nolo-cli 0.1.26 → 0.1.29

package/server/handlers/versionStore.ts

@@ -0,0 +1,176 @@
+// packages/server/handlers/versionStore.ts
+// 通用版本快照存储
+// Key 设计:
+//   version-{type}-{entityId}-{ulid}  → 快照内容
+// 扫描某实体的所有版本: prefix range version-{type}-{entityId}-
+// entityType: "app" | "doc" | "agent"
+
+import serverDb from "../../database/server/db";
+import { ulid } from "ulid";
+
+export type VersionEntityType = "app" | "doc" | "agent";
+
+export const VERSION_PREFIX = "version-";
+
+export function versionKey(type: VersionEntityType, entityId: string, versionId: string) {
+  return `${VERSION_PREFIX}${type}-${entityId}-${versionId}`;
+}
+
+export function versionRangePrefix(type: VersionEntityType, entityId: string) {
+  return `${VERSION_PREFIX}${type}-${entityId}-`;
+}
+
+export interface VersionMeta {
+  versionId: string;
+  entityId: string;
+  type: VersionEntityType;
+  label?: string;
+  pinned?: boolean;
+  createdAt: number;
+  createdBy: string;
+}
+
+export interface VersionRecord extends VersionMeta {
+  snapshot: any;
+}
+
+export const MAX_UNPINNED_VERSIONS = 50;
+export const MAX_PINNED_VERSIONS = 10;
+
+// ── 保存版本快照 ──────────────────────────────────────────────
+export async function saveVersion(
+  type: VersionEntityType,
+  entityId: string,
+  snapshot: any,
+  opts: {
+    createdBy: string;
+    label?: string;
+    pinned?: boolean;
+    versionId?: string;
+    createdAt?: number;
+  }
+): Promise<string> {
+  const versionId = opts.versionId ?? ulid();
+  const record: VersionRecord = {
+    versionId,
+    entityId,
+    type,
+    label: opts.label,
+    pinned: opts.pinned ?? false,
+    createdAt: opts.createdAt ?? Date.now(),
+    createdBy: opts.createdBy,
+    snapshot,
+  };
+
+  await serverDb.put(versionKey(type, entityId, versionId), record);
+  pruneVersions(type, entityId).catch(() => {});
+  return versionId;
+}
+
+// ── 列出版本（不含快照内容）────────────────────────────────────
+export async function listVersions(
+  type: VersionEntityType,
+  entityId: string
+): Promise<Omit<VersionRecord, "snapshot">[]> {
+  const prefix = versionRangePrefix(type, entityId);
+  const results: Omit<VersionRecord, "snapshot">[] = [];
+
+  for await (const [, value] of serverDb.iterator({
+    gte: prefix,
+    lte: prefix + "\xff",
+    reverse: true,
+    limit: MAX_UNPINNED_VERSIONS + MAX_PINNED_VERSIONS + 10,
+  })) {
+    const { snapshot: _, ...meta } = value as VersionRecord;
+    results.push(meta);
+  }
+
+  return results;
+}
+
+// ── 获取单个版本（含快照）────────────────────────────────────
+export async function getVersion(
+  type: VersionEntityType,
+  entityId: string,
+  versionId: string
+): Promise<VersionRecord | null> {
+  try {
+    return (await serverDb.get(versionKey(type, entityId, versionId))) as VersionRecord;
+  } catch {
+    return null;
+  }
+}
+
+// ── 自动剪枝：删最旧的未 pin 版本，pin 单独计数 ─────────────
+export async function pruneVersions(
+  type: VersionEntityType,
+  entityId: string
+): Promise<void> {
+  const prefix = versionRangePrefix(type, entityId);
+  const allEntries: { key: string; pinned: boolean }[] = [];
+
+  for await (const [key, value] of serverDb.iterator({
+    gte: prefix,
+    lte: prefix + "\xff",
+  })) {
+    allEntries.push({ key: key as string, pinned: !!(value as VersionRecord).pinned });
+  }
+
+  const unpinned = allEntries.filter((e) => !e.pinned);
+  if (unpinned.length <= MAX_UNPINNED_VERSIONS) return;
+
+  const toDelete = unpinned.slice(0, unpinned.length - MAX_UNPINNED_VERSIONS);
+  await Promise.all(toDelete.map((e) => serverDb.del(e.key)));
+}
+
+// ── Pin / Unpin 版本 ──────────────────────────────────────────
+export async function pinVersion(
+  type: VersionEntityType,
+  entityId: string,
+  versionId: string,
+  pinned: boolean
+): Promise<{ ok: boolean; reason?: string }> {
+  const record = await getVersion(type, entityId, versionId);
+  if (!record) return { ok: false, reason: "NOT_FOUND" };
+
+  if (pinned) {
+    // 检查 pin 上限
+    const all = await listVersions(type, entityId);
+    const pinnedCount = all.filter((v) => v.pinned && v.versionId !== versionId).length;
+    if (pinnedCount >= MAX_PINNED_VERSIONS) {
+      return { ok: false, reason: "PIN_LIMIT_EXCEEDED" };
+    }
+  }
+
+  await serverDb.put(versionKey(type, entityId, versionId), { ...record, pinned });
+  return { ok: true };
+}
+
+// ── 删除单个版本 ──────────────────────────────────────────────
+export async function deleteVersion(
+  type: VersionEntityType,
+  entityId: string,
+  versionId: string
+): Promise<void> {
+  await serverDb.del(versionKey(type, entityId, versionId));
+}
+
+// ── 删除实体所有版本（级联清理，entity 删除时调用）──────────
+export async function deleteVersionsForEntity(
+  type: VersionEntityType,
+  entityId: string
+): Promise<void> {
+  const prefix = versionRangePrefix(type, entityId);
+  const keys: string[] = [];
+
+  for await (const [key] of serverDb.iterator({
+    gte: prefix,
+    lte: prefix + "\xff",
+    keys: true,
+    values: false,
+  })) {
+    keys.push(key as string);
+  }
+
+  await Promise.all(keys.map((k) => serverDb.del(k)));
+}

package/server/handlers/wereadGatewayHandler.ts

@@ -0,0 +1,48 @@
+import { authenticateRequest, CORS_HEADERS_AUTH } from "../../auth/utils";
+import { runWereadGatewayRequest, type WereadGatewayArgs } from "../../ai/tools/wereadGatewayTool";
+import { getUserSecret } from "./userSecretsHandler";
+
+function jsonResponse(status: number, data: unknown): Response {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...CORS_HEADERS_AUTH },
+  });
+}
+
+export async function handleWereadGateway(req: Request): Promise<Response> {
+  if (req.method === "OPTIONS") {
+    return new Response(null, { status: 204, headers: CORS_HEADERS_AUTH });
+  }
+  if (req.method !== "POST") {
+    return jsonResponse(405, { error: "Method not allowed" });
+  }
+
+  const auth = await authenticateRequest(req);
+  if (auth instanceof Response) return auth;
+
+  let body: WereadGatewayArgs;
+  try {
+    body = await req.json();
+  } catch {
+    return jsonResponse(400, { error: "请求体必须是合法的 JSON" });
+  }
+
+  const apiKey = await getUserSecret(auth.userId, "WEREAD_API_KEY");
+  if (!apiKey) {
+    return jsonResponse(400, {
+      error:
+        "缺少 WEREAD_API_KEY。请先打开[密钥管理](/setting/secrets?key=WEREAD_API_KEY&source=weread)保存；如果还没有 key，再到[微信读书授权页](https://weread.qq.com/r/weread-skills)获取。",
+      code: "MISSING_WEREAD_API_KEY",
+      missingSecret: "WEREAD_API_KEY",
+    });
+  }
+
+  try {
+    const result = await runWereadGatewayRequest(body, { apiKey });
+    return jsonResponse(200, result);
+  } catch (error) {
+    return jsonResponse(502, {
+      error: error instanceof Error ? error.message : String(error),
+    });
+  }
+}

package/server/handlers/whisperHandler.ts

@@ -0,0 +1,158 @@
+import { getFileContentById } from "../../database/server/fileService";
+import { authenticateRequest } from "../../auth/utils";
+import { chargeExternalTool } from "../../ai/token/externalToolCost";
+
+const CORS_HEADERS = {
+  "Content-Type": "application/json",
+  "Access-Control-Allow-Origin": "*",
+};
+
+/**
+ * 将 audioUrl 解析成 { buffer, filename, mimeType }
+ * 支持：
+ *  - 内部文件 ID (file-... 或 26 位 ULID)
+ *  - http/https URL
+ *  - base64 data URI  (data:<mime>;base64,...)
+ */
+async function resolveAudio(audioUrl: string): Promise<{ buffer: Buffer; filename: string; mimeType: string }> {
+  // 内部文件 ID
+  if (audioUrl.startsWith("file-") || /^[0-9A-Z]{26}$/.test(audioUrl)) {
+    const { buffer, metadata } = await getFileContentById(audioUrl);
+    const mime = metadata.mimeType || "audio/mpeg";
+    const ext = mime.split("/")[1] || "mp3";
+    return { buffer, filename: `audio.${ext}`, mimeType: mime };
+  }
+
+  // base64 data URI
+  if (audioUrl.startsWith("data:")) {
+    const commaIndex = audioUrl.indexOf(",");
+    if (commaIndex < 0) throw new Error("Invalid data URI");
+    const header = audioUrl.slice(0, commaIndex);
+    const b64 = audioUrl.slice(commaIndex + 1);
+    if (!header.includes(";base64")) {
+      throw new Error("Only base64 data URI is supported");
+    }
+    const mime = header.replace("data:", "").split(";")[0] || "audio/mpeg";
+    const ext = mime.split("/")[1] || "mp3";
+    return {
+      buffer: Buffer.from(b64, "base64"),
+      filename: `audio.${ext}`,
+      mimeType: mime,
+    };
+  }
+
+  // http/https URL
+  const res = await fetch(audioUrl);
+  if (!res.ok) throw new Error(`Failed to fetch audio URL: ${res.status}`);
+  const mime = res.headers.get("content-type")?.split(";")[0] || "audio/mpeg";
+  const ext = mime.split("/")[1] || "mp3";
+  const buf = Buffer.from(await res.arrayBuffer());
+  return { buffer: buf, filename: `audio.${ext}`, mimeType: mime };
+}
+
+/** 创建指定 model 的 Whisper 转录 handler */
+export function createWhisperHandler(model: string) {
+  return async function handleWhisper(req: Request): Promise<Response> {
+    const DEEPINFRA_API_KEY = process.env.DEEPINFRA_API_KEY;
+
+    if (req.method === "OPTIONS") {
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "Access-Control-Allow-Origin": "*",
+          "Access-Control-Allow-Headers": "Content-Type, Authorization",
+        },
+      });
+    }
+
+    const auth = await authenticateRequest(req);
+    if (auth instanceof Response) return auth;
+
+    if (!DEEPINFRA_API_KEY) {
+      return new Response(
+        JSON.stringify({ error: "Server missing DEEPINFRA_API_KEY" }),
+        { status: 500, headers: CORS_HEADERS }
+      );
+    }
+
+    try {
+      const body: any = await req.json();
+      const { audioUrl, language, dialogId } = body;
+
+      if (!audioUrl || typeof audioUrl !== "string") {
+        return new Response(
+          JSON.stringify({ error: "缺少有效的 audioUrl 参数" }),
+          { status: 400, headers: CORS_HEADERS }
+        );
+      }
+
+      let audio: { buffer: Buffer; filename: string; mimeType: string };
+      try {
+        audio = await resolveAudio(audioUrl);
+      } catch (e: any) {
+        return new Response(
+          JSON.stringify({ error: `无法获取音频: ${e.message}` }),
+          { status: 404, headers: CORS_HEADERS }
+        );
+      }
+
+      const form = new FormData();
+      form.append("model", model);
+      form.append("response_format", "verbose_json");
+      if (language) form.append("language", language);
+      const bytes = new Uint8Array(
+        audio.buffer.buffer,
+        audio.buffer.byteOffset,
+        audio.buffer.byteLength
+      );
+      form.append(
+        "file",
+        new Blob([bytes], { type: audio.mimeType }),
+        audio.filename
+      );
+
+      const response = await fetch(
+        "https://api.deepinfra.com/v1/openai/audio/transcriptions",
+        {
+          method: "POST",
+          headers: { Authorization: `Bearer ${DEEPINFRA_API_KEY}` },
+          body: form,
+        }
+      );
+
+      if (!response.ok) {
+        const errorText = await response.text();
+        return new Response(
+          JSON.stringify({ error: `DeepInfra API error: ${errorText}` }),
+          { status: response.status, headers: CORS_HEADERS }
+        );
+      }
+
+      const data: any = await response.json();
+
+      // 按实际时长计费（duration 单位：秒）
+      const durationMinutes = (data.duration ?? 0) / 60;
+      await chargeExternalTool({
+        userId: auth.userId,
+        toolId: model,
+        dialogId,
+        durationMinutes,
+        reason: "whisper_transcription",
+      });
+
+      return new Response(JSON.stringify(data), {
+        status: 200,
+        headers: CORS_HEADERS,
+      });
+    } catch (error: any) {
+      console.error(`Whisper handler (${model}) error:`, error);
+      return new Response(JSON.stringify({ error: error.message }), {
+        status: 500,
+        headers: CORS_HEADERS,
+      });
+    }
+  };
+}
+
+export const handleWhisperTurbo = createWhisperHandler("openai/whisper-large-v3-turbo");
+export const handleWhisperV3 = createWhisperHandler("openai/whisper-large-v3");

package/server/handlers/writeFileHandler.ts

@@ -0,0 +1,168 @@
+// 文件路径: packages/server/handlers/writeFileHandler.ts
+
+import { dirname } from "node:path";
+import { mkdir } from "node:fs/promises";
+import { diffLines } from "diff";
+
+import {
+    getDefaultDevToolAllowedRoots,
+    resolveDevToolPathWithinRoots,
+    resolveProjectFilePath,
+} from "../devToolPathPolicy";
+
+type WriteFileRequestBody = {
+    filePath: string;
+    content: string;
+    /**
+     * 是否允许覆盖已存在的文件。
+     * - false 或未提供：如果目标文件已存在，则报错。
+     * - true：允许覆盖已存在文件。
+     */
+    overwrite?: boolean;
+};
+
+const JSON_HEADERS = {
+    "Content-Type": "application/json; charset=utf-8",
+};
+
+async function fileExists(path: string): Promise<boolean> {
+    // 尽量使用 Bun 的 API 检查文件是否存在
+    return await Bun.file(path).exists();
+}
+
+function resolveWritablePath(filePath: string): string {
+    if (process.env.NOLO_DESKTOP === "1") {
+        return resolveDevToolPathWithinRoots(filePath, getDefaultDevToolAllowedRoots());
+    }
+    return resolveProjectFilePath(filePath);
+}
+
+export async function handleWriteFile(req: Request): Promise<Response> {
+    try {
+        let body: unknown;
+        try {
+            body = await req.json();
+        } catch {
+            return new Response(
+                JSON.stringify({ error: "请求体必须是合法的 JSON。" }),
+                { status: 400, headers: JSON_HEADERS }
+            );
+        }
+
+        const { filePath, content, overwrite }: Partial<WriteFileRequestBody> =
+            typeof body === "object" && body !== null ? (body as any) : {};
+
+        if (!filePath || typeof filePath !== "string") {
+            return new Response(
+                JSON.stringify({
+                    error: "写入文件失败：必须提供有效的 filePath 字符串。",
+                }),
+                { status: 400, headers: JSON_HEADERS }
+            );
+        }
+
+        if (typeof content !== "string") {
+            return new Response(
+                JSON.stringify({
+                    error: "写入文件失败：content 必须是字符串。",
+                }),
+                { status: 400, headers: JSON_HEADERS }
+            );
+        }
+
+        // 简单防御：不允许明显是目录的路径
+        if (filePath.endsWith("/") || filePath.endsWith("\\")) {
+            return new Response(
+                JSON.stringify({
+                    error: "写入文件失败：filePath 不能是目录路径。",
+                }),
+                { status: 400, headers: JSON_HEADERS }
+            );
+        }
+
+        let absPath: string;
+        try {
+            absPath = resolveWritablePath(filePath);
+        } catch (err: any) {
+            return new Response(
+                JSON.stringify({ error: err?.message || "解析文件路径失败。" }),
+                { status: 400, headers: JSON_HEADERS }
+            );
+        }
+
+        const exists = await fileExists(absPath);
+
+        if (exists && overwrite !== true) {
+            return new Response(
+                JSON.stringify({
+                    error:
+                        "写入文件失败：目标文件已存在，且 overwrite 未设置为 true。",
+                    filePath,
+                }),
+                { status: 409, headers: JSON_HEADERS }
+            );
+        }
+
+        // 如果文件已存在，先读原内容，用于生成 diff
+        let originalText: string | null = null;
+        if (exists) {
+            try {
+                originalText = await Bun.file(absPath).text();
+            } catch (e) {
+                console.warn(
+                    "[write-file] 读取原始文件内容失败，diff 将不可用:",
+                    e
+                );
+                originalText = null;
+            }
+        }
+
+        // 确保目录存在
+        await mkdir(dirname(absPath), { recursive: true });
+
+        // 写入文件（保持调用方提供的换行风格）
+        await Bun.write(absPath, content);
+
+        // 为 UI 统一换行符为 \n，方便行号及 diff 展示
+        const normalizedNewContent =
+            content.indexOf("\r\n") >= 0
+                ? content.replace(/\r\n/g, "\n")
+                : content;
+
+        let diff: ReturnType<typeof diffLines> | undefined;
+        if (originalText != null) {
+            const normalizedOld =
+                originalText.indexOf("\r\n") >= 0
+                    ? originalText.replace(/\r\n/g, "\n")
+                    : originalText;
+            diff = diffLines(normalizedOld, normalizedNewContent);
+        }
+
+        const result = {
+            ok: true,
+            filePath,
+            absolutePath: absPath,
+            created: !exists,
+            overwritten: exists && overwrite === true,
+            // 提供给前端用于“最终文件预览”与 Diff 视图
+            newContent: normalizedNewContent,
+            diff,
+        };
+
+        return new Response(JSON.stringify(result), {
+            status: 200,
+            headers: JSON_HEADERS,
+        });
+    } catch (error: any) {
+        console.error("[write-file] Error:", error);
+        return new Response(
+            JSON.stringify({
+                error: `写入文件失败：${error?.message || String(error)}`,
+            }),
+            {
+                status: 500,
+                headers: JSON_HEADERS,
+            }
+        );
+    }
+}

package/server/html/desktopReleaseManifest.server.ts

@@ -0,0 +1,17 @@
+import {
+  DESKTOP_RELEASE_MANIFEST_PUBLIC_PATH,
+  normalizeDesktopReleaseManifest,
+  type DesktopReleaseManifest,
+} from "../../app/constants/desktopReleaseManifest";
+
+export async function readDesktopReleaseManifest(): Promise<DesktopReleaseManifest | null> {
+  const relativePath = DESKTOP_RELEASE_MANIFEST_PUBLIC_PATH.replace(/^\/+/, "");
+  const file = Bun.file(relativePath);
+  if (!(await file.exists())) return null;
+  try {
+    return normalizeDesktopReleaseManifest(await file.json());
+  } catch (error) {
+    console.warn("Failed to read desktop release manifest:", error);
+    return null;
+  }
+}

package/server/html/generateErrorResponse.ts

@@ -0,0 +1,22 @@
+export function generateErrorResponse(error) {
+  console.error(error);
+  return new Response(
+    `
+      <!DOCTYPE html>
+      <html lang="zh-CN">
+      <head>
+        <meta charSet="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, viewport-fit=cover"/>
+        <title>错误</title>
+      </head>
+      <body>
+        <h1>抱歉，服务器发生错误，请稍后重试</h1>
+      </body>
+      </html>
+      `,
+    {
+      status: 500,
+      headers: { "content-type": "text/html; charset=utf-8" },
+    }
+  );
+}

package/server/html/serializeState.ts

@@ -0,0 +1,9 @@
+export function serializeState(preloadedState, scriptNonce: string) {
+  return `
+          <script nonce="${scriptNonce}">
+                      // WARNING: See the following for security issues around embedding JSON in HTML:
+            // https://redux.js.org/usage/server-rendering#security-considerations
+            window.__PRELOADED_STATE__ = ${JSON.stringify(preloadedState).replace(/</g, "\\u003c")}
+          </script>
+        `;
+}