ysagc-agent 0.1.0

package/src/methods/git.js

@@ -0,0 +1,391 @@
+/**
+ * git.* RPC 方法（T-M2-01..09）
+ * - git.check / git.init / git.status / git.diff
+ * - git.stage / git.unstage / git.commit / git.push / git.pull / git.fetch
+ * - git.branches / git.createBranch / git.checkout / git.deleteBranch / git.merge / git.mergeAbort
+ * - 安全：spawn 参数数组（绝不拼字符串命令）、GIT_TERMINAL_PROMPT=0 防凭证挂起、
+ *   单设备单 git 写操作（E_GIT_BUSY）、输出截断 200KB、敏感字段（URL 凭证）脱敏
+ * - 凭证：不落后端、不落盘（系统钥匙串/credential manager/ssh-agent 由 git 自身处理）
+ */
+'use strict';
+
+const path = require('path');
+const { execFile } = require('child_process');
+const { RpcError } = require('../rpc');
+const logger = require('../logger');
+
+const GIT_TIMEOUT = 120000;
+const MAX_OUTPUT = 200 * 1024;
+const GIT_ENV = { ...process.env, GIT_TERMINAL_PROMPT: '0', GIT_ASKPASS: 'echo' };
+
+/** 运行 git 命令（参数数组；cwd 必须在已授权项目内） */
+function runGit(args, opts = {}) {
+  return new Promise((resolve, reject) => {
+    execFile(
+      'git',
+      args,
+      {
+        cwd: opts.cwd,
+        timeout: opts.timeout || GIT_TIMEOUT,
+        maxBuffer: MAX_OUTPUT,
+        windowsHide: true,
+        env: GIT_ENV,
+        encoding: 'utf8',
+      },
+      (err, stdout, stderr) => {
+        const out = String(stdout || '');
+        const errOut = String(stderr || '');
+        if (err) {
+          const code = (err.code || '').toString();
+          // 凭证/认证类错误 → 引导
+          if (/authentication|could not read|credential|fatal: unable to access/i.test(errOut)) {
+            return reject(new RpcError('E_GIT_AUTH', `Git 认证失败（凭证）：${errOut.trim().split('\n').pop()}`));
+          }
+          if (/not a git repository/i.test(errOut)) {
+            return reject(new RpcError('E_GIT_NOT_REPO', '不是 Git 仓库，请先 git init'));
+          }
+          if (/conflict/i.test(errOut)) {
+            return reject(new RpcError('E_GIT_CONFLICT', `存在冲突：${errOut.trim().split('\n').pop()}`));
+          }
+          return reject(new RpcError('E_GIT_FAILED', `${errOut.trim().split('\n').pop() || err.message}`));
+        }
+        resolve({ stdout: out, stderr: errOut });
+      }
+    );
+  });
+}
+
+/** 解析 porcelain v2 状态 */
+function parseStatusV2(text) {
+  const branch = { current: '', upstream: '', ahead: 0, behind: 0 };
+  const changes = { staged: [], unstaged: [], untracked: [], conflicts: [] };
+  for (const line of String(text).split(/\r?\n/)) {
+    if (!line) continue;
+    const parts = line.split(' ');
+    const h = parts[0];
+    if (h === '#') {
+      if (parts[1] === 'branch.head') branch.current = parts[2] === '(detached)' ? '(detached)' : parts[2];
+      else if (parts[1] === 'branch.upstream') branch.upstream = parts[2];
+      else if (parts[1] === 'branch.ab') {
+        branch.ahead = Number(parts[2].replace('+', ''));
+        branch.behind = Number(parts[3].replace('-', ''));
+      }
+      continue;
+    }
+    if (h === '1' || h === '2') {
+      const xy = parts[1];
+      const path2 = h === '2' ? parts[8] : parts[7];
+      const entry = { path: path2, xy };
+      if (xy[0] !== '.' && xy[0] !== '?') changes.staged.push(entry);
+      if (xy[1] !== '.') changes.unstaged.push(entry);
+      if (xy === 'UU' || xy[0] === 'u' || xy[1] === 'u') changes.conflicts.push(entry);
+    } else if (h === 'u') {
+      // 冲突条目：u <xy> <sub> <m1> <m2> <m3> <mW> <hH> <hI> <path>
+      changes.conflicts.push({ path: parts[parts.length - 1], xy: 'UU' });
+    } else if (h === '?') {
+      changes.untracked.push({ path: parts[1], xy: '??' });
+    }
+  }
+  // 去重（staged+unstaged 可能同文件）
+  changes.conflicts = changes.conflicts.filter((c, i, arr) => arr.findIndex((x) => x.path === c.path) === i);
+  return { branch, changes };
+}
+
+/** 解析 numstat（增删行） */
+function parseNumstat(text, staged = false) {
+  const map = {};
+  for (const line of String(text).split(/\r?\n/)) {
+    if (!line) continue;
+    const m = line.match(/^(\d+|-)\t(\d+|-)\t(.+)$/);
+    if (m) map[m[3]] = { added: m[1] === '-' ? 0 : Number(m[1]), deleted: m[2] === '-' ? 0 : Number(m[2]), staged };
+  }
+  return map;
+}
+
+function createGitMethods(ctxRef) {
+  const sandbox = () => ctxRef().sandbox;
+  /** 单设备单 git 写操作锁（T-M2-09） */
+  let writeLock = null;
+
+  async function withWriteLock(fn) {
+    if (writeLock) throw new RpcError('E_GIT_BUSY', '已有 Git 写操作进行中，请稍后再试');
+    writeLock = true;
+    try {
+      return await fn();
+    } finally {
+      writeLock = false;
+    }
+  }
+
+  function resolveRepo(params) {
+    const r = sandbox().resolve(params.path || '', params.base);
+    if (!r.rel || r.rel === '.' || r.rel === '') {
+      return r.abs; // 项目根
+    }
+    return r.abs;
+  }
+
+  /** 敏感字段脱敏：URL 中的 user:pass@ → ***@ */
+  function sanitize(text) {
+    return String(text).replace(/(https?:\/\/)[^/@\s]+@/g, '$1***@');
+  }
+
+  function register(reg) {
+    // ---- 检查：git 是否安装 + 是否仓库（T-M2-01）----
+    reg('git.check', async (params = {}) => {
+      const abs = resolveRepo(params);
+      let version = '';
+      let installed = true;
+      try {
+        const r = await runGit(['--version'], { cwd: abs, timeout: 15000 });
+        const m = r.stdout.match(/git version\s+([^\s]+)/i);
+        version = m ? m[1] : r.stdout.trim();
+      } catch {
+        installed = false;
+      }
+      let isRepo = false;
+      if (installed) {
+        try {
+          await runGit(['rev-parse', '--is-inside-work-tree'], { cwd: abs, timeout: 15000 });
+          isRepo = true;
+        } catch {
+          isRepo = false;
+        }
+      }
+      return { installed, version, isRepo, path: abs };
+    });
+
+    // ---- git init（T-M2-01 按钮）----
+    reg('git.init', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        try {
+          await runGit(['init'], { cwd: abs, timeout: 30000 });
+        } catch (e) {
+          throw new RpcError('E_GIT_FAILED', `git init 失败: ${e.message}`);
+        }
+        return { ok: true };
+      });
+    });
+
+    // ---- 状态（T-M2-02）----
+    reg('git.status', async (params = {}) => {
+      const abs = resolveRepo(params);
+      try {
+        const [st, num, numC] = await Promise.all([
+          runGit(['status', '--porcelain=v2', '-b', '--untracked-files=normal'], { cwd: abs }),
+          runGit(['diff', '--numstat'], { cwd: abs }).catch(() => ({ stdout: '' })),
+          runGit(['diff', '--cached', '--numstat'], { cwd: abs }).catch(() => ({ stdout: '' })),
+        ]);
+        const parsed = parseStatusV2(st.stdout);
+        const numstat = { ...parseNumstat(num.stdout), ...parseNumstat(numC.stdout, true) };
+        const mergeInProgress = /^\s*Merge conflict|unmerged/i.test(st.stdout);
+        return {
+          branch: parsed.branch,
+          changes: parsed.changes,
+          numstat,
+          mergeInProgress,
+          isRepo: true,
+        };
+      } catch (e) {
+        if (e && e.code === 'E_GIT_NOT_REPO') return { isRepo: false };
+        throw e;
+      }
+    });
+
+    // ---- diff（T-M2-03）----
+    reg('git.diff', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const args = ['diff'];
+      if (params.staged) args.push('--cached');
+      if (params.file) {
+        args.push('--', String(params.file));
+      } else if (params.files && Array.isArray(params.files) && params.files.length > 0) {
+        args.push('--', ...params.files.map(String));
+      }
+      const r = await runGit(args, { cwd: abs });
+      return { diff: r.stdout };
+    });
+
+    // ---- 暂存/取消暂存（T-M2-04）----
+    reg('git.stage', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        const args = ['add'];
+        if (params.all) args.push('-A');
+        else if (params.files && Array.isArray(params.files) && params.files.length > 0) args.push('--', ...params.files.map(String));
+        else if (params.file) args.push('--', String(params.file));
+        else throw new RpcError('E_VALIDATION', '缺少文件或 all');
+        await runGit(args, { cwd: abs });
+        return { ok: true };
+      });
+    });
+
+    reg('git.unstage', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        const args = ['reset', 'HEAD'];
+        if (params.files && Array.isArray(params.files) && params.files.length > 0) args.push('--', ...params.files.map(String));
+        else if (params.file) args.push('--', String(params.file));
+        else throw new RpcError('E_VALIDATION', '缺少文件');
+        await runGit(args, { cwd: abs }).catch(() => { /* 空仓库 reset 可能失败，忽略 */ });
+        return { ok: true };
+      });
+    });
+
+    // ---- 提交（T-M2-04）----
+    reg('git.commit', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const message = String(params.message || '').trim();
+      if (!message) throw new RpcError('E_VALIDATION', '提交信息不能为空');
+      if (message.length > 500) throw new RpcError('E_VALIDATION', '提交信息过长（≤500 字符）');
+      return withWriteLock(async () => {
+        const r = await runGit(['commit', '-m', message], { cwd: abs });
+        return { ok: true, output: sanitize(r.stdout.trim()) };
+      });
+    });
+
+    // ---- 推送（T-M2-05，危险级：前端必确认）----
+    reg('git.push', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        const args = ['push'];
+        if (params.remote) args.push(String(params.remote));
+        if (params.branch) args.push(String(params.branch));
+        args.push('--porcelain');
+        const r = await runGit(args, { cwd: abs, timeout: 180000 });
+        return { ok: true, output: sanitize(r.stdout.trim() || r.stderr.trim()) };
+      });
+    });
+
+    // ---- 拉取/获取（T-M2-05）----
+    reg('git.pull', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        const args = ['pull'];
+        if (params.remote) args.push(String(params.remote));
+        if (params.branch) args.push(String(params.branch));
+        const r = await runGit(args, { cwd: abs, timeout: 180000 });
+        const out = sanitize(r.stdout.trim() || r.stderr.trim());
+        const hasConflict = /conflict|CONFLICT/i.test(r.stdout + r.stderr);
+        return { ok: true, output: out, conflict: hasConflict };
+      });
+    });
+
+    reg('git.fetch', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        const r = await runGit(['fetch', '--prune'], { cwd: abs, timeout: 180000 });
+        return { ok: true, output: sanitize(r.stdout.trim() || r.stderr.trim()) };
+      });
+    });
+
+    // ---- 分支（T-M2-06）----
+    reg('git.branches', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const [local, remote, status] = await Promise.all([
+        runGit(['branch', '--format=%(refname:short)'], { cwd: abs }),
+        runGit(['branch', '-r', '--format=%(refname:short)'], { cwd: abs }).catch(() => ({ stdout: '' })),
+        runGit(['status', '--porcelain=v2', '-b', '--untracked-files=no'], { cwd: abs }),
+      ]);
+      const current = parseStatusV2(status.stdout).branch.current;
+      return {
+        current,
+        local: local.stdout.split(/\r?\n/).filter(Boolean),
+        remote: remote.stdout.split(/\r?\n/).filter(Boolean),
+      };
+    });
+
+    reg('git.createBranch', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const name = String(params.name || '').trim();
+      if (!/^[^\s~^:?*[\\]+$/.test(name)) throw new RpcError('E_VALIDATION', '分支名包含非法字符');
+      return withWriteLock(async () => {
+        await runGit(['checkout', '-b', name], { cwd: abs });
+        return { ok: true, branch: name };
+      });
+    });
+
+    reg('git.checkout', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const branch = String(params.branch || '').trim();
+      if (!branch) throw new RpcError('E_VALIDATION', '缺少分支名');
+      return withWriteLock(async () => {
+        const args = ['checkout'];
+        if (params.force) args.push('-f');
+        args.push(branch);
+        const r = await runGit(args, { cwd: abs });
+        return { ok: true, output: r.stdout.trim() };
+      });
+    });
+
+    reg('git.deleteBranch', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const name = String(params.name || '').trim();
+      if (!name) throw new RpcError('E_VALIDATION', '缺少分支名');
+      return withWriteLock(async () => {
+        const args = ['branch', '-d'];
+        if (params.force) args.push('-D');
+        args.push(name);
+        const r = await runGit(args, { cwd: abs });
+        return { ok: true, output: r.stdout.trim() };
+      });
+    });
+
+    // ---- 合并（T-M2-06/07，危险级：前端必确认）----
+    reg('git.merge', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const branch = String(params.branch || '').trim();
+      if (!branch) throw new RpcError('E_VALIDATION', '缺少要合并的分支');
+      return withWriteLock(async () => {
+        const r = await runGit(['merge', branch], { cwd: abs, timeout: 120000 });
+        const out = sanitize(r.stdout.trim() || r.stderr.trim());
+        return { ok: true, output: out, conflict: /conflict|CONFLICT/i.test(r.stdout + r.stderr) };
+      });
+    });
+
+    reg('git.mergeAbort', async (params = {}) => {
+      const abs = resolveRepo(params);
+      return withWriteLock(async () => {
+        await runGit(['merge', '--abort'], { cwd: abs });
+        return { ok: true };
+      });
+    });
+
+    // ---- 最近提交（辅助展示）----
+    reg('git.log', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const n = Math.min(50, Math.max(1, Number(params.n) || 20));
+      const r = await runGit(['log', `-${n}`, '--pretty=format:%h|%an|%ad|%s', '--date=format:%Y-%m-%d %H:%M'], { cwd: abs });
+      const commits = r.stdout
+        .split(/\r?\n/)
+        .filter(Boolean)
+        .map((line) => {
+          const [hash, author, date, ...rest] = line.split('|');
+          return { hash, author, date, subject: rest.join('|') };
+        });
+      return { commits };
+    });
+
+    // ---- 凭证检测（T-M2-08：仅检测，不取回凭证）----
+    reg('git.credentialCheck', async (params = {}) => {
+      const abs = resolveRepo(params);
+      const remote = String(params.remote || '');
+      let url = remote;
+      if (!url) {
+        try {
+          const r = await runGit(['remote', 'get-url', 'origin'], { cwd: abs });
+          url = r.stdout.trim();
+        } catch {
+          url = '';
+        }
+      }
+      // 只返回脱敏后的远程地址与是否含凭证提示
+      return { remoteUrl: url ? sanitize(url) : '', hasRemote: !!url };
+    });
+  }
+
+  return { register };
+}
+
+module.exports = { createGitMethods };

package/src/methods/project.js

@@ -0,0 +1,57 @@
+/**
+ * project.* RPC：项目目录授权管理（allowlist 维护，T-M0-13）
+ * - project.addRoot {path}   网站添加项目时由前端调用（写入 agent.json allowedRoots）
+ * - project.removeRoot {path}
+ * - project.listRoots
+ * - project.validate {path}  校验路径是否在沙箱内（后端/前端预检用）
+ */
+'use strict';
+
+const { RpcError } = require('../rpc');
+
+function createProjectMethods(ctxRef) {
+  function sandbox() {
+    return ctxRef().sandbox;
+  }
+
+  return {
+    register(register) {
+      register('project.addRoot', async (params = {}) => {
+        const cfg = ctxRef().config;
+        const root = sandbox().addRoot(params.path, { force: false });
+        // 持久化到 agent.json + 内存同步
+        const { saveConfig } = require('../config');
+        if (!cfg.allowedRoots.includes(root)) {
+          cfg.allowedRoots = [...cfg.allowedRoots, root];
+          saveConfig({ allowedRoots: cfg.allowedRoots });
+        }
+        return { root };
+      });
+
+      register('project.removeRoot', async (params = {}) => {
+        const cfg = ctxRef().config;
+        const ok = sandbox().removeRoot(params.path);
+        if (ok) {
+          const { saveConfig } = require('../config');
+          cfg.allowedRoots = cfg.allowedRoots.filter((r) => r !== params.path && require('path').resolve(r) !== require('path').resolve(params.path));
+          saveConfig({ allowedRoots: cfg.allowedRoots });
+        }
+        return { removed: ok };
+      });
+
+      register('project.listRoots', async () => ({ roots: sandbox().listRoots() }));
+
+      register('project.validate', async (params = {}) => {
+        try {
+          const r = sandbox().resolve(params.path, params.base);
+          return { ok: true, abs: r.abs, root: r.root, rel: r.rel };
+        } catch (e) {
+          if (e instanceof RpcError) return { ok: false, code: e.code, message: e.message };
+          throw e;
+        }
+      });
+    },
+  };
+}
+
+module.exports = { createProjectMethods };

package/src/methods/scaffold.js

@@ -0,0 +1,131 @@
+/**
+ * scaffold.* RPC 方法（T-M3-10/11，需求 5.3.2 方式 C / 7.3）
+ * - scaffold.write {files:[{relPath, content}], requestId}  批量写文件（幂等）
+ * - scaffold.rollback {manifestId}  删除本次创建的全部文件（回滚）
+ * - 安全：路径沙箱校验（相对路径/无穿越/无非法字符）、大小限制（文件数≤200、单文件≤200KB、总量≤10MB）
+ * - 幂等：requestId 去重；回滚清单持久化（技能/项目根下 .scaffold-manifests.json）
+ */
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { RpcError } = require('../rpc');
+const { CONFIG_DIR } = require('../config');
+const logger = require('../logger');
+
+const MAX_FILES = 200;
+const MAX_FILE_SIZE = 200 * 1024; // 单文件 200KB
+const MAX_TOTAL = 10 * 1024 * 1024; // 总量 10MB
+const MANIFEST_FILE = path.join(CONFIG_DIR, 'scaffold-manifests.json');
+const IDEMPOTENT_MS = 5 * 60 * 1000;
+
+function createScaffoldMethods(ctxRef) {
+  const sandbox = () => ctxRef().sandbox;
+  const idempotentCache = new Map();
+
+  function readManifests() {
+    try {
+      return JSON.parse(fs.readFileSync(MANIFEST_FILE, 'utf8'));
+    } catch {
+      return [];
+    }
+  }
+  function saveManifests(list) {
+    try {
+      fs.mkdirSync(path.dirname(MANIFEST_FILE), { recursive: true });
+      fs.writeFileSync(MANIFEST_FILE, JSON.stringify(list, null, 2));
+    } catch (e) {
+      logger.warn(`[scaffold] 清单保存失败: ${e.message}`);
+    }
+  }
+
+  function register(reg) {
+    // ---- 批量写入（幂等）----
+    reg('scaffold.write', async (params = {}) => {
+      const requestId = String(params.requestId || '');
+      if (requestId) {
+        const hit = idempotentCache.get(requestId);
+        if (hit && Date.now() - hit.at < IDEMPOTENT_MS) return hit.result;
+      }
+      const files = Array.isArray(params.files) ? params.files : [];
+      if (files.length === 0) throw new RpcError('E_SCAFFOLD_EMPTY', '文件清单为空');
+      if (files.length > MAX_FILES) throw new RpcError('E_SCAFFOLD_OVERFLOW', `文件数超限（>${MAX_FILES}）`);
+
+      // 校验 + 解析（相对路径基准 = 项目根）
+      const projectRoot = params.projectRoot ? String(params.projectRoot) : '';
+      const r = sandbox().resolve(projectRoot, '');
+      const absRoot = r.abs;
+      const written = [];
+      let totalBytes = 0;
+      for (const f of files) {
+        const rel = String(f.relPath || '');
+        if (!rel || rel.includes('..') || rel.startsWith('/') || rel.includes('\\') || rel.split('/').some((s) => !s || s === '.')) {
+          throw new RpcError('E_SCAFFOLD_INVALID', `非法相对路径: ${rel}`);
+        }
+        const content = String(f.content ?? '');
+        if (Buffer.byteLength(content, 'utf8') > MAX_FILE_SIZE) {
+          throw new RpcError('E_SCAFFOLD_OVERFLOW', `单文件超限（>200KB）: ${rel}`);
+        }
+        totalBytes += Buffer.byteLength(content, 'utf8');
+        if (totalBytes > MAX_TOTAL) throw new RpcError('E_SCAFFOLD_OVERFLOW', '总大小超限（>10MB）');
+        written.push({ relPath: rel, content });
+      }
+
+      // 批量写入（幂等：已存在同内容跳过，不同内容报错防覆盖）
+      const created = [];
+      const manifestId = `${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+      for (const f of written) {
+        const abs = path.join(absRoot, f.relPath);
+        if (fs.existsSync(abs)) {
+          const cur = fs.readFileSync(abs, 'utf8');
+          if (cur === f.content) continue; // 已写入（重试幂等）
+          throw new RpcError('E_PATH_EXISTS', `文件已存在且内容不同（已创建 ${created.length} 个，可回滚）: ${f.relPath}`);
+        }
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, f.content, 'utf8');
+        created.push(f.relPath);
+      }
+      // 记录回滚清单
+      const manifests = readManifests();
+      manifests.push({ manifestId, projectRoot: absRoot, files: created, createdAt: Date.now() });
+      saveManifests(manifests.slice(-100));
+
+      const result = { ok: true, manifestId, created: created.length };
+      if (requestId) idempotentCache.set(requestId, { at: Date.now(), result });
+      logger.info(`[scaffold] 写入 ${created.length}/${written.length} 个文件到 ${absRoot}`);
+      return result;
+    });
+
+    // ---- 回滚（删除本次创建文件）----
+    reg('scaffold.rollback', async (params = {}) => {
+      const manifestId = String(params.manifestId || '');
+      const manifests = readManifests();
+      const idx = manifests.findIndex((m) => m.manifestId === manifestId);
+      if (idx < 0) throw new RpcError('E_SCAFFOLD_NOT_FOUND', '回滚清单不存在');
+      const m = manifests[idx];
+      // 目标必须在授权项目内
+      const r = sandbox().resolve(m.projectRoot, '');
+      if (r.abs !== m.projectRoot && !m.projectRoot.startsWith(r.abs + path.sep)) {
+        throw new RpcError('E_PATH_ESCAPE', '回滚目标越界');
+      }
+      // 只删除清单内文件（倒序删文件，目录留着）
+      const removed = [];
+      for (const rel of m.files.slice().reverse()) {
+        const abs = path.join(m.projectRoot, rel);
+        try {
+          if (fs.existsSync(abs)) {
+            fs.rmSync(abs);
+            removed.push(rel);
+          }
+        } catch { /* ignore */ }
+      }
+      manifests.splice(idx, 1);
+      saveManifests(manifests);
+      return { ok: true, removed: removed.length };
+    });
+  }
+
+  return { register };
+}
+
+module.exports = { createScaffoldMethods };