nolo-cli 0.1.23 → 0.1.29

package/server/services/browserSessionManager.ts

@@ -0,0 +1,354 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import type { Browser, LaunchOptions, Page } from "playwright";
+
+type BrowserProvider = "chromium" | "lightpanda";
+type PlaywrightChromium = typeof import("playwright")["chromium"];
+
+interface BrowserSession {
+  page: Page;
+  createdAt: number;
+}
+
+interface LightpandaConfig {
+  binPath: string;
+  host: string;
+  port: number;
+  startupTimeoutMs: number;
+  disableTelemetry: boolean;
+  cdpEndpoint: string;
+}
+
+const activeSessions = new Map<string, BrowserSession>();
+let browserInstance: Browser | null = null;
+let browserStartupPromise: Promise<Browser> | null = null;
+let lightpandaProcess: ChildProcess | null = null;
+let cleanupRegistered = false;
+let playwrightChromium: PlaywrightChromium | null = null;
+
+const SESSION_TIMEOUT_MS = 5 * 60 * 1000;
+const MAX_CONCURRENT_SESSIONS = 3;
+const LIGHTPANDA_RETRY_INTERVAL_MS = 250;
+const DEFAULT_BROWSER_USER_AGENT =
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36";
+const DEFAULT_BROWSER_INIT_SCRIPT = `
+Object.defineProperty(navigator, "webdriver", {
+  get: () => undefined,
+});
+Object.defineProperty(navigator, "languages", {
+  get: () => ["en-US", "en"],
+});
+Object.defineProperty(navigator, "platform", {
+  get: () => "Win32",
+});
+`;
+
+function normalizeBrowserProvider(rawProvider: string | undefined): BrowserProvider {
+  const provider = rawProvider?.trim().toLowerCase();
+  if (!provider || provider === "chromium") {
+    return "chromium";
+  }
+
+  if (provider === "lightpanda") {
+    return "lightpanda";
+  }
+
+  throw new Error(
+    `未知的浏览器提供方: ${rawProvider}。请使用 BROWSER_PROVIDER=chromium 或 lightpanda。`
+  );
+}
+
+function getBrowserProvider(): BrowserProvider {
+  return normalizeBrowserProvider(process.env.BROWSER_PROVIDER);
+}
+
+function parsePositiveInteger(value: string | undefined, fallback: number, envName: string): number {
+  if (!value) return fallback;
+  const parsed = Number(value);
+  if (!Number.isInteger(parsed) || parsed <= 0) {
+    throw new Error(`${envName} 必须是正整数，当前收到: ${value}`);
+  }
+  return parsed;
+}
+
+function getChromiumLaunchOptions(): LaunchOptions {
+  return {
+    args: [
+      "--no-sandbox",
+      "--disable-setuid-sandbox",
+      "--disable-dev-shm-usage",
+      "--disable-background-timer-throttling",
+      "--disable-backgrounding-occluded-windows",
+      "--disable-breakpad",
+      "--disable-component-extensions-with-background-pages",
+      "--disable-extensions",
+      "--disable-features=Translate,BackForwardCache,AcceptCHFrame,MediaRouter,OptimizationHints",
+      "--disable-ipc-flooding-protection",
+      "--disable-renderer-backgrounding",
+      "--mute-audio",
+      "--no-first-run",
+    ],
+    headless: true,
+  };
+}
+
+function getLightpandaConfig(): LightpandaConfig {
+  const binPath = process.env.LIGHTPANDA_BIN?.trim();
+  if (!binPath) {
+    throw new Error(
+      "启用 Lightpanda 时必须设置 LIGHTPANDA_BIN，例如 LIGHTPANDA_BIN=/usr/local/bin/lightpanda。"
+    );
+  }
+
+  const host = process.env.LIGHTPANDA_HOST?.trim() || "127.0.0.1";
+  const port = parsePositiveInteger(process.env.LIGHTPANDA_PORT, 9222, "LIGHTPANDA_PORT");
+
+  return {
+    binPath,
+    host,
+    port,
+    startupTimeoutMs: parsePositiveInteger(
+      process.env.LIGHTPANDA_STARTUP_TIMEOUT_MS,
+      10000,
+      "LIGHTPANDA_STARTUP_TIMEOUT_MS"
+    ),
+    disableTelemetry: process.env.LIGHTPANDA_DISABLE_TELEMETRY !== "0",
+    cdpEndpoint: process.env.LIGHTPANDA_CDP_ENDPOINT?.trim() || `ws://${host}:${port}`,
+  };
+}
+
+function registerCleanupHandlers() {
+  if (cleanupRegistered) return;
+  cleanupRegistered = true;
+
+  process.on("exit", () => {
+    void browserInstance?.close().catch(() => {});
+    if (lightpandaProcess && lightpandaProcess.exitCode === null && !lightpandaProcess.killed) {
+      lightpandaProcess.kill();
+    }
+  });
+}
+
+function attachBrowserLifecycle(browser: Browser) {
+  browser.once("disconnected", () => {
+    if (browserInstance === browser) {
+      browserInstance = null;
+    }
+  });
+}
+
+function attachLightpandaLifecycle(child: ChildProcess) {
+  child.once("exit", () => {
+    if (lightpandaProcess === child) {
+      lightpandaProcess = null;
+    }
+  });
+}
+
+async function getPlaywrightChromium(): Promise<PlaywrightChromium> {
+  if (!playwrightChromium) {
+    const playwright = await import("playwright");
+    playwrightChromium = playwright.chromium;
+  }
+  return playwrightChromium;
+}
+
+async function connectToLightpanda(config: LightpandaConfig): Promise<Browser> {
+  const deadline = Date.now() + config.startupTimeoutMs;
+  let lastError: unknown = null;
+  const chromium = await getPlaywrightChromium();
+
+  while (Date.now() < deadline) {
+    try {
+      // Keep the Lightpanda integration path in-tree because it works with
+      // Node-based CDP clients, but do not make it the default on the current
+      // Bun mainline yet. Real repo benchmarks showed Bun + Playwright fails the
+      // websocket/CDP handshake even when the same Lightpanda binary works under
+      // Node with newer Playwright/Puppeteer clients.
+      return await chromium.connectOverCDP(config.cdpEndpoint);
+    } catch (error) {
+      lastError = error;
+      await Bun.sleep(LIGHTPANDA_RETRY_INTERVAL_MS);
+    }
+  }
+
+  const message = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(
+    `连接 Lightpanda CDP 超时 (${config.startupTimeoutMs}ms, endpoint=${config.cdpEndpoint}): ${message}`
+  );
+}
+
+function ensureLightpandaProcess(config: LightpandaConfig) {
+  if (lightpandaProcess && lightpandaProcess.exitCode === null && !lightpandaProcess.killed) {
+    return;
+  }
+
+  console.log("启动共享浏览器实例 (Lightpanda CDP)...");
+  const child = spawn(
+    config.binPath,
+    ["serve", "--host", config.host, "--port", String(config.port)],
+    {
+      stdio: "ignore",
+      env: {
+        ...process.env,
+        LIGHTPANDA_DISABLE_TELEMETRY: config.disableTelemetry ? "true" : "false",
+      },
+    }
+  );
+  attachLightpandaLifecycle(child);
+  lightpandaProcess = child;
+}
+
+async function launchBrowser(): Promise<Browser> {
+  const provider = getBrowserProvider();
+
+  if (provider === "lightpanda") {
+    // This provider remains opt-in so we can revisit it quickly once Bun's
+    // websocket/CDP compatibility catches up, or if we move browser execution
+    // into a Node-based worker.
+    const config = getLightpandaConfig();
+    ensureLightpandaProcess(config);
+    console.log("连接共享浏览器实例 (Lightpanda)...");
+    return connectToLightpanda(config);
+  }
+
+  console.log("启动共享浏览器实例 (Chromium)...");
+  const chromium = await getPlaywrightChromium();
+  return chromium.launch(getChromiumLaunchOptions());
+}
+
+async function ensureBrowser(): Promise<Browser> {
+  if (browserInstance && browserInstance.isConnected()) {
+    return browserInstance;
+  }
+
+  if (!browserStartupPromise) {
+    browserStartupPromise = (async () => {
+      const browser = await launchBrowser();
+      browserInstance = browser;
+      registerCleanupHandlers();
+      attachBrowserLifecycle(browser);
+      return browser;
+    })().finally(() => {
+      browserStartupPromise = null;
+    });
+  }
+
+  return browserStartupPromise;
+}
+
+export async function createSession(
+  url: string,
+  options?: { authToken?: string }
+): Promise<{ sessionId: string }> {
+  if (activeSessions.size >= MAX_CONCURRENT_SESSIONS) {
+    throw new Error(
+      `服务器繁忙：当前并发会话数已达上限 (${MAX_CONCURRENT_SESSIONS})。请稍后再试或关闭不需要的标签页。`
+    );
+  }
+
+  const browser = await ensureBrowser();
+  const targetOrigin = new URL(url).origin;
+  const context = await browser.newContext({
+    userAgent: DEFAULT_BROWSER_USER_AGENT,
+    viewport: { width: 1280, height: 720 },
+    locale: "en-US",
+  });
+  await context.addInitScript(DEFAULT_BROWSER_INIT_SCRIPT);
+
+  await context.route("**/*", (route) => {
+    const request = route.request();
+    const type = request.resourceType();
+    if (["image", "media", "font", "stylesheet"].includes(type)) {
+      return route.abort();
+    }
+    if (!options?.authToken) {
+      return route.continue();
+    }
+
+    const headers = { ...request.headers() };
+    try {
+      if (new URL(request.url()).origin === targetOrigin) {
+        headers.authorization = `Bearer ${options.authToken}`;
+      }
+    } catch {
+      // Keep best-effort auth injection limited to valid same-origin URLs.
+    }
+    return route.continue({ headers });
+  });
+
+  const page = await context.newPage();
+
+  try {
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 15000 });
+  } catch (error) {
+    await context.close();
+    const message = error instanceof Error ? error.message : String(error);
+    throw new Error(`访问 URL 失败或超时: ${message}`);
+  }
+
+  const sessionId = `session_${Date.now()}_${Math.random().toString(36).slice(2, 7)}`;
+  activeSessions.set(sessionId, { page, createdAt: Date.now() });
+
+  console.log(
+    `浏览器会话已创建: ${sessionId} (当前活跃: ${activeSessions.size})，目标: ${url}`
+  );
+  return { sessionId };
+}
+
+export function getSessionPage(sessionId: string): Page {
+  const session = activeSessions.get(sessionId);
+  if (!session) {
+    throw new Error(
+      `会话无效或已过期: ${sessionId}。请先使用 browser_openSession 创建会话。`
+    );
+  }
+  session.createdAt = Date.now();
+  return session.page;
+}
+
+export async function closeSession(sessionId: string) {
+  const session = activeSessions.get(sessionId);
+  if (!session) {
+    throw new Error(
+      `会话无效或已过期: ${sessionId}。请先使用 browser_openSession 创建会话。`
+    );
+  }
+
+  activeSessions.delete(sessionId);
+  await session.page.context().close();
+}
+
+export async function resetBrowserSessionManagerForTests() {
+  for (const session of activeSessions.values()) {
+    await session.page.context().close().catch(() => {});
+  }
+  activeSessions.clear();
+
+  if (browserInstance) {
+    await browserInstance.close().catch(() => {});
+  }
+  browserInstance = null;
+  browserStartupPromise = null;
+
+  if (lightpandaProcess && lightpandaProcess.exitCode === null && !lightpandaProcess.killed) {
+    lightpandaProcess.kill();
+  }
+  lightpandaProcess = null;
+  playwrightChromium = null;
+}
+
+const sessionCleanupTimer = setInterval(() => {
+  const now = Date.now();
+  for (const [sessionId, session] of activeSessions.entries()) {
+    if (now - session.createdAt > SESSION_TIMEOUT_MS) {
+      console.log(`会话 ${sessionId} 超时，正在关闭...`);
+      session.page
+        .context()
+        .close()
+        .catch((error) => console.error(`关闭超时会话 ${sessionId} 失败:`, error));
+      activeSessions.delete(sessionId);
+    }
+  }
+}, 60 * 1000);
+
+sessionCleanupTimer.unref?.();

package/server/shareRoutes.ts

@@ -0,0 +1,86 @@
+import { API_ENDPOINTS } from "../database/config";
+import {
+  handleListAllCommunityShares,
+  handleListCreatorCommunityShares,
+  handleListOwnerShares,
+} from "../share/server/listCommunityShares";
+import { handlePurchaseDoc, handleCheckDocAccess } from "../share/server/purchaseDoc";
+import { handleImportShare } from "../share/server/importShare";
+import { handleReadSharedTable } from "../share/server/readSharedTable";
+import { handleReadCommunityShareCover } from "../share/server/readCommunityShareCover";
+import { createRouteConfig } from "./routeFactory";
+
+const shareRouteConfigs = [
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/community`,
+    handlers: {
+      GET: async (req) => handleListAllCommunityShares(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/community/cover/:token`,
+    handlers: {
+      GET: async (req) => handleReadCommunityShareCover(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/community/:userId`,
+    handlers: {
+      GET: async (req) => handleListCreatorCommunityShares(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/owner/:userId`,
+    handlers: {
+      GET: async (req) => handleListOwnerShares(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/:token/purchase`,
+    handlers: {
+      POST: async (req) => handlePurchaseDoc(req),
+    },
+    allowedMethods: ["POST", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/:token/access`,
+    handlers: {
+      GET: async (req) => handleCheckDocAccess(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/:token/import`,
+    handlers: {
+      POST: async (req) => handleImportShare(req),
+    },
+    allowedMethods: ["POST", "OPTIONS"],
+    enableCors: true,
+  }),
+  createRouteConfig({
+    path: `${API_ENDPOINTS.SHARE}/:token/table`,
+    handlers: {
+      GET: async (req) => handleReadSharedTable(req),
+    },
+    allowedMethods: ["GET", "OPTIONS"],
+    enableCors: true,
+  }),
+];
+
+export const shareRoutes = shareRouteConfigs.reduce(
+  (acc, { path, route }) => {
+    acc[path] = route;
+    return acc;
+  },
+  {} as Record<string, any>
+);

package/server/sqliteRoutes.ts

@@ -0,0 +1,141 @@
+// src/sqliteRoutes.ts
+
+import { pino } from "pino";
+import { API_ENDPOINTS } from "../database/config";
+import { getSqliteDb } from "../database/sqliteDb";
+import {
+  authenticateRequest,
+  authErrorResponse,
+  CORS_HEADERS_AUTH,
+} from "../auth/utils";
+
+const logger = pino({ name: "sqliteRoutes" });
+const CORS_HEADERS = CORS_HEADERS_AUTH;
+
+const ALLOWED_SQL_EXEC_USER_IDS = (process.env.ALLOWED_SQL_EXEC_USER_IDS ?? "1c2b14b968,0e95801d90,21b40f2e04").split(",").map(s => s.trim()).filter(Boolean);
+
+// 禁止通过此接口执行的危险语句模式
+const DANGEROUS_SQL_PATTERNS = /\b(ATTACH|DETACH|LOAD_EXTENSION|PRAGMA\s+(?!table_info|table_list|index_list))\b/i;
+
+export const sqliteRoutes = {
+  [API_ENDPOINTS.EXECUTE_SQL]: {
+    POST: async (req: Request) => {
+      const authResult = await authenticateRequest(req);
+
+      if (authResult instanceof Response) {
+        return authResult;
+      }
+
+      const { userId } = authResult;
+      logger.info({ userId }, "SQLite access attempt");
+
+      if (!ALLOWED_SQL_EXEC_USER_IDS.includes(userId)) {
+        return authErrorResponse(
+          "此功能暂未向普通用户开放。",
+          "FEATURE_NOT_AVAILABLE",
+          403
+        );
+      }
+
+      const userDb = getSqliteDb(userId);
+
+      try {
+        const body = await req.json().catch(() => ({}));
+
+        // [关键修复] 1. 同时解构 sql_query 和可选的 params
+        const { sql_query, params } = body as {
+          sql_query: string;
+          params?: any[];
+        };
+
+        if (typeof sql_query !== "string" || sql_query.trim() === "") {
+          return new Response(
+            JSON.stringify({ error: "Invalid or empty 'sql_query' provided." }),
+            {
+              status: 400,
+              headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+            }
+          );
+        }
+
+        // 安全校验：禁止危险 SQL 语句
+        if (DANGEROUS_SQL_PATTERNS.test(sql_query)) {
+          logger.warn({ userId, sql_query }, "Blocked dangerous SQL statement");
+          return new Response(
+            JSON.stringify({ error: "This SQL statement is not allowed." }),
+            {
+              status: 403,
+              headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+            }
+          );
+        }
+
+        // [关键修复] 2. 增加对 params 类型的校验
+        if (params && !Array.isArray(params)) {
+          return new Response(
+            JSON.stringify({ error: "'params' must be an array." }),
+            {
+              status: 400,
+              headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+            }
+          );
+        }
+
+        // 日志记录
+        logger.debug({ userId, sql_query, hasParams: !!params }, "Executing SQL");
+
+        let result: any;
+
+        // [关键修复] 3. 使用支持参数绑定的方法执行 SQL
+        try {
+          // .query(sql) 返回一个 Statement 对象
+          // .all(...params) 在该 Statement 上执行并绑定参数
+          // bun:sqlite 的这个设计可以完美处理有无参数的情况
+          const statement = userDb.query(sql_query);
+          result = statement.all(...(params || []));
+        } catch (e: any) {
+          // 如果查询不是为了返回行（例如 INSERT, UPDATE, DELETE），.all() 会报错
+          if (
+            e.message.includes("statement does not return rows") ||
+            e.message.includes("not designed to return results")
+          ) {
+            try {
+              // .run(sql, ...params) 用于执行不返回行的语句，并支持参数绑定
+              result = userDb.run(sql_query, ...(params || []));
+            } catch (runError: any) {
+              // 最后的 fallback，只对无参数的、可能包含多语句的 SQL 生效
+              if (params && params.length > 0) {
+                // 如果带有参数的 .run() 都失败了，这是一个真实错误，应该抛出
+                throw runError;
+              }
+              userDb.exec(sql_query);
+              result = { message: "SQL command executed successfully." };
+            }
+          } else {
+            // 重新抛出其他类型的查询错误
+            throw e;
+          }
+        }
+
+        return new Response(JSON.stringify({ success: true, result: result }), {
+          headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+        });
+      } catch (error: any) {
+        logger.error(
+          { userId, error: error.message },
+          "Error executing SQL via SQLite API"
+        );
+        return new Response(
+          JSON.stringify({
+            error: error.message || "An unknown error occurred.",
+          }),
+          {
+            status: 500,
+            headers: { ...CORS_HEADERS, "Content-Type": "application/json" },
+          }
+        );
+      }
+    },
+    OPTIONS: () => new Response(null, { status: 204, headers: CORS_HEADERS }),
+  },
+};

package/server/taskRunBridgeRoutes.ts

@@ -0,0 +1,95 @@
+import { handleToken } from "../auth/server/token";
+import { createApiRouteFamily } from "./apiRouteAdapter";
+import { DataType } from "../create/types";
+import { createKey } from "../database/keys";
+import serverDb from "../database/server/db";
+import { fetchMessages } from "../chat/messages/fetchMessages";
+import { authenticateMachineToken } from "./handlers/machines/machineAuth";
+import {
+  runTaskRunToolForUser,
+  type TaskRunToolArgs,
+} from "./handlers/agentRun/taskRunToolHandler";
+
+const JSON_HEADERS: Record<string, string> = {
+  "Content-Type": "application/json; charset=utf-8",
+  "Access-Control-Allow-Origin": "*",
+};
+
+function json(body: unknown, status = 200) {
+  return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS });
+}
+
+async function authenticateTaskRunBridge(req: Request): Promise<{ userId: string } | Response> {
+  const machineAuth = await authenticateMachineToken(req);
+  if (machineAuth instanceof Response) return machineAuth;
+  if (machineAuth?.userId) return { userId: machineAuth.userId };
+
+  const user = await handleToken(req as any, {});
+  if (!user?.userId) {
+    return json({ ok: false, error: "Unauthorized" }, 401);
+  }
+  return { userId: user.userId };
+}
+
+export async function handleTaskRunBridge(req: Request) {
+  const auth = await authenticateTaskRunBridge(req);
+  if (auth instanceof Response) return auth;
+
+  let body: TaskRunToolArgs;
+  try {
+    body = await req.json() as TaskRunToolArgs;
+  } catch {
+    return json({ ok: false, error: "Request body must be valid JSON" }, 400);
+  }
+
+  const result = await runTaskRunToolForUser(body, auth.userId);
+  return new Response(result, { status: 200, headers: JSON_HEADERS });
+}
+
+export async function handleDialogReadBridge(req: Request) {
+  const auth = await authenticateTaskRunBridge(req);
+  if (auth instanceof Response) return auth;
+
+  let body: any;
+  try {
+    body = await req.json();
+  } catch {
+    return json({ ok: false, error: "Request body must be valid JSON" }, 400);
+  }
+
+  const dialogId = typeof body?.dialogId === "string" ? body.dialogId.trim() : "";
+  const requestedDialogKey = typeof body?.dialogKey === "string" ? body.dialogKey.trim() : "";
+  const expectedDialogKey = dialogId ? createKey(DataType.DIALOG, auth.userId, dialogId) : "";
+  if (!dialogId) return json({ ok: false, error: "dialogId is required" }, 400);
+  if (requestedDialogKey && requestedDialogKey !== expectedDialogKey) {
+    return json({ ok: false, error: "dialogKey does not belong to authenticated machine owner" }, 403);
+  }
+
+  const limit = typeof body?.limit === "number" && Number.isFinite(body.limit) && body.limit > 0
+    ? Math.min(Math.floor(body.limit), 200)
+    : 50;
+
+  try {
+    const [meta, msgs] = await Promise.all([
+      serverDb.get(expectedDialogKey),
+      fetchMessages(serverDb, dialogId, { limit, throwOnError: true }),
+    ]);
+    return json({ ok: true, meta, msgs });
+  } catch (error) {
+    return json({
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+    }, 404);
+  }
+}
+
+export const taskRunBridgeRoutes: Record<string, any> = createApiRouteFamily([
+  {
+    path: "/api/task-run",
+    handlers: { POST: handleTaskRunBridge },
+  },
+  {
+    path: "/api/dialog-read",
+    handlers: { POST: handleDialogReadBridge },
+  },
+]);