ysagc-agent 0.2.0 → 0.3.0

package/README.md

@@ -7,6 +7,7 @@
 - 路径沙箱：只能操作 allowlist（用户显式添加的项目根目录）内路径
 - 终端：node-pty（Windows: PowerShell / macOS·Linux: 默认 shell），输入输出**不经过网站后端**
 - **免配对码**（v0.2.0）：浏览器打开网站「工作台」自动识别并连接本机代理，无需输入配对码、无需安装 exe
+- **目录树浏览 + 技能链接安装**（v0.3.0）：新增 `fs.browse`（网页内逐级选文件夹）与 `skill.installFromUrl`（从链接下载安装技能）
 
 ## 安装（npm 方式，全球通用）
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ysagc-agent",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "代码工作台本机代理：替浏览器在本机执行文件/Git/终端操作（JSON-RPC over WebSocket，直连 127.0.0.1，免配对码）",
   "main": "src/index.js",
   "bin": {

package/src/index.js

@@ -29,6 +29,7 @@ const { createSkillMethods } = require('./methods/skill');
 const { createGitMethods } = require('./methods/git');
 const { createScaffoldMethods } = require('./methods/scaffold');
 const { createDialogMethods } = require('./methods/dialog');
+const { createBrowseMethods } = require('./methods/browse');
 const { createHttpFsHandlers } = require('./http-fs');
 const { Sandbox } = require('./sandbox');
 const { startPairing, stopPairing, agentId } = require('./pairing');
@@ -104,6 +105,8 @@ const scaffoldMethods = createScaffoldMethods(() => configRef);
 scaffoldMethods.register(register);
 const dialogMethods = createDialogMethods();
 dialogMethods.register(register);
+const browseMethods = createBrowseMethods();
+browseMethods.register(register);
 
 // ---------------- WS 服务 ----------------
 const state = {

package/src/methods/browse.js

@@ -0,0 +1,91 @@
+/**
+ * fs.browse RPC：本机目录树浏览（v0.3.0）
+ * 用途：新增工作区时在网页内逐级点选文件夹，替代系统原生文件夹选择器（跨平台、无原生弹窗依赖）。
+ * - fs.browse {}            → 返回常见根目录（Windows 盘符 + Home；POSIX / + Home）
+ * - fs.browse { path }      → 返回该目录下的子目录
+ * 安全：仅列出目录名（只读），不做 allowlist 校验（选择后加入 allowlist 才可操作）；
+ * 仅 Origin 受信任的浏览器连接可调用（与其他 RPC 相同的鉴权门槛）。
+ */
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { RpcError } = require('../rpc');
+
+// 目录树浏览时默认隐藏的目录（避免噪声/系统目录）
+const HIDDEN = new Set([
+  '.git', '.svn', '.hg', '.idea', '.vscode', '.vs', '.next', '.nuxt',
+  'node_modules', 'dist', 'build', 'out', 'target', '.cache', '.npm',
+  '$RECYCLE.BIN', 'System Volume Information', 'Windows', 'Program Files',
+  'Program Files (x86)', 'ProgramData', 'AppData', '.gradle', '.m2',
+]);
+
+function listRoots() {
+  const roots = [];
+  const home = os.homedir();
+  if (process.platform === 'win32') {
+    for (let c = 65; c <= 90; c++) {
+      const letter = String.fromCharCode(c);
+      try {
+        if (fs.existsSync(`${letter}:/`)) roots.push({ name: `${letter}:`, path: `${letter}:/` });
+      } catch { /* ignore */ }
+    }
+  } else {
+    roots.push({ name: '/', path: '/' });
+  }
+  if (home) roots.push({ name: 'Home', path: home.replace(/\\/g, '/') });
+  return roots;
+}
+
+function browse(dirPath) {
+  // 无路径 → 根目录
+  if (!dirPath || String(dirPath).trim() === '') {
+    return { path: null, parent: null, roots: listRoots(), entries: [] };
+  }
+  const abs = path.resolve(String(dirPath).trim());
+  let st;
+  try {
+    st = fs.statSync(abs);
+  } catch {
+    throw new RpcError('E_PATH_NOT_FOUND', '目录不存在');
+  }
+  if (!st.isDirectory()) throw new RpcError('E_PATH_NOT_DIR', '不是目录');
+  const parent = path.dirname(abs);
+  const atRoot = parent === abs;
+  const entries = [];
+  let raw;
+  try {
+    raw = fs.readdirSync(abs, { withFileTypes: true });
+  } catch (e) {
+    throw new RpcError('E_PATH_NO_PERMISSION', `无法读取目录: ${e.message}`);
+  }
+  for (const e of raw) {
+    if (!e.isDirectory()) continue;
+    if (e.isSymbolicLink()) continue; // 防符号链接循环
+    if (e.name.startsWith('.') || HIDDEN.has(e.name)) continue;
+    const child = path.join(abs, e.name);
+    try {
+      if (fs.statSync(child).isDirectory()) {
+        entries.push({ name: e.name, path: child.replace(/\\/g, '/') });
+      }
+    } catch { /* 无权限跳过 */ }
+  }
+  entries.sort((a, b) => a.name.localeCompare(b.name, 'zh-CN'));
+  return {
+    path: abs.replace(/\\/g, '/'),
+    parent: atRoot ? null : parent.replace(/\\/g, '/'),
+    roots: atRoot ? listRoots() : [],
+    entries,
+  };
+}
+
+function createBrowseMethods() {
+  return {
+    register(reg) {
+      reg('fs.browse', async (params = {}) => browse(params && params.path));
+    },
+  };
+}
+
+module.exports = { createBrowseMethods };

package/src/methods/skill.js

@@ -48,7 +48,10 @@ function saveState(state) {
 
 /** 解析 SKILL.md：frontmatter + 正文 */
 function parseSkillDoc(content) {
-  const m = String(content || '').match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
+  // 兼容带 BOM 的文件（常见于 Windows 编辑器/Compress-Archive 产物）
+  let text = String(content || '');
+  if (text.charCodeAt(0) === 0xfeff) text = text.slice(1);
+  const m = text.match(/^---\s*\n([\s\S]*?)\n---\s*\n([\s\S]*)$/);
   if (!m) return null;
   const meta = {};
   for (const line of m[1].split('\n')) {
@@ -220,6 +223,100 @@ function fetchMarketRaw(backendUrl, skillId, ticket) {
   });
 }
 
+/**
+ * 从任意 http/https 链接下载技能（v0.3.0：skill.installFromUrl）
+ * 支持两种形态：
+ *  - .zip / 压缩包（含 SKILL.md 的技能包，可带 scripts/resources）
+ *  - 单个 SKILL.md / .md 文本（视为单个技能）
+ * 安全：仅 http/https；大小 ≤ MAX_TOTAL_BYTES；SKILL.md frontmatter + 名称白名单校验；
+ *       解压文件防路径穿越；校验失败整体回滚。
+ */
+function downloadUrl(url, maxBytes) {
+  return new Promise((resolve, reject) => {
+    let u;
+    try {
+      u = new URL(String(url || '').trim());
+    } catch {
+      return reject(new RpcError('E_VALIDATION', '链接无效'));
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:') {
+      return reject(new RpcError('E_VALIDATION', '仅支持 http/https 链接'));
+    }
+    const lib = u.protocol === 'https:' ? https : http;
+    const chunks = [];
+    let total = 0;
+    let settled = false;
+    const fail = (err) => {
+      if (settled) return;
+      settled = true;
+      reject(err);
+    };
+    const req = lib.get(u, { timeout: 20000, headers: { 'User-Agent': 'ysagc-agent/0.3' } }, (res) => {
+      if (res.statusCode >= 400) {
+        let body = '';
+        res.on('data', (c) => (body += c));
+        res.on('end', () => {
+          let msg = `下载失败（HTTP ${res.statusCode}）`;
+          try { msg = JSON.parse(body).msg || msg; } catch { /* ignore */ }
+          fail(new RpcError('E_SKILL_DOWNLOAD_FAILED', msg));
+        });
+        return;
+      }
+      res.on('data', (c) => {
+        total += c.length;
+        if (total > maxBytes) {
+          req.destroy();
+          fail(new RpcError('E_SKILL_DOWNLOAD_FAILED', `技能包过大（>${Math.floor(maxBytes / 1024 / 1024)}MB）`));
+          return;
+        }
+        chunks.push(c);
+      });
+      res.on('end', () => {
+        if (settled) return;
+        settled = true;
+        const base = path.basename(u.pathname || '').split('?')[0];
+        resolve({ buffer: Buffer.concat(chunks), contentType: res.headers['content-type'] || '', fileName: base });
+      });
+    });
+    req.on('error', (e) => fail(new RpcError('E_SKILL_DOWNLOAD_FAILED', `下载失败: ${e.message}`)));
+    req.on('timeout', () => { req.destroy(); fail(new RpcError('E_SKILL_DOWNLOAD_FAILED', '下载超时')); });
+  });
+}
+
+/** 解压 zip（防路径穿越），返回 [{relPath, content}] */
+function extractZipToFiles(buffer) {
+  return new Promise((resolve, reject) => {
+    let yauzl;
+    try {
+      yauzl = require('yauzl');
+    } catch {
+      return reject(new RpcError('E_SKILL_INVALID', '本机缺少解压组件，请更新 Agent'));
+    }
+    yauzl.fromBuffer(buffer, { lazyEntries: true, decodeStrings: true }, (err, zipfile) => {
+      if (err || !zipfile) return reject(new RpcError('E_SKILL_INVALID', '压缩包解析失败'));
+      const files = [];
+      zipfile.on('entry', (entry) => {
+        const name = entry.fileName;
+        if (/\/$/.test(name)) { zipfile.readEntry(); return; }
+        if (name.includes('..') || name.startsWith('/') || name.includes('\\')) { zipfile.readEntry(); return; }
+        zipfile.openReadStream(entry, (e, stream) => {
+          if (e || !stream) { zipfile.readEntry(); return; }
+          const chunks = [];
+          stream.on('data', (c) => chunks.push(c));
+          stream.on('end', () => {
+            files.push({ relPath: name, content: Buffer.concat(chunks).toString('utf8') });
+            zipfile.readEntry();
+          });
+          stream.on('error', () => zipfile.readEntry());
+        });
+      });
+      zipfile.on('end', () => resolve(files));
+      zipfile.on('error', (e) => reject(new RpcError('E_SKILL_INVALID', `压缩包读取失败: ${e.message}`)));
+      zipfile.readEntry();
+    });
+  });
+}
+
 function createSkillMethods(ctxRef) {
   const cfg = () => ctxRef().config;
 
@@ -296,6 +393,34 @@ function createSkillMethods(ctxRef) {
       return { ok: true, skill: readSkillInfo(dir) };
     });
 
+    // ---- 从链接安装（v0.3.0）----
+    reg('skill.installFromUrl', async (params = {}) => {
+      const url = String(params.url || '').trim();
+      if (!url) throw new RpcError('E_VALIDATION', '请输入技能链接');
+      const { buffer, fileName } = await downloadUrl(url, MAX_TOTAL_BYTES);
+      const isZip = /\.zip$/i.test(fileName) || (buffer.length >= 2 && buffer[0] === 0x50 && buffer[1] === 0x4b);
+      let files = [];
+      if (isZip) {
+        files = await extractZipToFiles(buffer);
+      } else {
+        files = [{ relPath: 'SKILL.md', content: buffer.toString('utf8') }];
+      }
+      const sm = files.find((f) => f.relPath === 'SKILL.md');
+      if (!sm) throw new RpcError('E_SKILL_INVALID', '技能包缺少 SKILL.md');
+      const parsed = parseSkillDoc(sm.content);
+      if (!parsed) throw new RpcError('E_SKILL_INVALID', 'SKILL.md 格式非法（需要 name/description frontmatter）');
+      const name = parsed.name;
+      const dir = writeSkillFiles(name, files);
+      const check = validateSkillDir(dir, name);
+      if (!check.ok) {
+        try { fs.rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
+        throw new RpcError('E_SKILL_INVALID', `技能校验失败: ${check.errors.join('; ')}`);
+      }
+      audit('skill.install', name, 'ok');
+      logger.info(`[skill] 已从链接安装技能 ${name}（${url}）`);
+      return { ok: true, skill: readSkillInfo(dir) };
+    });
+
     // ---- 卸载（危险级：前端二次确认）----
     reg('skill.uninstall', async (params = {}) => {
       const name = String(params.name || '');