scrum-skills 0.3.2 → 0.3.3

package/tools/serve.mjs

@@ -1,154 +1,180 @@
-#!/usr/bin/env node
-/**
- * 敏捷看板 server（零依赖，node >= 18）
- * 用法: node tools/serve.mjs [目标目录] [port]   目录默认 cwd，端口默认 4173
- *
- * 它只做两件事：
- *   1. /api/agile  把目标目录 agile/*.json（三文件结构）吐给前端
- *   2. 其余路径     托管 Nuxt 静态产物（assets/board），SPA 回退 index.html
- * 页面渲染全部由 Nuxt 产物负责，这里没有任何手写 HTML。
- * 校验不通过时拒绝出报表，提示先跑 validate。
- */
-import { existsSync, statSync, createReadStream } from 'node:fs';
-import { join, resolve, extname, normalize, sep } from 'node:path';
-import { execFileSync } from 'node:child_process';
-import { createServer } from 'node:http';
-import { fileURLToPath } from 'node:url';
-import { createProjects, handleProjectApi } from './projects.mjs';
-import { createAiService, handleAiApi } from './ai.mjs';
-import { createAgileTools } from './agile-tools.mjs';
-
-const PKG_ROOT = fileURLToPath(new URL('..', import.meta.url));
-const TARGET = resolve(process.argv[2] || process.cwd());
-const PORT = Number(process.argv[3] || 4173);
-const AGILE = join(TARGET, 'agile');
-
-// 静态产物：优先用包内 assets/board，仓库内开发时退化到 apps/board/.output/public
-const BOARD_DIR = [
-  join(PKG_ROOT, 'assets/board'),
-  join(PKG_ROOT, 'apps/board/.output/public'),
-].find(d => existsSync(join(d, 'index.html')));
-
-if (!BOARD_DIR) {
-  console.error('✘ 找不到看板静态产物（assets/board/index.html）。请在仓库里先跑 pnpm --dir apps/board run generate');
-  process.exit(1);
-}
-
-try {
-  execFileSync(process.execPath, [join(PKG_ROOT, 'tools/validate.mjs'), TARGET], { stdio: 'pipe' });
-} catch (e) {
-  console.error(`✘ ${TARGET} 下的数据校验未通过，拒绝出报表。请先修复：\n${e.stdout ?? e.message}`);
-  process.exit(1);
-}
-
-const MIME = {
-  '.html': 'text/html; charset=utf-8',
-  '.js': 'text/javascript; charset=utf-8',
-  '.mjs': 'text/javascript; charset=utf-8',
-  '.css': 'text/css; charset=utf-8',
-  '.json': 'application/json; charset=utf-8',
-  '.svg': 'image/svg+xml',
-  '.png': 'image/png',
-  '.jpg': 'image/jpeg',
-  '.webp': 'image/webp',
-  '.ico': 'image/x-icon',
-  '.woff2': 'font/woff2',
-  '.woff': 'font/woff',
-  '.ttf': 'font/ttf',
-  '.map': 'application/json; charset=utf-8',
-};
-
-const projects = createProjects({ root: TARGET });
-// AI 助手：工具改的就是当前 projects 打开的那个目录，token 与项目接口共用一套
-// root 传函数：工具要跟着「看板当前打开的项目」走，而不是命令行传入的那个目录
-const agileTools = createAgileTools({ root: () => projects.list().root });
-const ai = createAiService({ root: TARGET, token: projects.list().token, tools: agileTools });
-
-function sendFile(res, file) {
-  res.writeHead(200, {
-    'content-type': MIME[extname(file).toLowerCase()] ?? 'application/octet-stream',
-    'cache-control': 'no-cache',
-  });
-  createReadStream(file).pipe(res);
-}
-
-const server = createServer(async (req, res) => {
-  const url = new URL(req.url, 'http://x');
-  const pathname = decodeURIComponent(url.pathname);
-
-  if (pathname.startsWith('/api/ai')) {
-    // 聊天请求带整段对话历史，不能再按 8KB 卡；流式回答必须直接写 socket，
-    // 走 JSON 序列化那条路会把 SSE 拼成一整块，前端就看不到逐字输出了。
-    const limit = pathname === '/api/ai/chat' ? 2 * 1024 * 1024 : 8192;
-    try {
-      let text = '';
-      for await (const chunk of req) {
-        text += chunk;
-        if (Buffer.byteLength(text) > limit) throw new Error('请求体过大');
-      }
-      const payload = text ? JSON.parse(text) : undefined;
-      const controller = new AbortController();
-      res.on('close', () => controller.abort());
-      if (payload && req.method === 'POST') payload.signal = controller.signal;
-
-      const result = await handleAiApi(ai, { method: req.method, path: req.url, headers: req.headers, body: payload });
-      if (result.stream) {
-        res.writeHead(200, {
-          'content-type': 'text/event-stream; charset=utf-8',
-          'cache-control': 'no-store',
-          connection: 'keep-alive',
-          'x-accel-buffering': 'no',
-        });
-        for await (const event of result.stream) res.write(`data: ${JSON.stringify(event)}\n\n`);
-        res.end();
-        return;
-      }
-      res.writeHead(result.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
-      res.end(JSON.stringify(result.body ?? {}));
-    } catch (e) {
-      res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
-      res.end(JSON.stringify({ error: String(e.message) }));
-    }
-    return;
-  }
-
-  if (pathname.startsWith('/api/agile') || pathname.startsWith('/api/projects')) {
-    try {
-      let text = '';
-      for await (const chunk of req) {
-        text += chunk;
-        if (Buffer.byteLength(text) > 8192) throw new Error('请求体过大');
-      }
-      const result = await handleProjectApi(projects, {
-        method: req.method, path: req.url, headers: req.headers,
-        body: text ? JSON.parse(text) : undefined,
-      });
-      res.writeHead(result.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
-      res.end(JSON.stringify(result.body));
-    } catch (e) {
-      res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
-      res.end(JSON.stringify({ error: String(e.message) }));
-    }
-    return;
-  }
-
-  // 静态文件：防目录穿越 + SPA 回退
-  const rel = normalize(pathname).replace(/^([/\\])+/, '');
-  const file = join(BOARD_DIR, rel);
-  if (!file.startsWith(BOARD_DIR + sep) && file !== BOARD_DIR) {
-    res.writeHead(403).end('forbidden');
-    return;
-  }
-  if (pathname !== '/' && existsSync(file) && statSync(file).isFile()) return sendFile(res, file);
-
-  const index = join(BOARD_DIR, 'index.html');
-  if (existsSync(index)) return sendFile(res, index);
-
-  res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' }).end('not found');
-});
-
-server.listen(PORT, '127.0.0.1', () => {
-  console.log(`敏捷看板: http://localhost:${PORT}`);
-  console.log(`  数据目录: ${AGILE}`);
-  console.log(`  静态产物: ${BOARD_DIR}`);
-});
+#!/usr/bin/env node
+/**
+ * 敏捷看板 server（零依赖，node >= 18）
+ * 用法: node tools/serve.mjs [目标目录] [port]   目录默认 cwd，端口默认 4173
+ *
+ * 它只做两件事：
+ *   1. /api/agile  把目标目录 agile/*.json（三文件结构）吐给前端
+ *   2. 其余路径     托管 Nuxt 静态产物（assets/board），SPA 回退 index.html
+ * 页面渲染全部由 Nuxt 产物负责，这里没有任何手写 HTML。
+ * 校验不通过时拒绝出报表，提示先跑 validate。
+ */
+import { existsSync, statSync, createReadStream } from 'node:fs';
+import { join, resolve, extname, normalize, sep } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createServer } from 'node:http';
+import { fileURLToPath } from 'node:url';
+import { createProjects, handleProjectApi } from './projects.mjs';
+import { createAiService, handleAiApi } from './ai.mjs';
+import { createAgileTools } from './agile-tools.mjs';
+
+const PKG_ROOT = fileURLToPath(new URL('..', import.meta.url));
+const TARGET = resolve(process.argv[2] || process.cwd());
+const PORT = Number(process.argv[3] || 4173);
+const AGILE = join(TARGET, 'agile');
+
+// 静态产物：优先用包内 assets/board，仓库内开发时退化到 apps/board/.output/public
+const BOARD_DIR = [
+  join(PKG_ROOT, 'assets/board'),
+  join(PKG_ROOT, 'apps/board/.output/public'),
+].find(d => existsSync(join(d, 'index.html')));
+
+if (!BOARD_DIR) {
+  console.error('✘ 找不到看板静态产物（assets/board/index.html）。请在仓库里先跑 pnpm build');
+  process.exit(1);
+}
+
+try {
+  execFileSync(process.execPath, [join(PKG_ROOT, 'tools/validate.mjs'), TARGET], { stdio: 'pipe' });
+} catch (e) {
+  console.error(`✘ ${TARGET} 下的数据校验未通过，拒绝出报表。请先修复：\n${e.stdout ?? e.message}`);
+  process.exit(1);
+}
+
+const MIME = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.webp': 'image/webp',
+  '.ico': 'image/x-icon',
+  '.woff2': 'font/woff2',
+  '.woff': 'font/woff',
+  '.ttf': 'font/ttf',
+  '.map': 'application/json; charset=utf-8',
+};
+
+const projects = createProjects({ root: TARGET });
+// AI 助手：工具改的就是当前 projects 打开的那个目录，token 与项目接口共用一套
+// root 传函数：工具要跟着「看板当前打开的项目」走，而不是命令行传入的那个目录
+const agileTools = createAgileTools({ root: () => projects.list().root });
+const ai = createAiService({ root: TARGET, token: projects.list().token, tools: agileTools });
+
+function sendFile(res, file) {
+  res.writeHead(200, {
+    'content-type': MIME[extname(file).toLowerCase()] ?? 'application/octet-stream',
+    'cache-control': 'no-cache',
+  });
+  createReadStream(file).pipe(res);
+}
+
+const server = createServer(async (req, res) => {
+  const url = new URL(req.url, 'http://x');
+  const pathname = decodeURIComponent(url.pathname);
+
+  if (pathname.startsWith('/api/ai')) {
+    // 聊天请求带整段对话历史，不能再按 8KB 卡；流式回答必须直接写 socket，
+    // 走 JSON 序列化那条路会把 SSE 拼成一整块，前端就看不到逐字输出了。
+    const limit = pathname === '/api/ai/chat' ? 2 * 1024 * 1024 : 8192;
+    try {
+      let text = '';
+      for await (const chunk of req) {
+        text += chunk;
+        if (Buffer.byteLength(text) > limit) throw new Error('请求体过大');
+      }
+      const payload = text ? JSON.parse(text) : undefined;
+      const controller = new AbortController();
+      res.on('close', () => controller.abort());
+      if (payload && req.method === 'POST') payload.signal = controller.signal;
+
+      const result = await handleAiApi(ai, { method: req.method, path: req.url, headers: req.headers, body: payload });
+      if (result.stream) {
+        res.writeHead(200, {
+          'content-type': 'text/event-stream; charset=utf-8',
+          'cache-control': 'no-store',
+          connection: 'keep-alive',
+          'x-accel-buffering': 'no',
+        });
+        for await (const event of result.stream) res.write(`data: ${JSON.stringify(event)}\n\n`);
+        res.end();
+        return;
+      }
+      res.writeHead(result.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      res.end(JSON.stringify(result.body ?? {}));
+    } catch (e) {
+      res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
+      res.end(JSON.stringify({ error: String(e.message) }));
+    }
+    return;
+  }
+
+  // 图例产物：唯一一个不返回 JSON 的接口。按 id 取文件，路径由索引决定（不接受客户端路径）。
+  // 下发的 CSP 是兜底：即便产物里带脚本，也只能在这个 sandbox 里跑，碰不到看板本身。
+  if (pathname === '/api/agile/diagram') {
+    const host = req.headers.host || '';
+    const sameOrigin = /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host)
+      && (!req.headers.origin || req.headers.origin === `http://${host}`)
+      && req.headers['sec-fetch-site'] !== 'cross-site';
+    if (!sameOrigin) {
+      res.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' }).end('forbidden');
+      return;
+    }
+    try {
+      const { contentType, text } = projects.readDiagram(url.searchParams.get('id'), url.searchParams.get('format') ?? 'html');
+      res.writeHead(200, {
+        'content-type': contentType,
+        'content-security-policy': "sandbox allow-scripts",
+        'x-content-type-options': 'nosniff',
+        'cache-control': 'no-store',
+      });
+      res.end(text);
+    } catch (e) {
+      res.writeHead(404, { 'content-type': 'application/json; charset=utf-8' }).end(JSON.stringify({ error: String(e.message) }));
+    }
+    return;
+  }
+
+  if (pathname.startsWith('/api/agile') || pathname.startsWith('/api/projects')) {
+    try {
+      let text = '';
+      for await (const chunk of req) {
+        text += chunk;
+        if (Buffer.byteLength(text) > 8192) throw new Error('请求体过大');
+      }
+      const result = await handleProjectApi(projects, {
+        method: req.method, path: req.url, headers: req.headers,
+        body: text ? JSON.parse(text) : undefined,
+      });
+      res.writeHead(result.status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' });
+      res.end(JSON.stringify(result.body));
+    } catch (e) {
+      res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
+      res.end(JSON.stringify({ error: String(e.message) }));
+    }
+    return;
+  }
+
+  // 静态文件：防目录穿越 + SPA 回退
+  const rel = normalize(pathname).replace(/^([/\\])+/, '');
+  const file = join(BOARD_DIR, rel);
+  if (!file.startsWith(BOARD_DIR + sep) && file !== BOARD_DIR) {
+    res.writeHead(403).end('forbidden');
+    return;
+  }
+  if (pathname !== '/' && existsSync(file) && statSync(file).isFile()) return sendFile(res, file);
+
+  const index = join(BOARD_DIR, 'index.html');
+  if (existsSync(index)) return sendFile(res, index);
+
+  res.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' }).end('not found');
+});
+
+server.listen(PORT, '127.0.0.1', () => {
+  console.log(`敏捷看板: http://localhost:${PORT}`);
+  console.log(`  数据目录: ${AGILE}`);
+  console.log(`  静态产物: ${BOARD_DIR}`);
+});