oasis_test 0.1.67 → 0.1.69

package/dist/_base/wrapper-base.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Shared wrapper logic for CLI connectors.
+#
+# Source this from your connector wrapper and call oasis_resolve_bin + oasis_check_available.
+# Before sourcing, set:
+#   OASIS_BIN_VAR   — name of env var that holds the absolute binary path (e.g., "GH_BIN")
+#   OASIS_CMD_NAME  — command name to find (e.g., "gh")
+#
+# Example:
+#   OASIS_BIN_VAR="GH_BIN"
+#   OASIS_CMD_NAME="gh"
+#   source "$(dirname "$(realpath "$0")")/../_base/wrapper-base.sh"
+#   oasis_resolve_bin
+#   oasis_check_available
+#   # Add connector-specific env injection here
+#   exec "$GH_BIN" "$@"
+
+set -euo pipefail
+
+# Resolve the real binary path (avoid recursion into self).
+# If ${OASIS_BIN_VAR} is already set (injected by inject()), use it.
+# Otherwise, scan PATH for the first executable that isn't this wrapper.
+oasis_resolve_bin() {
+  local bin_var="${OASIS_BIN_VAR:?OASIS_BIN_VAR must be set}"
+  local cmd_name="${OASIS_CMD_NAME:?OASIS_CMD_NAME must be set}"
+
+  # If already set by inject() AND executable on THIS machine, skip PATH scan.
+  # ${OASIS_BIN_VAR} (LARK_BIN/GH_BIN) is resolved server-side via `which`; on a remote
+  # node the real binary may live at a different path than the server's. Don't blindly
+  # exec a stale/non-existent path — fall through to the PATH scan below (which skips
+  # this wrapper to avoid recursion) so a node-local install is still found.
+  if [ -n "${!bin_var:-}" ] && [ -x "${!bin_var:-}" ]; then
+    return 0
+  fi
+  # Stale/non-executable injected path: clear it so the PATH scan can repopulate cleanly.
+  unset "$bin_var" 2>/dev/null || true
+
+  # Fallback: scan PATH for real binary (skip self to avoid recursion)
+  local SELF
+  SELF="$(realpath "$0" 2>/dev/null || echo "$0")"
+  local candidate
+  while IFS= read -r dir; do
+    candidate="$dir/$cmd_name"
+    if [ -x "$candidate" ] && [ "$(realpath "$candidate" 2>/dev/null)" != "$SELF" ]; then
+      printf -v "$bin_var" '%s' "$candidate"
+      export "$bin_var"
+      return 0
+    fi
+  done <<< "$(echo "$PATH" | tr ':' '\n')"
+}
+
+# Check that the resolved binary is accessible and responds to --version.
+# If not (e.g., locked during upgrade), exit with user-friendly message.
+oasis_check_available() {
+  local bin_var="${OASIS_BIN_VAR:?OASIS_BIN_VAR must be set}"
+  local bin_path="${!bin_var:-}"
+
+  if [ -z "$bin_path" ]; then
+    echo "error: The requested cli is upgrading, please try again in 30 seconds." >&2
+    exit 1
+  fi
+
+  if [ ! -x "$bin_path" ] || ! "$bin_path" --version >/dev/null 2>&1; then
+    echo "error: The requested cli is upgrading, please try again in 30 seconds." >&2
+    exit 1
+  fi
+}

package/dist/feishu/wrapper.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# Feishu CLI wrapper — 通过前置 PATH 替换 lark-cli。
+#
+# 凭据保护：敏感凭据（App Secret / User Access Token）**不**放进 agent 环境变量，
+# 而是写在只有本 wrapper 读取的临时文件里（inject() 写，chmod 600）。agent 环境里
+# 只有一个非敏感的文件路径指针 FEISHU_CREDS_FILE。wrapper 在调用真实 lark-cli 前
+# `source` 该文件，把 LARKSUITE_CLI_* 外部凭据变量注入**本 wrapper 子进程**——
+# 这些秘密从不出现在 agent 自身的 env / /proc/self/environ，也不被 agent 其它子进程继承。
+#
+# 环境变量：
+#   LARK_BIN          — 真实 lark-cli 绝对路径（避免递归调用自身）
+#   FEISHU_CREDS_FILE — 凭据文件路径（内含 export LARKSUITE_CLI_* 行）
+
+set -euo pipefail
+
+OASIS_BIN_VAR="LARK_BIN"
+OASIS_CMD_NAME="lark-cli"
+# shellcheck source=../_base/wrapper-base.sh
+source "$(dirname "$(realpath "$0")")/../_base/wrapper-base.sh"
+
+oasis_resolve_bin
+oasis_check_available
+
+# Load feishu credentials into THIS process only (not visible to the agent).
+if [ -n "${FEISHU_CREDS_FILE:-}" ] && [ -f "${FEISHU_CREDS_FILE}" ]; then
+  # shellcheck disable=SC1090
+  source "${FEISHU_CREDS_FILE}"
+fi
+
+exec "$LARK_BIN" "$@"

package/dist/github/wrapper.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# GitHub CLI wrapper — replaces `gh` in the agent's PATH.
+#
+# The wrapper reads the token from an env var injected by inject(),
+# never exposing it in a way the agent can read directly (the agent
+# sees the wrapper name "gh" on PATH, not the token value).
+#
+# Environment variables (written by inject(), read here only):
+#   GH_CREDS_FILE  — path to a chmod-600 file with `export GH_TOKEN=...` lines
+#                    (token value is NOT in the agent env — only this path is)
+#   GH_BIN         — absolute path to the real gh binary
+#   GIT_AUTHOR_NAME / GIT_COMMITTER_NAME — set by inject() directly (non-secret)
+
+set -euo pipefail
+
+OASIS_BIN_VAR="GH_BIN"
+OASIS_CMD_NAME="gh"
+# shellcheck source=../_base/wrapper-base.sh
+source "$(dirname "$(realpath "$0")")/../_base/wrapper-base.sh"
+
+oasis_resolve_bin
+oasis_check_available
+
+# Load the GitHub token into THIS process only (not visible to the agent).
+# The token lives in a chmod-600 file the wrapper sources; the agent env only
+# holds the non-secret path GH_CREDS_FILE.
+if [ -n "${GH_CREDS_FILE:-}" ] && [ -f "${GH_CREDS_FILE}" ]; then
+  # shellcheck disable=SC1090
+  source "${GH_CREDS_FILE}"
+fi
+
+exec "$GH_BIN" "$@"