('remote', 'touch_enabled')) {
+        mobileJson(res, { error: 'Remote touch disabled' }, 403);
+        return;
+    }
+    if (!mobileAuthorized(req)) {
+        mobileJson(res, { error: 'Unauthorized' }, 401);
+        return;
+    }
+    if (!agent) {
+        mobileJson(res, { error: 'Agent not initialized' }, 500);
+        return;
+    }
+    res.writeHead(200, {
+        'Content-Type': 'text/event-stream; charset=utf-8',
+        'Cache-Control': 'no-cache',
+        'Connection': 'keep-alive',
+        'Access-Control-Allow-Origin': '*',
+    });
+    res.write('retry: 3000\n\n');
+    const unsubscribe = agent.subscribeWorkEvents(event => {
+        try {
+            res.write(`event: work\ndata: ${JSON.stringify(event)}\n\n`);
+        }
+        catch {
+            // socket is gone; the close handler will clean up
+        }
+    });
+    const heartbeat = setInterval(() => {
+        try {
+            res.write(': ping\n\n');
+        }
+        catch { }
+    }, 15000);
+    req.on('close', () => {
+        clearInterval(heartbeat);
+        unsubscribe();
+    });
+}
 function resolveAppPath(root, targetPath) {
     if (!targetPath)
         return root;
@@ -214,6 +281,16 @@ function jsonResponse(res, data, code = 200) {
 async function handleApi(req, res, body) {
     const url = new URL(req.url || '/', `http://localhost:${PORT}`);
     const pathname = url.pathname;
+    if (pathname.startsWith('/api/mobile/')) {
+        if (agent && !agent.config.getBool('remote', 'touch_enabled')) {
+            mobileJson(res, { error: 'Remote touch disabled' }, 403);
+            return;
+        }
+        if (!mobileAuthorized(req)) {
+            mobileJson(res, { error: 'Unauthorized' }, 401);
+            return;
+        }
+    }
     if (!agent) {
         jsonResponse(res, { error: 'Agent not initialized' }, 500);
         return;
@@ -603,15 +680,114 @@ async function handleApi(req, res, body) {
                 jsonResponse(res, { content: agent.readArchive(aName2) });
                 return;
             }
+            case '/api/mobile/pair-confirm': {
+                let pairingId = url.searchParams.get('pairingId') || '';
+                if (!pairingId) {
+                    try {
+                        pairingId = String(JSON.parse(body || '{}').pairingId || '');
+                    }
+                    catch { }
+                }
+                const result = (0, mobilePairing_1.confirmPairing)(appRoot, pairingId, mobileToken);
+                mobileJson(res, result.ok
+                    ? { ok: true, status: result.status }
+                    : { ok: false, error: result.error, status: result.status }, result.ok ? 200 : 401);
+                return;
+            }
+            case '/api/mobile/pair-status': {
+                mobileJson(res, { ok: true, status: (0, mobilePairing_1.pairingStatus)(appRoot) });
+                return;
+            }
+            case '/api/mobile/hello': {
+                mobileJson(res, {
+                    ok: true,
+                    version: (0, installUpdate_1.currentAppVersion)(),
+                    hostname: os.hostname(),
+                    platform: process.platform,
+                    tailscaleIpv4: (0, mobilePairing_1.tailscaleIpv4)(),
+                    workspace: agent.workspace.current ? {
+                        id: agent.workspace.current.id,
+                        name: agent.workspace.current.name,
+                        path: agent.workspace.current.path,
+                    } : null,
+                    conversationCount: agent.listConversationStates().length,
+                    activeConversationId: agent.activeConversationId,
+                });
+                return;
+            }
+            case '/api/mobile/state': {
+                const active = agent.getConversationSnapshot(agent.activeConversationId, { window: 200 });
+                mobileJson(res, {
+                    mode: agent.mode,
+                    model: agent.modelSelectionValue(),
+                    status: agent.status,
+                    activeConversationId: agent.activeConversationId,
+                    conversations: agent.listConversationStates(),
+                    workspaces: { internal: agent.workspace.internal, external: agent.workspace.external, current: agent.workspace.current },
+                    pendingOptions: agent.pendingOptions,
+                    contextWindow: agent.contextWindow(),
+                    chatMessages: active.chatMessages,
+                    totalMessages: active.totalMessages,
+                    conversationLocked: agent.isConversationLocked(),
+                });
+                return;
+            }
+            case '/api/mobile/conversations': {
+                mobileJson(res, agent.listConversationStates());
+                return;
+            }
+            case '/api/mobile/conversation': {
+                const conversationId = url.searchParams.get('conversationId') || agent.activeConversationId;
+                const windowParam = url.searchParams.get('window');
+                const beforeParam = url.searchParams.get('before');
+                const windowSize = windowParam ? Math.max(1, Math.min(500, Number(windowParam) || 200)) : 200;
+                const before = beforeParam ? Math.max(0, Number(beforeParam) || 0) : undefined;
+                const snapshot = agent.getConversationSnapshot(String(conversationId), { window: windowSize, before });
+                mobileJson(res, snapshot);
+                return;
+            }
+            case '/api/mobile/workspaces': {
+                mobileJson(res, { internal: agent.workspace.internal, external: agent.workspace.external, current: agent.workspace.current });
+                return;
+            }
+            case '/api/mobile/send': {
+                const params = JSON.parse(body || '{}');
+                const message = String(params.message || '');
+                if (!message) {
+                    mobileJson(res, { error: 'No message' }, 400);
+                    return;
+                }
+                if (params.conversationId)
+                    agent.setConversation(String(params.conversationId));
+                const tokens = await agent.process(message);
+                const snapshot = agent.getConversationSnapshot(agent.activeConversationId, { window: 200 });
+                mobileJson(res, {
+                    ok: true,
+                    conversationId: agent.activeConversationId,
+                    response: tokens.map(token => token.text).join(''),
+                    tokens: tokens.map(token => ({ type: token.type, text: token.text })),
+                    options: agent.pendingOptions,
+                    status: agent.status,
+                    conversations: agent.listConversationStates(),
+                    chatMessages: snapshot.chatMessages,
+                    totalMessages: snapshot.totalMessages,
+                });
+                return;
+            }
             default:
                 jsonResponse(res, { error: 'Unknown API' }, 404);
         }
     }
     catch (e) {
-        jsonResponse(res, { error: e.message }, 500);
+        if (pathname.startsWith('/api/mobile/'))
+            mobileJson(res, { error: e.message }, 500);
+        else
+            jsonResponse(res, { error: e.message }, 500);
     }
 }
 function startServer(root) {
+    mobileToken = (0, mobilePairing_1.ensureMobileToken)(root);
+    appRoot = root;
     agent = new agent_1.Agent(root);
     workspaceFileRouter = new workspaceFileRouter_1.WorkspaceFileRouter(() => path.resolve(agent?.workspace.current?.path || root));
     automation = new automation_1.AutomationManager(agent.config, async (prompt, model, item) => {
@@ -645,11 +821,19 @@ function startServer(root) {
     const uiDir = path.join(__dirname, 'ui');
     const server = http.createServer(async (req, res) => {
         if (req.method === 'OPTIONS') {
-            res.writeHead(204);
+            res.writeHead(204, {
+                'Access-Control-Allow-Origin': '*',
+                'Access-Control-Allow-Headers': 'Authorization, Content-Type',
+                'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+            });
             res.end();
             return;
         }
         const url = new URL(req.url || '/', `http://localhost:${PORT}`);
+        if (url.pathname === '/api/mobile/events') {
+            handleMobileEvents(req, res);
+            return;
+        }
         if (req.method === 'POST' && url.pathname.startsWith('/api/')) {
             let body = '';
             req.on('data', chunk => body += chunk);
@@ -667,9 +851,17 @@ function startServer(root) {
         const fullPath = path.join(uiDir, filePath);
         serveFile(res, fullPath);
     });
-    server.listen(PORT, '127.0.0.1', () => {
+    const bindHost = process.env.NEWMARK_BIND_HOST || '0.0.0.0';
+    const tailscale = (0, mobilePairing_1.tailscaleIpv4)();
+    const tokenPath = path.join(root, '.newmark-mobile-token');
+    server.listen(PORT, bindHost, () => {
         console.log(`\n  Newmark Agent v1.0 - Server Mode`);
+        console.log(`  Bind: ${bindHost}:${PORT}`);
         console.log(`  GUI: http://localhost:${PORT}`);
+        console.log(`  Tailscale IPv4: ${tailscale || 'not detected (install/start Tailscale)'}`);
+        console.log(`  Mobile endpoint: http://${tailscale || '<tailscale-ip>'}:${PORT}/api/mobile/hello?token=<token>`);
+        console.log(`  Mobile token file: ${tokenPath}`);
+        console.log(`  Mobile events (SSE): http://${tailscale || '<tailscale-ip>'}:${PORT}/api/mobile/events?token=<token>`);
         console.log(`  Press Ctrl+C to stop\n`);
     });
 }

package/dist/tools/index.d.ts

@@ -91,13 +91,27 @@ export declare class ToolExecutor {
     private parseGitHubRepo;
     private githubFileAudit;
     private repoSecurityAudit;
+    private collectRepositoryFiles;
     private scanRepositorySecrets;
+    /**
+     * 扫描隐私地址类高危信息：带凭据的 URL（user:pass@）、私网 IP、本地用户目录
+     * 绝对路径（C:\Users\<user>、/home/<user>、/Users/<user>）。这些内容泄露个人
+     * 账号、内网拓扑或本地机器结构，进入公开 remote 即构成隐私暴露，需与密钥同级
+     * 硬性阻挡并在 Agent 二轮审查确认后放行。
+     */
+    private scanRepositoryPrivacyLeaks;
     private releaseExcludedPathFindings;
     private ghJson;
     private gbranch;
     private ghFork;
     private ghPrCreate;
     private withRemoteSecurityPreamble;
+    /**
+     * 硬性阻挡远程写：当密钥或隐私地址类高危信息存在且 Agent 尚未二轮审查确认时，
+     * 返回明确的阻挡结果（脱敏 findings），要求处理/确认后再以
+     * security_review_confirmed=true 重试放行。
+     */
+    private formatRemoteSecurityBlock;
     private gstat;
     private gpull;
     private gpush;