superacli 1.1.6 → 1.1.7

package/server/services/pluginsService.js

@@ -0,0 +1,303 @@
+const crypto = require("crypto")
+const { getStorage } = require("../storage/adapter")
+const { bumpVersion } = require("./configService")
+
+const PLUGIN_PREFIX = "plugin_server:"
+const SETTINGS_KEY = "settings:plugins"
+
+function invalid(message) {
+  return Object.assign(new Error(message), {
+    code: 85,
+    type: "invalid_argument",
+    recoverable: false,
+  })
+}
+
+function defaultSettings() {
+  return {
+    max_zip_mb: 10,
+    default_hooks_policy: "deny",
+  }
+}
+
+function pluginKey(name) {
+  return `${PLUGIN_PREFIX}${name}`
+}
+
+function normalizeStringArray(value) {
+  if (!Array.isArray(value)) return []
+  return value.map(v => String(v)).filter(Boolean)
+}
+
+function sanitizeManifest(manifest, expectedName) {
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw invalid("manifest must be an object")
+  }
+  const name = String(manifest.name || "").trim()
+  if (!name) throw invalid("manifest.name is required")
+  if (expectedName && name !== expectedName) {
+    throw invalid(`manifest.name '${name}' must match plugin name '${expectedName}'`)
+  }
+  if (!Array.isArray(manifest.commands)) {
+    throw invalid("manifest.commands must be an array")
+  }
+  return manifest
+}
+
+function sanitizeHooksPolicy(value, fallback) {
+  const raw = String(value || fallback || "inherit").trim().toLowerCase()
+  if (!["inherit", "allow", "deny"].includes(raw)) {
+    throw invalid("hooks_policy must be one of: inherit, allow, deny")
+  }
+  return raw
+}
+
+function hashBuffer(buffer) {
+  return crypto.createHash("sha256").update(buffer).digest("hex")
+}
+
+function isUnsafeZipEntryName(name) {
+  if (!name) return true
+  if (name.startsWith("/") || name.startsWith("\\")) return true
+  if (/^[a-zA-Z]:[\\/]/.test(name)) return true
+  if (name.includes("../") || name.includes("..\\")) return true
+  return false
+}
+
+function inspectZipEntries(buffer) {
+  let totalUncompressed = 0
+  let entries = 0
+  for (let i = 0; i <= buffer.length - 46; i++) {
+    if (buffer[i] !== 0x50 || buffer[i + 1] !== 0x4b || buffer[i + 2] !== 0x01 || buffer[i + 3] !== 0x02) {
+      continue
+    }
+    const uncompressedSize = buffer.readUInt32LE(i + 24)
+    const fileNameLength = buffer.readUInt16LE(i + 28)
+    const extraLength = buffer.readUInt16LE(i + 30)
+    const commentLength = buffer.readUInt16LE(i + 32)
+    const fileNameStart = i + 46
+    const fileNameEnd = fileNameStart + fileNameLength
+    if (fileNameEnd > buffer.length) throw invalid("ZIP appears corrupted")
+
+    const fileName = buffer.subarray(fileNameStart, fileNameEnd).toString("utf-8")
+    if (isUnsafeZipEntryName(fileName)) {
+      throw invalid(`ZIP contains unsafe path '${fileName}'`)
+    }
+
+    totalUncompressed += Number(uncompressedSize)
+    entries += 1
+    i = fileNameEnd + extraLength + commentLength - 1
+  }
+  if (entries === 0) throw invalid("ZIP has no central directory entries")
+  return { entries, totalUncompressed }
+}
+
+async function getSettings() {
+  const storage = getStorage()
+  const stored = await storage.get(SETTINGS_KEY)
+  const merged = { ...defaultSettings(), ...(stored || {}) }
+  const maxZip = Number(merged.max_zip_mb)
+  if (!Number.isFinite(maxZip) || maxZip <= 0) merged.max_zip_mb = 10
+  merged.default_hooks_policy = sanitizeHooksPolicy(merged.default_hooks_policy, "deny")
+  return merged
+}
+
+async function updateSettings(patch = {}) {
+  const current = await getSettings()
+  const next = { ...current }
+  if (patch.max_zip_mb !== undefined) {
+    const value = Number(patch.max_zip_mb)
+    if (!Number.isFinite(value) || value <= 0) {
+      throw invalid("max_zip_mb must be a positive number")
+    }
+    next.max_zip_mb = value
+  }
+  if (patch.default_hooks_policy !== undefined) {
+    next.default_hooks_policy = sanitizeHooksPolicy(patch.default_hooks_policy, next.default_hooks_policy)
+  }
+  const storage = getStorage()
+  await storage.set(SETTINGS_KEY, next)
+  return next
+}
+
+function toPublicPlugin(record) {
+  return {
+    name: record.name,
+    version: record.version,
+    description: record.description || "",
+    source_type: record.source_type,
+    enabled: record.enabled !== false,
+    checksum: record.checksum,
+    size_bytes: record.size_bytes || 0,
+    has_learn: record.has_learn === true,
+    tags: normalizeStringArray(record.tags),
+    hooks_policy: record.hooks_policy || "inherit",
+    updated_at: record.updated_at,
+    manifest: record.manifest,
+  }
+}
+
+async function listServerPlugins() {
+  const storage = getStorage()
+  const keys = await storage.listKeys(PLUGIN_PREFIX)
+  const records = await Promise.all(keys.map(k => storage.get(k)))
+  return records
+    .filter(Boolean)
+    .sort((a, b) => String(a.name || "").localeCompare(String(b.name || "")))
+    .map(toPublicPlugin)
+}
+
+async function getServerPlugin(name) {
+  const storage = getStorage()
+  const record = await storage.get(pluginKey(name))
+  if (!record) return null
+  return toPublicPlugin(record)
+}
+
+function normalizeCommonPayload(payload) {
+  const name = String(payload.name || "").trim()
+  if (!name) throw invalid("name is required")
+  const version = String(payload.version || "0.0.0").trim() || "0.0.0"
+  const description = String(payload.description || "")
+  const enabled = payload.enabled === undefined ? true : payload.enabled === true
+  const hasLearn = payload.has_learn === true
+  const tags = normalizeStringArray(payload.tags)
+  const hooksPolicy = sanitizeHooksPolicy(payload.hooks_policy, "inherit")
+  return {
+    name,
+    version,
+    description,
+    enabled,
+    has_learn: hasLearn,
+    tags,
+    hooks_policy: hooksPolicy,
+  }
+}
+
+async function upsertJsonPlugin(payload) {
+  const common = normalizeCommonPayload(payload)
+  const manifest = sanitizeManifest(payload.manifest, common.name)
+  const content = Buffer.from(JSON.stringify(manifest, null, 2), "utf-8")
+  const now = new Date().toISOString()
+  const next = {
+    ...common,
+    source_type: "json",
+    manifest,
+    archive_base64: null,
+    checksum: hashBuffer(content),
+    size_bytes: content.length,
+    updated_at: now,
+  }
+  const storage = getStorage()
+  await storage.set(pluginKey(common.name), next)
+  await bumpVersion()
+  return toPublicPlugin(next)
+}
+
+async function upsertZipPlugin(payload) {
+  const common = normalizeCommonPayload(payload)
+  const manifest = sanitizeManifest(payload.manifest, common.name)
+  const archiveBase64 = payload.archive_base64 ? String(payload.archive_base64).trim() : ""
+  const archiveBuffer = Buffer.isBuffer(payload.archive_buffer) ? payload.archive_buffer : null
+  if (!archiveBase64 && !archiveBuffer) throw invalid("ZIP payload is required")
+
+  const buffer = archiveBuffer || Buffer.from(archiveBase64, "base64")
+  if (!buffer.length) throw invalid("archive_base64 is empty or invalid")
+
+  const settings = await getSettings()
+  const maxBytes = Math.floor(Number(settings.max_zip_mb) * 1024 * 1024)
+  if (buffer.length > maxBytes) {
+    throw invalid(`ZIP exceeds max size of ${settings.max_zip_mb}MB`)
+  }
+  if (!(buffer[0] === 0x50 && buffer[1] === 0x4b)) {
+    throw invalid("archive_base64 must be a ZIP payload")
+  }
+  const zipStats = inspectZipEntries(buffer)
+  if (zipStats.totalUncompressed > maxBytes * 5) {
+    throw invalid("ZIP uncompressed content exceeds safety threshold")
+  }
+
+  const now = new Date().toISOString()
+  const next = {
+    ...common,
+    source_type: "zip",
+    manifest,
+    archive_base64: buffer.toString("base64"),
+    checksum: hashBuffer(buffer),
+    size_bytes: buffer.length,
+    updated_at: now,
+  }
+  const storage = getStorage()
+  await storage.set(pluginKey(common.name), next)
+  await bumpVersion()
+  return toPublicPlugin(next)
+}
+
+async function setPluginEnabled(name, enabled) {
+  const storage = getStorage()
+  const key = pluginKey(name)
+  const current = await storage.get(key)
+  if (!current) {
+    throw Object.assign(new Error(`Server plugin '${name}' not found`), {
+      code: 92,
+      type: "resource_not_found",
+      recoverable: false,
+    })
+  }
+  current.enabled = enabled === true
+  current.updated_at = new Date().toISOString()
+  await storage.set(key, current)
+  await bumpVersion()
+  return toPublicPlugin(current)
+}
+
+async function updatePluginMetadata(name, patch = {}) {
+  const storage = getStorage()
+  const key = pluginKey(name)
+  const current = await storage.get(key)
+  if (!current) {
+    throw Object.assign(new Error(`Server plugin '${name}' not found`), {
+      code: 92,
+      type: "resource_not_found",
+      recoverable: false,
+    })
+  }
+  if (patch.enabled !== undefined) current.enabled = patch.enabled === true
+  if (patch.hooks_policy !== undefined) {
+    current.hooks_policy = sanitizeHooksPolicy(patch.hooks_policy, current.hooks_policy || "inherit")
+  }
+  current.updated_at = new Date().toISOString()
+  await storage.set(key, current)
+  await bumpVersion()
+  return toPublicPlugin(current)
+}
+
+async function removeServerPlugin(name) {
+  const storage = getStorage()
+  const key = pluginKey(name)
+  const current = await storage.get(key)
+  if (!current) return false
+  await storage.delete(key)
+  await bumpVersion()
+  return true
+}
+
+async function getPluginArchiveBuffer(name) {
+  const storage = getStorage()
+  const current = await storage.get(pluginKey(name))
+  if (!current || current.source_type !== "zip" || !current.archive_base64) return null
+  return Buffer.from(current.archive_base64, "base64")
+}
+
+module.exports = {
+  getSettings,
+  updateSettings,
+  listServerPlugins,
+  getServerPlugin,
+  upsertJsonPlugin,
+  upsertZipPlugin,
+  setPluginEnabled,
+  updatePluginMetadata,
+  removeServerPlugin,
+  getPluginArchiveBuffer,
+}

package/server/views/command-edit.ejs

@@ -4,6 +4,14 @@
   <h1 class="text-2xl font-bold mb-6"><%= command ? "Edit Command" : "New Command" %></h1>
 
   <div id="cmd-editor">
+    <div v-if="message.text" :class="['alert mb-4', message.type === 'error' ? 'alert-error' : 'alert-success']">
+      <span>{{ message.text }}</span>
+    </div>
+
+    <div class="alert alert-info mb-4">
+      <span>Tip: run <code>SUPERCLI_SERVER=http://localhost:3001 sc sync</code> after saving to refresh your local CLI cache.</span>
+    </div>
+
     <form @submit.prevent="save" class="flex flex-col gap-4">
 
       <div class="grid grid-cols-3 gap-4">
@@ -28,18 +36,36 @@
 
       <div class="form-control">
         <label class="label"><span class="label-text">Adapter</span></label>
-        <select v-model="form.adapter" class="select select-bordered select-sm">
+        <select v-model="form.adapter" @change="onAdapterChange" class="select select-bordered select-sm">
           <option value="http">http</option>
           <option value="openapi">openapi</option>
           <option value="mcp">mcp</option>
           <option value="shell">shell</option>
+          <option value="process">process</option>
+          <option value="builtin">builtin</option>
           <option value="custom">custom</option>
         </select>
       </div>
 
+      <div class="rounded border border-base-300 p-3 bg-base-100">
+        <div class="text-sm font-semibold">Adapter Guide</div>
+        <div class="text-xs opacity-80 mt-1">{{ adapterGuide.help }}</div>
+        <div class="text-xs mt-2">
+          <span class="font-semibold">Required:</span>
+          <span>{{ adapterGuide.required }}</span>
+        </div>
+      </div>
+
       <div class="form-control">
         <label class="label"><span class="label-text">Adapter Config (JSON)</span></label>
-        <textarea v-model="adapterConfigStr" class="textarea textarea-bordered textarea-sm font-mono" rows="4" placeholder='{"method":"GET","url":"https://..."}'></textarea>
+        <textarea v-model="adapterConfigStr" class="textarea textarea-bordered textarea-sm font-mono" rows="7" placeholder='{"method":"GET","url":"https://..."}'></textarea>
+        <div class="flex gap-2 mt-2">
+          <button type="button" @click="loadTemplate(true)" class="btn btn-xs btn-outline">Load Template</button>
+          <button type="button" @click="validateConfig" class="btn btn-xs btn-outline btn-primary">Validate Config</button>
+        </div>
+        <div v-if="validationResult" class="text-xs mt-2" :class="validationResult.ok ? 'text-success' : 'text-error'">
+          {{ validationResult.message }}
+        </div>
       </div>
 
       <!-- Arguments -->
@@ -72,6 +98,69 @@
 
 <script>
   const editData = <%- JSON.stringify(command) %>;
+  const ADAPTER_GUIDES = {
+    http: {
+      required: "adapterConfig.url",
+      help: "Use for REST endpoints. Optional method defaults to GET.",
+      template: {
+        method: "GET",
+        url: "https://api.example.com/health",
+        parseJson: true,
+        timeout_ms: 5000
+      }
+    },
+    openapi: {
+      required: "adapterConfig.spec, adapterConfig.operationId",
+      help: "Use OpenAPI operation ID from an indexed spec.",
+      template: {
+        spec: "petstore",
+        operationId: "listPets",
+        parseJson: true,
+        timeout_ms: 5000
+      }
+    },
+    mcp: {
+      required: "adapterConfig.tool and one of adapterConfig.server/url/command",
+      help: "Invoke MCP tools from a registered server or direct endpoint.",
+      template: {
+        server: "browser-use",
+        tool: "list_skills",
+        timeout_ms: 60000
+      }
+    },
+    shell: {
+      required: "adapterConfig.unsafe=true and adapterConfig.script",
+      help: "Runs a shell script via bash -lc. Keep scripts short and deterministic.",
+      template: {
+        unsafe: true,
+        script: "ls -lrt",
+        parseJson: false,
+        timeout_ms: 5000
+      }
+    },
+    process: {
+      required: "adapterConfig.command",
+      help: "Runs a binary directly with base args plus dynamic flags.",
+      template: {
+        command: "ls",
+        baseArgs: ["-lrt"],
+        parseJson: false,
+        timeout_ms: 5000
+      }
+    },
+    builtin: {
+      required: "adapterConfig.builtin",
+      help: "Runs internal built-in behavior.",
+      template: {
+        builtin: "noop"
+      }
+    },
+    custom: {
+      required: "Depends on your custom adapter",
+      help: "Use when loading adapters/<name>.js from the CLI workspace.",
+      template: {}
+    }
+  };
 
   Vue.createApp({
     data() {
@@ -85,23 +174,116 @@
           adapter: editData ? editData.adapter : 'http',
           args: editData && editData.args ? editData.args : []
         },
-        adapterConfigStr: editData && editData.adapterConfig ? JSON.stringify(editData.adapterConfig, null, 2) : '{}'
+        adapterConfigStr: editData && editData.adapterConfig ? JSON.stringify(editData.adapterConfig, null, 2) : '{}',
+        message: { type: '', text: '' },
+        validationResult: null,
+      }
+    },
+    computed: {
+      adapterGuide() {
+        return ADAPTER_GUIDES[this.form.adapter] || ADAPTER_GUIDES.http
+      }
+    },
+    mounted() {
+      if (!this.editId && this.adapterConfigStr.trim() === '{}') {
+        this.loadTemplate(false)
       }
     },
     methods: {
-      async save() {
-        const body = {
+      setMessage(type, text) {
+        this.message = { type, text }
+      },
+      clearMessage() {
+        this.message = { type: '', text: '' }
+      },
+      onAdapterChange() {
+        this.validationResult = null
+      },
+      loadTemplate(force) {
+        const current = this.adapterConfigStr.trim()
+        if (!force && current && current !== '{}') return
+        this.adapterConfigStr = JSON.stringify(this.adapterGuide.template, null, 2)
+        this.validationResult = null
+      },
+      parseAdapterConfig() {
+        try {
+          return JSON.parse(this.adapterConfigStr || '{}')
+        } catch (err) {
+          throw new Error('Adapter Config is not valid JSON: ' + err.message)
+        }
+      },
+      buildPayload() {
+        const adapterConfig = this.parseAdapterConfig()
+        return {
           ...this.form,
-          adapterConfig: JSON.parse(this.adapterConfigStr || '{}')
+          adapterConfig,
+        }
+      },
+      validateLocally(payload) {
+        if (!payload.namespace || !payload.resource || !payload.action) {
+          throw new Error('Namespace, Resource, and Action are required')
+        }
+        if (payload.adapter === 'shell') {
+          if (payload.adapterConfig.unsafe !== true) {
+            throw new Error('Shell adapter requires adapterConfig.unsafe=true')
+          }
+          if (!payload.adapterConfig.script || typeof payload.adapterConfig.script !== 'string') {
+            throw new Error('Shell adapter requires adapterConfig.script')
+          }
+        }
+      },
+      async parseErrorMessage(response) {
+        let msg = 'Request failed'
+        try {
+          const body = await response.json()
+          if (body && body.error) msg = body.error
+        } catch {
+          msg = response.status + ' ' + response.statusText
+        }
+        return msg
+      },
+      async validateConfig() {
+        this.clearMessage()
+        this.validationResult = null
+        try {
+          const payload = this.buildPayload()
+          this.validateLocally(payload)
+          const response = await fetch('/api/commands/validate', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload)
+          })
+          if (!response.ok) {
+            const msg = await this.parseErrorMessage(response)
+            this.validationResult = { ok: false, message: msg }
+            return
+          }
+          this.validationResult = { ok: true, message: 'Adapter config is valid' }
+        } catch (err) {
+          this.validationResult = { ok: false, message: err.message }
+        }
+      },
+      async save() {
+        this.clearMessage()
+        try {
+          const body = this.buildPayload()
+          this.validateLocally(body)
+          const url = this.editId ? '/api/commands/' + this.editId : '/api/commands'
+          const method = this.editId ? 'PUT' : 'POST'
+          const response = await fetch(url, {
+            method,
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body)
+          })
+          if (!response.ok) {
+            const msg = await this.parseErrorMessage(response)
+            this.setMessage('error', msg)
+            return
+          }
+          window.location.href = '/api/commands'
+        } catch (err) {
+          this.setMessage('error', err.message)
         }
-        const url = this.editId ? '/api/commands/' + this.editId : '/api/commands'
-        const method = this.editId ? 'PUT' : 'POST'
-        await fetch(url, {
-          method,
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify(body)
-        })
-        window.location.href = '/api/commands'
       }
     }
   }).mount('#cmd-editor')

package/server/views/partials/head.ejs

@@ -21,6 +21,7 @@
       <a href="/api/commands" class="btn btn-ghost justify-start" id="nav-commands">📋 Commands</a>
       <a href="/api/specs" class="btn btn-ghost justify-start" id="nav-specs">📄 OpenAPI Specs</a>
       <a href="/api/mcp" class="btn btn-ghost justify-start" id="nav-mcp">🔌 MCP Servers</a>
+      <a href="/api/plugins" class="btn btn-ghost justify-start" id="nav-plugins">🧩 Server Plugins</a>
       <a href="/api/jobs" class="btn btn-ghost justify-start" id="nav-jobs">📊 Jobs</a>
     </aside>
     <!-- Main content -->