ysagc-agent 0.1.0

package/src/index.js

@@ -0,0 +1,378 @@
+#!/usr/bin/env node
+/**
+ * ysagc-agent 入口
+ * - WS 服务仅绑定 127.0.0.1（浏览器可信源）
+ * - 端口占用自动 +1（最多 5 次）
+ * - 控制通道 JSON-RPC 2.0；终端二进制分帧
+ * - 鉴权握手 3s 超时；心跳 15s、3 次无响应断开
+ * - 同设备最多 2 个控制连接（T-M0-15）
+ * 用法：npx ysagc-agent [--init-token <token>] [--port N]
+ */
+'use strict';
+
+const http = require('http');
+const crypto = require('crypto');
+const url = require('url');
+const { WebSocketServer } = require('ws');
+const path = require('path');
+const fs = require('fs');
+
+const { loadConfig, saveConfig, CONFIG_DIR } = require('./config');
+const logger = require('./logger');
+const { register, handleRequest } = require('./rpc');
+const { registerSystemMethods } = require('./methods/system');
+const { createTerminalMethods } = require('./methods/terminal');
+const { createProjectMethods } = require('./methods/project');
+const { createFsMethods } = require('./methods/fs');
+const { createSkillMethods } = require('./methods/skill');
+const { createGitMethods } = require('./methods/git');
+const { createScaffoldMethods } = require('./methods/scaffold');
+const { createHttpFsHandlers } = require('./http-fs');
+const { Sandbox } = require('./sandbox');
+const { startPairing, stopPairing } = require('./pairing');
+
+const DEFAULT_PORT = 37890;
+const MAX_PORT_TRIES = 5;
+const AUTH_TIMEOUT_MS = 3000;
+const HEARTBEAT_INTERVAL_MS = 15000;
+const HEARTBEAT_MISS_LIMIT = 3;
+const MAX_CONNS_PER_DEVICE = 2;
+const RPC_RATE_LIMIT = 60; // RPC ≤ 60/min/设备（5.20.3）
+const RPC_RATE_WINDOW = 60000;
+
+// ---------------- CLI ----------------
+const argv = process.argv.slice(2);
+function getArg(name) {
+  const i = argv.indexOf(name);
+  return i >= 0 ? argv[i + 1] : null;
+}
+
+// ---------------- 配置 ----------------
+let config = loadConfig();
+logger.setLevel(config.logLevel);
+
+const initToken = getArg('--init-token');
+if (initToken) {
+  const hash = crypto.createHash('sha256').update(String(initToken)).digest('hex');
+  if (!config.deviceTokenWhitelist.includes(hash)) {
+    config = saveConfig({ deviceTokenWhitelist: [...config.deviceTokenWhitelist, hash] });
+    logger.info(`[init-token] 已加入设备令牌白名单（sha256: ${hash.slice(0, 16)}...）`);
+  }
+}
+if (getArg('--port')) {
+  config = saveConfig({ port: Number(getArg('--port')) || DEFAULT_PORT });
+}
+const configRef = { config }; // 供方法层读取最新配置
+const sandbox = new Sandbox(config.allowedRoots || []);
+configRef.sandbox = sandbox;
+
+// ---------------- RPC 注册 ----------------
+registerSystemMethods(register, () => configRef);
+const terminal = createTerminalMethods(() => configRef);
+terminal.register(register);
+const projectMethods = createProjectMethods(() => configRef);
+projectMethods.register(register);
+const fsMethods = createFsMethods(() => configRef);
+fsMethods.register(register);
+const skillMethods = createSkillMethods(() => configRef);
+skillMethods.register(register);
+const gitMethods = createGitMethods(() => configRef);
+gitMethods.register(register);
+const scaffoldMethods = createScaffoldMethods(() => configRef);
+scaffoldMethods.register(register);
+
+// ---------------- WS 服务 ----------------
+const state = {
+  /** deviceId -> Set<ws> 控制连接 */
+  deviceConns: new Map(),
+};
+
+function sha256(s) {
+  return crypto.createHash('sha256').update(String(s)).digest('hex');
+}
+
+function checkAuthToken(token) {
+  if (!token || typeof token !== 'string') return false;
+  return configRef.config.deviceTokenWhitelist.includes(sha256(token));
+}
+
+/**
+ * 客户端 → Agent 的二进制帧解析（终端输入）：
+ * 4 字节大端头长 + JSON 头 {channel:'terminal', sessionId, type} + payload
+ */
+function parseBinaryFrame(buffer) {
+  if (buffer.length < 5) return null;
+  const headerLen = buffer.readUInt32BE(0);
+  if (buffer.length < 4 + headerLen) return null;
+  let header;
+  try {
+    header = JSON.parse(buffer.slice(4, 4 + headerLen).toString('utf8'));
+  } catch {
+    return null;
+  }
+  return { header, payload: buffer.slice(4 + headerLen) };
+}
+
+function buildBinaryFrame(header, payload) {
+  const h = Buffer.from(JSON.stringify(header), 'utf8');
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(h.length, 0);
+  return Buffer.concat([len, h, payload]);
+}
+
+function sendJson(ws, obj) {
+  if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(obj));
+}
+
+function closeWith(ws, code, reason) {
+  try {
+    ws.close(code, reason);
+  } catch {
+    ws.terminate();
+  }
+}
+
+function setupConnection(ws, req) {
+  ws.isAlive = true;
+  ws.authed = false;
+  ws.deviceId = null;
+  ws.authTimer = setTimeout(() => {
+    if (!ws.authed) closeWith(ws, 4401, 'auth timeout');
+  }, AUTH_TIMEOUT_MS);
+
+  ws.on('pong', () => {
+    ws.isAlive = true;
+    ws.missed = 0;
+  });
+  ws.missed = 0;
+
+  ws.on('message', async (data, isBinary) => {
+    if (isBinary) {
+      const frame = parseBinaryFrame(data);
+      if (!frame || !ws.authed) return;
+      if (frame.header && frame.header.channel === 'terminal' && frame.header.sessionId) {
+        // 终端输入 → 对应 pty 会话
+        const s = terminal.sessions.get(frame.header.sessionId);
+        if (s && frame.payload.length > 0) s.pty.write(frame.payload.toString('utf8'));
+      }
+      return;
+    }
+    let msg;
+    try {
+      msg = JSON.parse(data.toString('utf8'));
+    } catch {
+      return;
+    }
+
+    // ---- 鉴权握手 ----
+    if (msg && msg.type === 'auth') {
+      if (ws.authed) return;
+      const ok = checkAuthToken(msg.token);
+      if (!ok) {
+        logger.warn(`[ws] 鉴权失败：token 不在白名单（remote=${req.socket.remoteAddress}）`);
+        closeWith(ws, 4401, 'unauthorized');
+        return;
+      }
+      ws.authed = true;
+      ws.deviceId = msg.deviceId || 'dev-default';
+      if (ws.authTimer) clearTimeout(ws.authTimer);
+      // ---- 多连接限制（T-M0-15）----
+      let set = state.deviceConns.get(ws.deviceId);
+      if (!set) {
+        set = new Set();
+        state.deviceConns.set(ws.deviceId, set);
+      }
+      const existing = [...set].filter((c) => c !== ws && c.readyState === c.OPEN);
+      if (existing.length >= MAX_CONNS_PER_DEVICE) {
+        sendJson(ws, { jsonrpc: '2.0', method: 'event.connection.limit', params: { max: MAX_CONNS_PER_DEVICE, code: 'E_CONNECTION_LIMIT' } });
+        closeWith(ws, 4403, 'connection limit');
+        return;
+      }
+      set.add(ws);
+      if (existing.length > 0) {
+        // 旧连接收到提示
+        sendJson(existing[0], { jsonrpc: '2.0', method: 'event.connection.duplicated', params: { hint: '已在其他窗口打开' } });
+      }
+      sendJson(ws, {
+        jsonrpc: '2.0',
+        method: 'event.auth.ok',
+        params: {
+          agentVersion: require('../package.json').version,
+          protocolVersion: 1,
+          port: configRef.config.port,
+          platform: `${process.platform} ${process.arch}`,
+        },
+      });
+      logger.info(`[ws] 设备 ${ws.deviceId} 已连接（当前 ${existing.length + 1} 连接）`);
+      return;
+    }
+
+    if (!ws.authed) {
+      // 未鉴权连接仅放行配对握手（新设备尚无 deviceToken，用配对码换取令牌）
+      if (msg && msg.jsonrpc === '2.0' && msg.method === 'pairing.handshake') {
+        const resp = await handleRequest(msg, {
+          socket: req.socket,
+          ws,
+          deviceId: null,
+          send: (obj) => sendJson(ws, obj),
+          sendBinary: null,
+        });
+        if (resp) sendJson(ws, resp);
+      }
+      return;
+    }
+    // ---- JSON-RPC（5.20.3 频率限制：RPC ≤60/min/设备）----
+    if (msg && msg.jsonrpc === '2.0' && msg.method) {
+      const now = Date.now();
+      if (!ws.rpcWindow) {
+        ws.rpcWindow = now;
+        ws.rpcCount = 0;
+      }
+      if (now - ws.rpcWindow > RPC_RATE_WINDOW) {
+        ws.rpcWindow = now;
+        ws.rpcCount = 0;
+      }
+      ws.rpcCount++;
+      if (ws.rpcCount > RPC_RATE_LIMIT) {
+        logger.warn(`[ws] RPC 频率超限（${ws.rpcCount}/${RPC_RATE_LIMIT} per min），拒绝: ${msg.method}`);
+        sendJson(ws, {
+          jsonrpc: '2.0',
+          id: msg.id ?? null,
+          error: { code: -32603, message: '请求过于频繁，请稍后再试', data: { code: 'E_RATE_LIMIT' } },
+        });
+        return;
+      }
+      const resp = await handleRequest(msg, {
+        socket: req.socket,
+        ws,
+        deviceId: ws.deviceId,
+        send: (obj) => sendJson(ws, obj),
+        sendBinary: (buf, opts) => {
+          if (ws.readyState === ws.OPEN) ws.send(buf, { binary: true });
+        },
+      });
+      if (resp) sendJson(ws, resp);
+    }
+  });
+
+  ws.on('close', () => {
+    if (ws.authTimer) clearTimeout(ws.authTimer);
+    if (ws.deviceId) {
+      const set = state.deviceConns.get(ws.deviceId);
+      if (set) {
+        set.delete(ws);
+        if (set.size === 0) state.deviceConns.delete(ws.deviceId);
+      }
+      logger.info(`[ws] 设备 ${ws.deviceId} 连接断开（剩余 ${set ? set.size : 0} 连接）`);
+    }
+  });
+
+  ws.on('error', () => {
+    /* 连接错误由 close 统一处理 */
+  });
+}
+
+function tryListen(port, triesLeft) {
+  const httpFs = createHttpFsHandlers(() => configRef);
+  const server = http.createServer((req, res) => {
+    // 本地 HTTP：上传/下载/zip（T-M1-05）
+    const parsed = url.parse(req.url, true);
+    const p = parsed.pathname || '';
+    try {
+      if (req.method === 'POST' && p === '/api/fs/upload') return httpFs.handleUpload(req, res, parsed.query);
+      if (req.method === 'GET' && p === '/api/fs/download') return httpFs.handleDownload(req, res, parsed.query);
+      if (req.method === 'GET' && p === '/api/fs/zip') return httpFs.handleZip(req, res, parsed.query);
+    } catch (e) {
+      logger.error(`[http] 处理 ${p} 失败: ${e && e.message}`);
+      res.writeHead(500, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ code: 'E_INTERNAL', msg: e && e.message }));
+      return;
+    }
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: 'not found' }));
+  });
+
+  const wss = new WebSocketServer({ server, maxPayload: 1024 * 1024 });
+  wss.on('connection', setupConnection);
+  // 广播通道（fs 监听等事件推送到所有已鉴权连接）
+  configRef.broadcast = (obj) => {
+    for (const c of wss.clients) {
+      if (c.authed && c.readyState === c.OPEN) sendJson(c, obj);
+    }
+  };
+
+  server.on('error', (err) => {
+    if (err.code === 'EADDRINUSE' && triesLeft > 0) {
+      logger.warn(`[ws] 端口 ${port} 被占用，尝试 ${port + 1}`);
+      tryListen(port + 1, triesLeft - 1);
+    } else {
+      logger.error(`[ws] 启动失败: ${err.message}`);
+      process.exit(1);
+    }
+  });
+
+  server.listen(port, '127.0.0.1', () => {
+    configRef.config = saveConfig({ port });
+    logger.info(`[ws] Agent 已启动 ws://127.0.0.1:${port}`);
+    console.log(`ysagc-agent 运行中: ws://127.0.0.1:${port}`);
+    // ---- 心跳 ----
+    const heartbeat = setInterval(() => {
+      for (const ws of wss.clients) {
+        if (ws.isAlive === false) {
+          ws.terminate();
+          continue;
+        }
+        ws.isAlive = false;
+        ws.missed = (ws.missed || 0) + 1;
+        if (ws.missed > HEARTBEAT_MISS_LIMIT) {
+          ws.terminate();
+          continue;
+        }
+        try {
+          ws.ping();
+        } catch {
+          /* ignore */
+        }
+      }
+    }, HEARTBEAT_INTERVAL_MS);
+    heartbeat.unref();
+    // ---- 配对码 ----
+    startPairing(() => configRef.config);
+  });
+
+  return server;
+}
+
+console.log(`ysagc-agent v${require('../package.json').version} 启动中（配置目录: ${CONFIG_DIR}）`);
+tryListen(config.port, MAX_PORT_TRIES);
+
+process.on('SIGINT', () => {
+  stopPairing();
+  logger.info('[agent] 收到 SIGINT，退出');
+  process.exit(0);
+});
+process.on('SIGTERM', () => {
+  stopPairing();
+  logger.info('[agent] 收到 SIGTERM，退出');
+  process.exit(0);
+});
+
+// Agent 守护进程韧性：单个会话/pty 的异步错误不得打崩整个 Agent。
+// 快速连续崩溃（如 10 秒内 5 次）视为致命，退出。
+let crashCount = 0;
+let crashWindowStart = 0;
+function guardCrash(level, err) {
+  const now = Date.now();
+  if (now - crashWindowStart > 10000) {
+    crashWindowStart = now;
+    crashCount = 0;
+  }
+  crashCount++;
+  logger.error(`[guard:${level}]`, err);
+  if (crashCount >= 5) {
+    logger.error('[guard] 短时间多次致命异常，Agent 退出');
+    process.exit(1);
+  }
+}
+process.on('uncaughtException', (err) => guardCrash('uncaughtException', err));
+process.on('unhandledRejection', (reason) => guardCrash('unhandledRejection', reason));

package/src/logger.js

@@ -0,0 +1,84 @@
+/**
+ * 滚动日志：~/.ysagc-agent/logs/agent.log（按日滚动，保留 7 份）
+ * 红线：永不记录密钥文件内容、Git 凭证、密码类数据
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { CONFIG_DIR } = require('./config');
+
+const LOG_DIR = path.join(CONFIG_DIR, 'logs');
+const LOG_FILE = path.join(LOG_DIR, 'agent.log');
+const MAX_KEEP = 7;
+const MAX_SIZE = 5 * 1024 * 1024; // 5MB 滚动
+
+let levelRank = { debug: 10, info: 20, warn: 30, error: 40 };
+let currentLevel = 'info';
+
+function ensureLogDir() {
+  try {
+    fs.mkdirSync(LOG_DIR, { recursive: true });
+  } catch {
+    /* 日志目录创建失败时降级为 console */
+  }
+}
+
+function rotateIfNeeded() {
+  try {
+    if (!fs.existsSync(LOG_FILE)) return;
+    const stat = fs.statSync(LOG_FILE);
+    if (stat.size < MAX_SIZE) return;
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    fs.renameSync(LOG_FILE, path.join(LOG_DIR, `agent.log.${stamp}`));
+    // 清理旧日志，保留最近 MAX_KEEP 份
+    const backups = fs
+      .readdirSync(LOG_DIR)
+      .filter((f) => f.startsWith('agent.log.') && f !== LOG_FILE)
+      .map((f) => ({ f, t: fs.statSync(path.join(LOG_DIR, f)).mtimeMs }))
+      .sort((a, b) => b.t - a.t);
+    for (const b of backups.slice(MAX_KEEP)) {
+      try {
+        fs.unlinkSync(path.join(LOG_DIR, b.f));
+      } catch {
+        /* ignore */
+      }
+    }
+  } catch {
+    /* ignore */
+  }
+}
+
+function sanitize(msg) {
+  // 脱敏：常见的密钥/凭证形态（预防性兜底，正常流程不应写入）
+  return String(msg).replace(
+    /(sk-[A-Za-z0-9_\-]{8,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[bap]-[A-Za-z0-9\-]{10,}|password\s*[:=]\s*\S+)/gi,
+    '[REDACTED]'
+  );
+}
+
+function write(level, args) {
+  if (levelRank[level] < levelRank[currentLevel]) return;
+  ensureLogDir();
+  rotateIfNeeded();
+  const line = `[${new Date().toISOString()}] [${level.toUpperCase()}] ${args
+    .map((a) => (a instanceof Error ? a.stack || a.message : typeof a === 'object' ? JSON.stringify(a) : String(a)))
+    .join(' ')}`;
+  try {
+    fs.appendFileSync(LOG_FILE, sanitize(line) + '\n');
+  } catch {
+    /* ignore */
+  }
+}
+
+const logger = {
+  setLevel(level) {
+    if (levelRank[level]) currentLevel = level;
+  },
+  debug: (...a) => write('debug', a),
+  info: (...a) => write('info', a),
+  warn: (...a) => write('warn', a),
+  error: (...a) => write('error', a),
+};
+
+module.exports = logger;