redskillhub-upload 1.0.0-alpha.1

package/cli/pack.mjs

@@ -0,0 +1,494 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs/promises';
+import fsSync from 'node:fs';
+import path from 'node:path';
+import AdmZip from 'adm-zip';
+import { getTmpDir } from './config.mjs';
+import { SkillhubUploadError, ExitCodes } from './errors.mjs';
+
+const IGNORE_DIRS = new Set(['.git', 'node_modules', '__MACOSX']);
+const IGNORE_FILES = new Set(['.DS_Store']);
+const ROOT_SKILL_FILES = ['SKILL.md', 'skill.md'];
+const SINGLE_FILE_MAX_SIZE = 10 * 1024 * 1024;
+const TOTAL_MAX_SIZE = 30 * 1024 * 1024;
+const ALLOWED_EXTENSIONS = new Set([
+  '.md',
+  '.txt',
+  '.html',
+  '.htm',
+  '.css',
+  '.js',
+  '.py',
+  '.java',
+  '.cpp',
+  '.c',
+  '.h',
+  '.php',
+  '.sh',
+  '.bat',
+  '.ps1',
+  '.json',
+  '.xml',
+  '.sql',
+  '.ini',
+  '.cfg',
+  '.log',
+  '.db',
+  '.sqlite',
+  '.sqlite3',
+  '.mdb',
+  '.accdb',
+  '.sys'
+]);
+const BINARY_EXTENSIONS = new Set([
+  '.exe',
+  '.dll',
+  '.so',
+  '.dylib',
+  '.bin',
+  '.obj',
+  '.o',
+  '.a',
+  '.lib',
+  '.class',
+  '.jar',
+  '.war',
+  '.ear',
+  '.zip',
+  '.tar',
+  '.gz',
+  '.rar',
+  '.7z',
+  '.png',
+  '.jpg',
+  '.jpeg',
+  '.gif',
+  '.bmp',
+  '.ico',
+  '.svg',
+  '.webp',
+  '.mp3',
+  '.mp4',
+  '.avi',
+  '.mov',
+  '.wav',
+  '.pdf',
+  '.doc',
+  '.docx',
+  '.xls',
+  '.xlsx',
+  '.ppt',
+  '.pptx'
+]);
+const ARCHIVE_EXTENSIONS = new Set(['.zip', '.tar', '.gz', '.rar', '.7z']);
+
+export function parseSkillMarkdown(markdown) {
+  const match = markdown.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+  if (!match) {
+    return { frontmatter: {}, detail: markdown.trim() };
+  }
+
+  const frontmatter = {};
+  for (const line of match[1].split('\n')) {
+    const idx = line.indexOf(':');
+    if (idx > 0) {
+      frontmatter[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();
+    }
+  }
+
+  return { frontmatter, detail: match[2].trim() };
+}
+
+export function deriveIdentifier(name = '') {
+  return name
+    .normalize('NFKD')
+    .replace(/[^\w\s-]/g, '')
+    .trim()
+    .toLowerCase()
+    .replace(/\s+/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-|-$/g, '')
+    .slice(0, 64);
+}
+
+async function walkDirectory(root, rel = '') {
+  const current = path.join(root, rel);
+  const entries = await fs.readdir(current, { withFileTypes: true });
+  const files = [];
+
+  for (const entry of entries) {
+    const entryRel = path.join(rel, entry.name);
+    const entryPath = path.join(root, entryRel);
+    const stat = await fs.lstat(entryPath);
+
+    if (stat.isSymbolicLink()) {
+      throw new SkillhubUploadError(
+        'LOCAL_VALIDATION_FAILED',
+        `目录中包含符号链接：${entryRel}，请移除后重试`,
+        ExitCodes.LOCAL_VALIDATION
+      );
+    }
+    if (stat.isDirectory() && IGNORE_DIRS.has(entry.name)) {
+      continue;
+    }
+    if (stat.isFile() && IGNORE_FILES.has(entry.name)) {
+      continue;
+    }
+
+    if (stat.isDirectory()) {
+      files.push(...await walkDirectory(root, entryRel));
+    }
+    if (stat.isFile()) {
+      files.push(entryRel);
+    }
+  }
+
+  return files;
+}
+
+async function sha256File(file) {
+  const hash = crypto.createHash('sha256');
+  await new Promise((resolve, reject) => {
+    fsSync.createReadStream(file)
+      .on('data', (chunk) => hash.update(chunk))
+      .on('error', reject)
+      .on('end', resolve);
+  });
+  return hash.digest('hex');
+}
+
+function bufferStartsWith(buffer, bytes, offset = 0) {
+  if (buffer.length < offset + bytes.length) {
+    return false;
+  }
+  return bytes.every((byte, index) => buffer[offset + index] === byte);
+}
+
+function bufferAscii(buffer, start, length) {
+  if (buffer.length < start + length) {
+    return '';
+  }
+  return buffer.subarray(start, start + length).toString('ascii');
+}
+
+function hasForbiddenSignature(buffer) {
+  const head = buffer.subarray(0, Math.min(buffer.length, 512));
+  return (
+    bufferStartsWith(head, [0x4d, 0x5a]) || // exe / dll
+    bufferStartsWith(head, [0x7f, 0x45, 0x4c, 0x46]) || // so / object
+    bufferStartsWith(head, [0xfe, 0xed, 0xfa, 0xce]) ||
+    bufferStartsWith(head, [0xfe, 0xed, 0xfa, 0xcf]) ||
+    bufferStartsWith(head, [0xce, 0xfa, 0xed, 0xfe]) ||
+    bufferStartsWith(head, [0xcf, 0xfa, 0xed, 0xfe]) || // Mach-O
+    bufferStartsWith(head, [0x21, 0x3c, 0x61, 0x72, 0x63, 0x68, 0x3e, 0x0a]) || // .a / .lib archive
+    bufferStartsWith(head, [0xca, 0xfe, 0xba, 0xbe]) || // class
+    bufferStartsWith(head, [0x50, 0x4b, 0x03, 0x04]) || // zip / jar / docx / xlsx / pptx
+    bufferStartsWith(head, [0x50, 0x4b, 0x05, 0x06]) ||
+    bufferStartsWith(head, [0x50, 0x4b, 0x07, 0x08]) ||
+    bufferStartsWith(head, [0x1f, 0x8b]) || // gzip
+    bufferStartsWith(head, [0x52, 0x61, 0x72, 0x21, 0x1a, 0x07]) || // rar
+    bufferStartsWith(head, [0x37, 0x7a, 0xbc, 0xaf, 0x27, 0x1c]) || // 7z
+    bufferStartsWith(head, [0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]) || // png
+    bufferStartsWith(head, [0xff, 0xd8, 0xff]) || // jpeg
+    bufferAscii(head, 0, 6) === 'GIF87a' ||
+    bufferAscii(head, 0, 6) === 'GIF89a' ||
+    bufferStartsWith(head, [0x42, 0x4d]) || // bmp
+    bufferStartsWith(head, [0x00, 0x00, 0x01, 0x00]) || // ico
+    bufferAscii(head, 0, 3) === 'ID3' ||
+    bufferStartsWith(head, [0xff, 0xfb]) ||
+    bufferStartsWith(head, [0xff, 0xf3]) ||
+    bufferStartsWith(head, [0xff, 0xf2]) || // mp3
+    bufferAscii(head, 4, 4) === 'ftyp' || // mp4 / mov
+    (bufferAscii(head, 0, 4) === 'RIFF' && bufferAscii(head, 8, 4) === 'AVI ') ||
+    bufferStartsWith(head, [0x25, 0x50, 0x44, 0x46]) || // pdf
+    bufferStartsWith(head, [0xd0, 0xcf, 0x11, 0xe0, 0xa1, 0xb1, 0x1a, 0xe1]) || // old office
+    bufferAscii(head, 257, 5) === 'ustar'
+  );
+}
+
+function throwBinary(file) {
+  throw new SkillhubUploadError(
+    'LOCAL_VALIDATION_FAILED',
+    `目录中包含不支持上传的文件：${file}，请移除后重试`,
+    ExitCodes.LOCAL_VALIDATION
+  );
+}
+
+function throwUnsafeZipEntry(file) {
+  throw new SkillhubUploadError(
+    'LOCAL_VALIDATION_FAILED',
+    `zip 中包含不安全路径：${file}，请解压检查后重试`,
+    ExitCodes.LOCAL_VALIDATION
+  );
+}
+
+function throwOversized(file) {
+  throw new SkillhubUploadError(
+    'LOCAL_VALIDATION_FAILED',
+    `文件超过 10MB：${file}，请压缩内容或移除后重试`,
+    ExitCodes.LOCAL_VALIDATION
+  );
+}
+
+async function hasForbiddenFileSignature(filePath) {
+  const handle = await fs.open(filePath, 'r');
+  try {
+    const buffer = Buffer.alloc(512);
+    const { bytesRead } = await handle.read(buffer, 0, buffer.length, 0);
+    return hasForbiddenSignature(buffer.subarray(0, bytesRead));
+  } finally {
+    await handle.close();
+  }
+}
+
+async function validateSourceFile(root, file) {
+  const actual = path.join(root, file);
+  const stat = await fs.stat(actual);
+  if (stat.size > SINGLE_FILE_MAX_SIZE) {
+    throwOversized(file);
+  }
+  if (BINARY_EXTENSIONS.has(path.extname(file).toLowerCase())) {
+    throwBinary(file);
+  }
+  if (await hasForbiddenFileSignature(actual)) {
+    throwBinary(file);
+  }
+  return stat.size;
+}
+
+function validateAllowedExtension(file) {
+  const ext = path.extname(file).toLowerCase();
+  if (!ALLOWED_EXTENSIONS.has(ext) || BINARY_EXTENSIONS.has(ext)) {
+    throwBinary(file);
+  }
+}
+
+function isAllowedExtension(file) {
+  return ALLOWED_EXTENSIONS.has(path.extname(file).toLowerCase());
+}
+
+async function createTempZipPath(env) {
+  const dir = await fs.mkdtemp(path.join(getTmpDir(env), `bundle-${process.pid}-`));
+  return path.join(dir, `${crypto.randomUUID()}.zip`);
+}
+
+function normalizeEntryPath(file) {
+  return file.split(path.sep).join('/');
+}
+
+function normalizeSkillEntryName(file) {
+  return file === 'skill.md' ? 'SKILL.md' : normalizeEntryPath(file);
+}
+
+async function resolveRootSkillPath(inputPath) {
+  for (const name of ROOT_SKILL_FILES) {
+    const skillPath = path.join(inputPath, name);
+    const stat = await fs.lstat(skillPath).catch(() => null);
+    if (!stat) {
+      continue;
+    }
+    if (stat.isSymbolicLink()) {
+      throw new SkillhubUploadError('LOCAL_VALIDATION_FAILED', `${name} 是符号链接，请改为普通文件后重试`, ExitCodes.LOCAL_VALIDATION);
+    }
+    if (!stat.isFile()) {
+      continue;
+    }
+    return skillPath;
+  }
+  return null;
+}
+
+async function prepareDirectorySource(inputPath) {
+  const skillPath = await resolveRootSkillPath(inputPath);
+  if (!skillPath) {
+    throw new SkillhubUploadError('LOCAL_VALIDATION_FAILED', '目录根目录缺少 SKILL.md，请确认输入的是 skill 目录', ExitCodes.LOCAL_VALIDATION);
+  }
+
+  const files = await walkDirectory(inputPath);
+  let totalSize = 0;
+  for (const file of files) {
+    validateAllowedExtension(file);
+    totalSize += await validateSourceFile(inputPath, file);
+    if (totalSize > TOTAL_MAX_SIZE) {
+      throw new SkillhubUploadError(
+        'LOCAL_VALIDATION_FAILED',
+        'skill 目录总大小不能超过 30MB，请精简后重试',
+        ExitCodes.LOCAL_VALIDATION
+      );
+    }
+  }
+
+  const markdown = await fs.readFile(skillPath, 'utf8');
+  return {
+    files: await Promise.all(files.map(async (file) => ({
+      entryName: normalizeSkillEntryName(file),
+      data: await fs.readFile(path.join(inputPath, file))
+    }))),
+    markdown,
+    sourcePathBaseName: path.basename(inputPath)
+  };
+}
+
+function isIgnoredZipEntry(rawName) {
+  const name = rawName.replace(/^\/+/, '');
+  const parts = name.split('/').filter(Boolean);
+  const baseName = parts.at(-1) || '';
+  return parts.includes('__MACOSX') || baseName.startsWith('.') || baseName === '.DS_Store';
+}
+
+function assertSafeZipEntryName(rawName) {
+  const normalized = rawName.replace(/\\/g, '/').replace(/^\/+/, '');
+  if (
+    !normalized
+    || path.posix.isAbsolute(rawName.replace(/\\/g, '/'))
+    || /^[A-Za-z]:/.test(rawName)
+    || normalized.split('/').some((part) => part === '..')
+  ) {
+    throwUnsafeZipEntry(rawName);
+  }
+  return normalized;
+}
+
+function stripCommonDirectoryPrefix(paths) {
+  if (paths.length === 0) {
+    return '';
+  }
+  const segmentsList = paths.map((item) => item.split('/'));
+  const first = segmentsList[0][0];
+  if (!first || segmentsList.some((segments) => segments.length < 2 || segments[0] !== first)) {
+    return '';
+  }
+  return `${first}/`;
+}
+
+function findRootSkillEntry(files) {
+  return files.find((file) => ROOT_SKILL_FILES.includes(file.entryName));
+}
+
+function validateSize(file, size) {
+  if (size > SINGLE_FILE_MAX_SIZE) {
+    throwOversized(file);
+  }
+  return size;
+}
+
+async function prepareZipSource(inputPath) {
+  const zip = new AdmZip(inputPath);
+  const rawFiles = [];
+
+  for (const entry of zip.getEntries()) {
+    if (entry.isDirectory) {
+      continue;
+    }
+    const safeName = assertSafeZipEntryName(entry.entryName);
+    if (isIgnoredZipEntry(safeName)) {
+      continue;
+    }
+    rawFiles.push({ entry, safeName });
+  }
+
+  const commonPrefix = stripCommonDirectoryPrefix(rawFiles.map((file) => file.safeName));
+  const files = [];
+  const seen = new Set();
+  let totalSize = 0;
+  for (const file of rawFiles) {
+    const entryName = file.safeName.slice(commonPrefix.length);
+    if (!entryName || isIgnoredZipEntry(entryName)) {
+      continue;
+    }
+    const ext = path.extname(entryName).toLowerCase();
+    if (ARCHIVE_EXTENSIONS.has(ext)) {
+      throwBinary(entryName);
+    }
+    if (!isAllowedExtension(entryName)) {
+      continue;
+    }
+
+    const data = file.entry.getData();
+    const size = Math.max(Number(file.entry.header?.size ?? 0), data.length);
+    totalSize += validateSize(entryName, size);
+    if (totalSize > TOTAL_MAX_SIZE) {
+      throw new SkillhubUploadError(
+        'LOCAL_VALIDATION_FAILED',
+        'skill 目录总大小不能超过 30MB，请精简后重试',
+        ExitCodes.LOCAL_VALIDATION
+      );
+    }
+
+    if (hasForbiddenSignature(data)) {
+      throwBinary(entryName);
+    }
+    const normalizedEntryName = entryName === 'skill.md' ? 'SKILL.md' : entryName;
+    if (seen.has(normalizedEntryName)) {
+      continue;
+    }
+    seen.add(normalizedEntryName);
+    files.push({
+      entryName: normalizedEntryName,
+      data
+    });
+  }
+
+  const skillEntry = findRootSkillEntry(files);
+  if (!skillEntry) {
+    throw new SkillhubUploadError('LOCAL_VALIDATION_FAILED', 'zip 根目录缺少 SKILL.md，请确认输入的是 skill 包', ExitCodes.LOCAL_VALIDATION);
+  }
+
+  return {
+    files,
+    markdown: skillEntry.data.toString('utf8'),
+    sourcePathBaseName: path.basename(inputPath, path.extname(inputPath))
+  };
+}
+
+async function buildBundle(source, env) {
+  const parsed = parseSkillMarkdown(source.markdown);
+  const zip = new AdmZip();
+  for (const file of source.files) {
+    zip.addFile(file.entryName, file.data);
+  }
+
+  const zipPath = await createTempZipPath(env);
+  zip.writeZip(zipPath);
+  const zipStat = await fs.stat(zipPath);
+
+  return {
+    zipPath,
+    bundleSha256: await sha256File(zipPath),
+    bundleSizeBytes: zipStat.size,
+    metadata: {
+      name: parsed.frontmatter.name || '',
+      description: parsed.frontmatter.description || '',
+      version: parsed.frontmatter.version || '',
+      detail: parsed.detail,
+      sourcePathBaseName: source.sourcePathBaseName
+    }
+  };
+}
+
+export async function prepareBundle(inputPath, options = {}) {
+  const env = options.env || process.env;
+  const stat = await fs.lstat(inputPath).catch(() => null);
+  if (!stat) {
+    throw new SkillhubUploadError('LOCAL_VALIDATION_FAILED', `路径不存在：${inputPath}，请输入正确的 skill 目录或 zip 文件`, ExitCodes.LOCAL_VALIDATION);
+  }
+  if (stat.isSymbolicLink()) {
+    throw new SkillhubUploadError('LOCAL_VALIDATION_FAILED', '输入路径是符号链接，请输入真实的 skill 目录或 zip 文件', ExitCodes.LOCAL_VALIDATION);
+  }
+  await fs.mkdir(getTmpDir(env), { recursive: true, mode: 0o700 });
+
+  let source;
+  if (stat.isDirectory()) {
+    source = await prepareDirectorySource(inputPath);
+  } else if (stat.isFile() && path.extname(inputPath).toLowerCase() === '.zip') {
+    source = await prepareZipSource(inputPath);
+  } else {
+    throw new SkillhubUploadError(
+      'LOCAL_VALIDATION_FAILED',
+      '请输入 skill 目录或 zip 文件',
+      ExitCodes.LOCAL_VALIDATION
+    );
+  }
+
+  return await buildBundle(source, env);
+}

package/cli/prompt.mjs

@@ -0,0 +1,115 @@
+import readline from 'node:readline';
+import { writePrompt } from './output.mjs';
+
+function createRl(input) {
+  return readline.createInterface({ input, crlfDelay: Infinity });
+}
+
+async function readLine(iterator) {
+  const next = await iterator.next();
+  return next.done ? '' : String(next.value).trim();
+}
+
+export function createPromptSession(io = {}) {
+  const input = io.input || process.stdin;
+  const out = io.out || process.stdout;
+  const rl = createRl(input);
+  const iterator = rl[Symbol.asyncIterator]();
+  return {
+    input,
+    out,
+    readLine: () => readLine(iterator),
+    close: () => rl.close()
+  };
+}
+
+export async function askAgent(prompt, io = {}) {
+  const input = io.input || process.stdin;
+  const out = io.out || process.stdout;
+  writePrompt(prompt, out);
+
+  if (io.readLine) {
+    return io.readLine();
+  }
+
+  const rl = createRl(input);
+  try {
+    return await readLine(rl[Symbol.asyncIterator]());
+  } finally {
+    rl.close();
+  }
+}
+
+export async function confirmAgent(payload, io = {}) {
+  const input = io.input || process.stdin;
+  const out = io.out || process.stdout;
+  writePrompt({ type: 'confirm', payload }, out);
+
+  if (io.readLine) {
+    const first = await io.readLine();
+    if (first === 'submit') {
+      return { action: 'submit' };
+    }
+    if (first === 'cancel') {
+      return { action: 'cancel' };
+    }
+    if (first === 'edit') {
+      const values = {};
+      while (true) {
+        const trimmed = await io.readLine();
+        if (!trimmed) {
+          break;
+        }
+
+        const idx = trimmed.indexOf('=');
+        if (idx < 0) {
+          throw new Error(`确认信息修改格式不正确，请使用 key=value 格式：${trimmed}`);
+        }
+
+        const key = trimmed.slice(0, idx).trim();
+        if (!key) {
+          throw new Error(`确认信息修改格式不正确，请使用 key=value 格式：${trimmed}`);
+        }
+        values[key] = trimmed.slice(idx + 1).trim();
+      }
+      return { action: 'edit', values };
+    }
+    return { action: first || 'cancel' };
+  }
+
+  const rl = createRl(input);
+  try {
+    const iterator = rl[Symbol.asyncIterator]();
+    const first = await readLine(iterator);
+    if (first === 'submit') {
+      return { action: 'submit' };
+    }
+    if (first === 'cancel') {
+      return { action: 'cancel' };
+    }
+    if (first === 'edit') {
+      const values = {};
+      for await (const line of iterator) {
+        const trimmed = String(line).trim();
+        if (!trimmed) {
+          break;
+        }
+
+        const idx = trimmed.indexOf('=');
+        if (idx < 0) {
+          throw new Error(`确认信息修改格式不正确，请使用 key=value 格式：${trimmed}`);
+        }
+
+        const key = trimmed.slice(0, idx).trim();
+        if (!key) {
+          throw new Error(`确认信息修改格式不正确，请使用 key=value 格式：${trimmed}`);
+        }
+        values[key] = trimmed.slice(idx + 1).trim();
+      }
+      return { action: 'edit', values };
+    }
+    return { action: first || 'cancel' };
+  } finally {
+    rl.close();
+  }
+}

package/cli/redact.mjs

@@ -0,0 +1,8 @@
+export function redactMessage(message, sensitiveValues = [], placeholder = '<redacted>') {
+  let text = String(message || '未知错误');
+  for (const value of sensitiveValues) {
+    if (!value) continue;
+    text = text.split(value).join(placeholder);
+  }
+  return text;
+}