opencode-api-security-testing 5.3.0 → 5.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "opencode-api-security-testing",
-  "version": "5.3.0",
+  "version": "5.4.0",
   "description": "API Security Testing Plugin for OpenCode - Automated vulnerability scanning and penetration testing",
   "type": "module",
   "main": "src/index.ts",

package/src/index.ts

@@ -1,13 +1,238 @@
-import type { Plugin } from "@opencode-ai/plugin";
+import type { Plugin, PluginInput } from "@opencode-ai/plugin";
 import { tool } from "@opencode-ai/plugin";
-import { join } from "path";
-import { existsSync, readFileSync } from "fs";
+import { join, dirname } from "path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, readdirSync, unlinkSync } from "fs";
 import { exec } from "child_process";
 import { promisify } from "util";
 
 const execAsync = promisify(exec);
 
-// 任务队列管理器
+// ============================================================================
+// OpenCode 原生集成 - 任务持久化与事件系统
+// ============================================================================
+
+const TASKS_DIR = ".opencode/tasks";
+const TASK_FILE_PREFIX = "security_scan_";
+
+interface PersistedScanTask {
+  id: string;
+  status: "pending" | "running" | "completed" | "failed" | "cancelled";
+  type: string;
+  target: string;
+  startTime: number;
+  endTime?: number;
+  result?: string;
+  error?: string;
+  progress: number;
+  ptyId?: string;
+  createdAt: string;
+}
+
+// 任务管理器 - 支持持久化和 PTY 集成
+class ScanTaskManager {
+  private tasks = new Map<string, PersistedScanTask>();
+  private directory: string = "";
+  private client: PluginInput["client"] | null = null;
+  private eventSubscription: ReturnType<typeof this.subscribeToEvents> | null = null;
+
+  init(directory: string, client: PluginInput["client"]) {
+    this.directory = directory;
+    this.client = client;
+    this.loadPersistedTasks();
+    this.subscribeToEvents();
+  }
+
+  private getTasksDir(): string {
+    return join(this.directory, TASKS_DIR);
+  }
+
+  private getTaskFilePath(taskId: string): string {
+    return join(this.getTasksDir(), `${TASK_FILE_PREFIX}${taskId}.json`);
+  }
+
+  // 持久化任务到文件
+  private persistTask(task: PersistedScanTask): void {
+    try {
+      const tasksDir = this.getTasksDir();
+      if (!existsSync(tasksDir)) {
+        mkdirSync(tasksDir, { recursive: true });
+      }
+      writeFileSync(this.getTaskFilePath(task.id), JSON.stringify(task, null, 2));
+    } catch (e) {
+      console.error(`[api-security-testing] Failed to persist task ${task.id}:`, e);
+    }
+  }
+
+  // 删除持久化文件
+  private removePersistedTask(taskId: string): void {
+    try {
+      const filePath = this.getTaskFilePath(taskId);
+      if (existsSync(filePath)) {
+        unlinkSync(filePath);
+      }
+    } catch (e) {
+      console.error(`[api-security-testing] Failed to remove task file ${taskId}:`, e);
+    }
+  }
+
+  // 从文件加载任务
+  private loadPersistedTasks(): void {
+    try {
+      const tasksDir = this.getTasksDir();
+      if (!existsSync(tasksDir)) return;
+
+      const files = readdirSync(tasksDir).filter(f => f.startsWith(TASK_FILE_PREFIX));
+      for (const file of files) {
+        try {
+          const content = readFileSync(join(tasksDir, file), "utf-8");
+          const task = JSON.parse(content) as PersistedScanTask;
+          // 恢复运行中的任务状态
+          if (task.status === "running") {
+            task.status = "pending"; // 重置为待处理，等待重新执行
+          }
+          this.tasks.set(task.id, task);
+        } catch (e) {
+          console.error(`[api-security-testing] Failed to load task from ${file}:`, e);
+        }
+      }
+      console.log(`[api-security-testing] Loaded ${this.tasks.size} persisted tasks`);
+    } catch (e) {
+      console.error(`[api-security-testing] Failed to load persisted tasks:`, e);
+    }
+  }
+
+  // 订阅 OpenCode 事件
+  private subscribeToEvents(): void {
+    if (!this.client) return;
+
+    // 使用 OpenCode 的 PTY 事件来跟踪后台任务
+    this.eventSubscription = this.client.event.subscribe({
+      body: { types: ["pty.*", "session.*"] }
+    });
+
+    console.log("[api-security-testing] Subscribed to OpenCode events");
+  }
+
+  // 创建新任务
+  createTask(type: string, target: string): PersistedScanTask {
+    const id = `scan_${Date.now()}_${Math.random().toString(36).substring(2, 8)}`;
+    const task: PersistedScanTask = {
+      id,
+      status: "pending",
+      type,
+      target,
+      startTime: Date.now(),
+      progress: 0,
+      createdAt: new Date().toISOString(),
+    };
+    this.tasks.set(id, task);
+    this.persistTask(task);
+    return task;
+  }
+
+  // 更新任务状态
+  updateTask(taskId: string, updates: Partial<PersistedScanTask>): PersistedScanTask | null {
+    const task = this.tasks.get(taskId);
+    if (!task) return null;
+    Object.assign(task, updates);
+    this.persistTask(task);
+    return task;
+  }
+
+  // 获取任务
+  getTask(taskId: string): PersistedScanTask | undefined {
+    return this.tasks.get(taskId);
+  }
+
+  // 列出所有任务
+  listTasks(statusFilter?: string): PersistedScanTask[] {
+    const tasks = Array.from(this.tasks.values());
+    if (statusFilter && statusFilter !== "all") {
+      return tasks.filter(t => t.status === statusFilter);
+    }
+    return tasks.sort((a, b) => b.startTime - a.startTime);
+  }
+
+  // 取消任务
+  cancelTask(taskId: string): PersistedScanTask | null {
+    const task = this.tasks.get(taskId);
+    if (!task || task.status === "completed" || task.status === "failed") {
+      return null;
+    }
+    task.status = "cancelled";
+    task.endTime = Date.now();
+    task.error = "Cancelled by user";
+    this.persistTask(task);
+    return task;
+  }
+
+  // 使用 PTY API 创建后台任务
+  async createPtyTask(command: string, taskId: string): Promise<string | null> {
+    if (!this.client) {
+      console.error("[api-security-testing] Client not initialized");
+      return null;
+    }
+
+    try {
+      const result = await this.client.pty.create({
+        body: {
+          command,
+          cwd: this.directory,
+          env: { ...process.env },
+          cols: 120,
+          rows: 30,
+        }
+      });
+
+      if (result.error) {
+        console.error(`[api-security-testing] Failed to create PTY:`, result.error);
+        return null;
+      }
+
+      const ptyId = (result.data as { id?: string })?.id;
+      if (ptyId) {
+        this.updateTask(taskId, { ptyId, status: "running" });
+        return ptyId;
+      }
+      return null;
+    } catch (e) {
+      console.error(`[api-security-testing] PTY creation error:`, e);
+      return null;
+    }
+  }
+
+  // 获取 PTY 输出
+  async getPtyOutput(ptyId: string): Promise<string> {
+    if (!this.client) return "";
+
+    try {
+      const result = await this.client.pty.get({
+        path: { id: ptyId }
+      });
+
+      if (result.error) return "";
+      return (result.data as { output?: string })?.output || "";
+    } catch {
+      return "";
+    }
+  }
+
+  // 清理过期任务
+  cleanupOldTasks(maxAgeMs: number = 7 * 24 * 60 * 60 * 1000): void {
+    const cutoff = Date.now() - maxAgeMs;
+    for (const [id, task] of this.tasks) {
+      if (task.startTime < cutoff && (task.status === "completed" || task.status === "failed" || task.status === "cancelled")) {
+        this.tasks.delete(id);
+        this.removePersistedTask(id);
+      }
+    }
+  }
+}
+
+// 全局任务管理器实例
+const taskManager = new ScanTaskManager();
+
+// 向后兼容的简化接口
 interface ScanTask {
   id: string;
   status: "pending" | "running" | "completed" | "failed" | "cancelled";
@@ -63,6 +288,7 @@ async function processQueue(): Promise<void> {
 }
 
 const SKILL_DIR = "skills/api-security-testing";
+const TASKS_DIR = ".opencode/tasks";
 const CORE_DIR = `${SKILL_DIR}/core`;
 const AGENTS_DIR = ".config/opencode/agents";
 const CONFIG_FILE = "api-security-testing.config.json";
@@ -282,7 +508,13 @@ function detectGiveUpPattern(text: string): boolean {
 
 const ApiSecurityTestingPlugin: Plugin = async (ctx) => {
   const config = loadConfig(ctx);
-  console.log(`[api-security-testing] Plugin loaded v5.2.2 - collection_mode: ${config.collection_mode}`);
+  
+  // 初始化任务管理器 (OpenCode 原生集成)
+  taskManager.init(ctx.directory, ctx.client);
+  taskManager.cleanupOldTasks(); // 清理过期任务
+  
+  console.log(`[api-security-testing] Plugin loaded v5.4.0 - collection_mode: ${config.collection_mode}`);
+  console.log(`[api-security-testing] Task persistence enabled at ${join(ctx.directory, TASKS_DIR)}`);
 
   return {
     tool: {
@@ -902,6 +1134,135 @@ print(json.dumps(result, ensure_ascii=False))
           }, null, 2);
         },
       }),
+
+      // ========================================
+      // OpenCode 原生集成工具
+      // ========================================
+
+      // PTY 后台扫描 - 使用 OpenCode 原生 PTY API
+      pty_scan: tool({
+        description: "使用 OpenCode PTY 创建后台安全扫描任务。任务在独立 PTY 会话中运行，支持持久化和重连。",
+        args: {
+          command: tool.schema.string(),
+          description: tool.schema.string().optional(),
+        },
+        async execute(args, ctx) {
+          const command = args.command as string;
+          const taskDesc = (args.description as string) || "Background security scan";
+          
+          // 创建持久化任务
+          const task = taskManager.createTask("pty_scan", taskDesc);
+          
+          // 创建 PTY 会话
+          const ptyId = await taskManager.createPtyTask(command, task.id);
+          
+          if (!ptyId) {
+            taskManager.updateTask(task.id, { 
+              status: "failed", 
+              error: "Failed to create PTY session" 
+            });
+            return JSON.stringify({ 
+              error: "Failed to create PTY session",
+              task_id: task.id 
+            }, null, 2);
+          }
+          
+          return JSON.stringify({
+            success: true,
+            task_id: task.id,
+            pty_id: ptyId,
+            status: "running",
+            message: "Background scan started. Use pty_output to check progress.",
+            persistence: `Task persisted to ${join(ctx.directory, TASKS_DIR)}`,
+          }, null, 2);
+        },
+      }),
+
+      // PTY 输出读取
+      pty_output: tool({
+        description: "获取 PTY 后台任务的输出和状态。",
+        args: {
+          task_id: tool.schema.string(),
+        },
+        async execute(args) {
+          const taskId = args.task_id as string;
+          const task = taskManager.getTask(taskId);
+          
+          if (!task) {
+            return JSON.stringify({ error: `Task ${taskId} not found` }, null, 2);
+          }
+          
+          let output = "";
+          if (task.ptyId) {
+            output = await taskManager.getPtyOutput(task.ptyId);
+          }
+          
+          return JSON.stringify({
+            task_id: task.id,
+            status: task.status,
+            progress: task.progress,
+            output: output.slice(-5000), // 限制输出长度
+            start_time: task.startTime,
+            end_time: task.endTime,
+            error: task.error,
+          }, null, 2);
+        },
+      }),
+
+      // 持久化任务列表
+      persisted_tasks: tool({
+        description: "列出所有持久化的扫描任务（包括历史任务）。",
+        args: {
+          status_filter: tool.schema.enum(["all", "pending", "running", "completed", "failed", "cancelled"]).optional(),
+          include_output: tool.schema.boolean().optional(),
+        },
+        async execute(args) {
+          const statusFilter = (args.status_filter as string) || "all";
+          const includeOutput = (args.include_output as boolean) || false;
+          
+          const tasks = taskManager.listTasks(statusFilter);
+          
+          return JSON.stringify({
+            total: tasks.length,
+            tasks: tasks.map(t => ({
+              id: t.id,
+              status: t.status,
+              type: t.type,
+              target: t.target,
+              progress: t.progress,
+              start_time: t.startTime,
+              end_time: t.endTime,
+              created_at: t.createdAt,
+              pty_id: t.ptyId,
+              ...(includeOutput && t.result ? { result: t.result.slice(-1000) } : {}),
+            })),
+            persistence_dir: TASKS_DIR,
+          }, null, 2);
+        },
+      }),
+
+      // 事件订阅状态
+      event_status: tool({
+        description: "检查 OpenCode 事件订阅状态。",
+        args: {},
+        async execute() {
+          return JSON.stringify({
+            event_subscription_active: true,
+            supported_events: [
+              "pty.created",
+              "pty.output", 
+              "pty.exited",
+              "session.created",
+              "session.deleted"
+            ],
+            task_persistence: {
+              enabled: true,
+              directory: TASKS_DIR,
+              format: "JSON",
+            },
+          }, null, 2);
+        },
+      }),
     },
 
     // 赛博监工 Hook - chat.message