ysagc-agent 0.2.0 → 0.4.0

package/src/index.js

@@ -1,439 +0,0 @@
-#!/usr/bin/env node
-/**
- * ysagc-agent 入口
- * - WS 服务仅绑定 127.0.0.1（浏览器可信源）
- * - 端口占用自动 +1（最多 5 次）
- * - 控制通道 JSON-RPC 2.0；终端二进制分帧
- * - 鉴权握手 3s 超时；心跳 15s、3 次无响应断开
- * - 同设备最多 2 个控制连接（T-M0-15）
- * 用法：npx ysagc-agent [--init-token <token>] [--port N]
- */
-'use strict';
-
-const http = require('http');
-const crypto = require('crypto');
-const url = require('url');
-const { WebSocketServer } = require('ws');
-const path = require('path');
-const fs = require('fs');
-
-const { loadConfig, saveConfig, CONFIG_DIR } = require('./config');
-const logger = require('./logger');
-const { register, handleRequest } = require('./rpc');
-const { isOriginTrusted } = require('./origin');
-const { registerSystemMethods } = require('./methods/system');
-const { createTerminalMethods } = require('./methods/terminal');
-const { createProjectMethods } = require('./methods/project');
-const { createFsMethods } = require('./methods/fs');
-const { createSkillMethods } = require('./methods/skill');
-const { createGitMethods } = require('./methods/git');
-const { createScaffoldMethods } = require('./methods/scaffold');
-const { createDialogMethods } = require('./methods/dialog');
-const { createHttpFsHandlers } = require('./http-fs');
-const { Sandbox } = require('./sandbox');
-const { startPairing, stopPairing, agentId } = require('./pairing');
-
-const DEFAULT_PORT = 37890;
-const MAX_PORT_TRIES = 5;
-const AUTH_TIMEOUT_MS = 3000;
-const HEARTBEAT_INTERVAL_MS = 15000;
-const HEARTBEAT_MISS_LIMIT = 3;
-const MAX_CONNS_PER_DEVICE = 2;
-const RPC_RATE_LIMIT = 60; // RPC ≤ 60/min/设备（5.20.3）
-const RPC_RATE_WINDOW = 60000;
-
-// ---------------- CLI ----------------
-const argv = process.argv.slice(2);
-function getArg(name) {
-  const i = argv.indexOf(name);
-  return i >= 0 ? argv[i + 1] : null;
-}
-
-const AGENT_VERSION = require('../package.json').version;
-if (argv.includes('--help') || argv.includes('-h')) {
-  console.log(`ysagc-agent v${AGENT_VERSION} — 代码工作台本机代理
-用法: npx ysagc-agent [选项]
-
-选项:
-  --port N          指定监听端口（默认 37890，被占用自动 +1）
-  --init-token <t>  把指定 token 加入白名单（兼容旧版配对，一般无需使用）
-  --help, -h        显示帮助
-  --version, -v     显示版本
-
-启动后无需配对码：浏览器打开网站「工作台」即可自动识别本机代理并连接。
-代理仅监听 127.0.0.1，替浏览器在本机执行文件 / Git / 终端操作。`);
-  process.exit(0);
-}
-if (argv.includes('--version') || argv.includes('-v')) {
-  console.log(AGENT_VERSION);
-  process.exit(0);
-}
-
-// ---------------- 配置 ----------------
-let config = loadConfig();
-logger.setLevel(config.logLevel);
-
-const initToken = getArg('--init-token');
-if (initToken) {
-  const hash = crypto.createHash('sha256').update(String(initToken)).digest('hex');
-  if (!config.deviceTokenWhitelist.includes(hash)) {
-    config = saveConfig({ deviceTokenWhitelist: [...config.deviceTokenWhitelist, hash] });
-    logger.info(`[init-token] 已加入设备令牌白名单（sha256: ${hash.slice(0, 16)}...）`);
-  }
-}
-if (getArg('--port')) {
-  config = saveConfig({ port: Number(getArg('--port')) || DEFAULT_PORT });
-}
-const configRef = { config }; // 供方法层读取最新配置
-const sandbox = new Sandbox(config.allowedRoots || []);
-configRef.sandbox = sandbox;
-
-// ---------------- RPC 注册 ----------------
-registerSystemMethods(register, () => configRef);
-const terminal = createTerminalMethods(() => configRef);
-terminal.register(register);
-const projectMethods = createProjectMethods(() => configRef);
-projectMethods.register(register);
-const fsMethods = createFsMethods(() => configRef);
-fsMethods.register(register);
-const skillMethods = createSkillMethods(() => configRef);
-skillMethods.register(register);
-const gitMethods = createGitMethods(() => configRef);
-gitMethods.register(register);
-const scaffoldMethods = createScaffoldMethods(() => configRef);
-scaffoldMethods.register(register);
-const dialogMethods = createDialogMethods();
-dialogMethods.register(register);
-
-// ---------------- WS 服务 ----------------
-const state = {
-  /** deviceId -> Set<ws> 控制连接 */
-  deviceConns: new Map(),
-};
-
-function sha256(s) {
-  return crypto.createHash('sha256').update(String(s)).digest('hex');
-}
-
-function checkAuthToken(token) {
-  if (!token || typeof token !== 'string') return false;
-  return configRef.config.deviceTokenWhitelist.includes(sha256(token));
-}
-
-/**
- * 客户端 → Agent 的二进制帧解析（终端输入）：
- * 4 字节大端头长 + JSON 头 {channel:'terminal', sessionId, type} + payload
- */
-function parseBinaryFrame(buffer) {
-  if (buffer.length < 5) return null;
-  const headerLen = buffer.readUInt32BE(0);
-  if (buffer.length < 4 + headerLen) return null;
-  let header;
-  try {
-    header = JSON.parse(buffer.slice(4, 4 + headerLen).toString('utf8'));
-  } catch {
-    return null;
-  }
-  return { header, payload: buffer.slice(4 + headerLen) };
-}
-
-function buildBinaryFrame(header, payload) {
-  const h = Buffer.from(JSON.stringify(header), 'utf8');
-  const len = Buffer.alloc(4);
-  len.writeUInt32BE(h.length, 0);
-  return Buffer.concat([len, h, payload]);
-}
-
-function sendJson(ws, obj) {
-  if (ws.readyState === ws.OPEN) ws.send(JSON.stringify(obj));
-}
-
-function closeWith(ws, code, reason) {
-  try {
-    ws.close(code, reason);
-  } catch {
-    ws.terminate();
-  }
-}
-
-function setupConnection(ws, req) {
-  ws.isAlive = true;
-  ws.authed = false;
-  ws.deviceId = null;
-  // 免配对码直连：Origin 可信的浏览器连接无需 deviceToken（v0.2.0）
-  ws.originTrusted = isOriginTrusted(req.headers.origin, configRef.config);
-  ws.authTimer = setTimeout(() => {
-    if (!ws.authed) closeWith(ws, 4401, 'auth timeout');
-  }, AUTH_TIMEOUT_MS);
-
-  ws.on('pong', () => {
-    ws.isAlive = true;
-    ws.missed = 0;
-  });
-  ws.missed = 0;
-
-  ws.on('message', async (data, isBinary) => {
-    if (isBinary) {
-      const frame = parseBinaryFrame(data);
-      if (!frame || !ws.authed) return;
-      if (frame.header && frame.header.channel === 'terminal' && frame.header.sessionId) {
-        // 终端输入 → 对应 pty 会话
-        const s = terminal.sessions.get(frame.header.sessionId);
-        if (s && frame.payload.length > 0) s.pty.write(frame.payload.toString('utf8'));
-      }
-      return;
-    }
-    let msg;
-    try {
-      msg = JSON.parse(data.toString('utf8'));
-    } catch {
-      return;
-    }
-
-    // ---- 鉴权握手 ----
-    if (msg && msg.type === 'auth') {
-      if (ws.authed) return;
-      const tokenOk = checkAuthToken(msg.token);
-      const autoOk = ws.originTrusted && (msg.mode === 'auto' || !msg.token);
-      if (!tokenOk && !autoOk) {
-        logger.warn(`[ws] 鉴权失败：token 不在白名单且 Origin 不受信任（origin=${req.headers.origin || 'none'} remote=${req.socket.remoteAddress}）`);
-        closeWith(ws, 4401, 'unauthorized');
-        return;
-      }
-      ws.authed = true;
-      ws.deviceId = msg.deviceId || 'dev-default';
-      if (ws.authTimer) clearTimeout(ws.authTimer);
-      // ---- 多连接限制（T-M0-15）----
-      let set = state.deviceConns.get(ws.deviceId);
-      if (!set) {
-        set = new Set();
-        state.deviceConns.set(ws.deviceId, set);
-      }
-      const existing = [...set].filter((c) => c !== ws && c.readyState === c.OPEN);
-      if (existing.length >= MAX_CONNS_PER_DEVICE) {
-        sendJson(ws, { jsonrpc: '2.0', method: 'event.connection.limit', params: { max: MAX_CONNS_PER_DEVICE, code: 'E_CONNECTION_LIMIT' } });
-        closeWith(ws, 4403, 'connection limit');
-        return;
-      }
-      set.add(ws);
-      if (existing.length > 0) {
-        // 旧连接收到提示
-        sendJson(existing[0], { jsonrpc: '2.0', method: 'event.connection.duplicated', params: { hint: '已在其他窗口打开' } });
-      }
-      sendJson(ws, {
-        jsonrpc: '2.0',
-        method: 'event.auth.ok',
-        params: {
-          agentVersion: require('../package.json').version,
-          protocolVersion: 1,
-          port: configRef.config.port,
-          platform: `${process.platform} ${process.arch}`,
-        },
-      });
-      logger.info(`[ws] 设备 ${ws.deviceId} 已连接（当前 ${existing.length + 1} 连接）`);
-      return;
-    }
-
-    if (!ws.authed) {
-      // 未鉴权连接仅放行配对握手（新设备尚无 deviceToken，用配对码换取令牌）
-      if (msg && msg.jsonrpc === '2.0' && msg.method === 'pairing.handshake') {
-        const resp = await handleRequest(msg, {
-          socket: req.socket,
-          ws,
-          deviceId: null,
-          send: (obj) => sendJson(ws, obj),
-          sendBinary: null,
-        });
-        if (resp) sendJson(ws, resp);
-      }
-      return;
-    }
-    // ---- JSON-RPC（5.20.3 频率限制：RPC ≤60/min/设备）----
-    if (msg && msg.jsonrpc === '2.0' && msg.method) {
-      const now = Date.now();
-      if (!ws.rpcWindow) {
-        ws.rpcWindow = now;
-        ws.rpcCount = 0;
-      }
-      if (now - ws.rpcWindow > RPC_RATE_WINDOW) {
-        ws.rpcWindow = now;
-        ws.rpcCount = 0;
-      }
-      ws.rpcCount++;
-      if (ws.rpcCount > RPC_RATE_LIMIT) {
-        logger.warn(`[ws] RPC 频率超限（${ws.rpcCount}/${RPC_RATE_LIMIT} per min），拒绝: ${msg.method}`);
-        sendJson(ws, {
-          jsonrpc: '2.0',
-          id: msg.id ?? null,
-          error: { code: -32603, message: '请求过于频繁，请稍后再试', data: { code: 'E_RATE_LIMIT' } },
-        });
-        return;
-      }
-      const resp = await handleRequest(msg, {
-        socket: req.socket,
-        ws,
-        deviceId: ws.deviceId,
-        send: (obj) => sendJson(ws, obj),
-        sendBinary: (buf, opts) => {
-          if (ws.readyState === ws.OPEN) ws.send(buf, { binary: true });
-        },
-      });
-      if (resp) sendJson(ws, resp);
-    }
-  });
-
-  ws.on('close', () => {
-    if (ws.authTimer) clearTimeout(ws.authTimer);
-    if (ws.deviceId) {
-      const set = state.deviceConns.get(ws.deviceId);
-      if (set) {
-        set.delete(ws);
-        if (set.size === 0) state.deviceConns.delete(ws.deviceId);
-      }
-      logger.info(`[ws] 设备 ${ws.deviceId} 连接断开（剩余 ${set ? set.size : 0} 连接）`);
-    }
-  });
-
-  ws.on('error', () => {
-    /* 连接错误由 close 统一处理 */
-  });
-}
-
-function tryListen(port, triesLeft) {
-  const httpFs = createHttpFsHandlers(() => configRef);
-  const server = http.createServer((req, res) => {
-    const parsed = url.parse(req.url, true);
-    const p = parsed.pathname || '';
-    const origin = req.headers.origin || '';
-
-    // CORS 预检（浏览器跨源 fetch 到 http://127.0.0.1 需要）
-    if (req.method === 'OPTIONS') {
-      res.writeHead(204, {
-        'Access-Control-Allow-Origin': origin || '*',
-        'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
-        'Access-Control-Allow-Headers': 'Content-Type, X-Offset, X-Total, Authorization',
-        'Access-Control-Max-Age': '86400',
-      });
-      res.end();
-      return;
-    }
-    const corsHeaders = (h) => {
-      h['Access-Control-Allow-Origin'] = origin || '*';
-      return h;
-    };
-    try {
-      // 免配对码直连：浏览器探测本机 Agent 信息（v0.2.0）
-      if (req.method === 'GET' && p === '/api/bootstrap') {
-        res.writeHead(200, corsHeaders({ 'Content-Type': 'application/json' }));
-        res.end(JSON.stringify({
-          agentId: agentId(),
-          agentVersion: require('../package.json').version,
-          protocolVersion: configRef.config.protocolVersion || 2,
-          port: configRef.config.port,
-          platform: `${process.platform} ${process.arch}`,
-          nodeVersion: process.version,
-          hostname: require('os').hostname(),
-          paired: (configRef.config.deviceTokenWhitelist || []).length > 0,
-          allowAuto: true,
-        }));
-        return;
-      }
-      if (req.method === 'POST' && p === '/api/fs/upload') return httpFs.handleUpload(req, res, parsed.query);
-      if (req.method === 'GET' && p === '/api/fs/download') return httpFs.handleDownload(req, res, parsed.query);
-      if (req.method === 'GET' && p === '/api/fs/zip') return httpFs.handleZip(req, res, parsed.query);
-    } catch (e) {
-      logger.error(`[http] 处理 ${p} 失败: ${e && e.message}`);
-      res.writeHead(500, corsHeaders({ 'Content-Type': 'application/json' }));
-      res.end(JSON.stringify({ code: 'E_INTERNAL', msg: e && e.message }));
-      return;
-    }
-    res.writeHead(404, corsHeaders({ 'Content-Type': 'application/json' }));
-    res.end(JSON.stringify({ error: 'not found' }));
-  });
-
-  const wss = new WebSocketServer({ server, maxPayload: 1024 * 1024 });
-  wss.on('connection', setupConnection);
-  // 广播通道（fs 监听等事件推送到所有已鉴权连接）
-  configRef.broadcast = (obj) => {
-    for (const c of wss.clients) {
-      if (c.authed && c.readyState === c.OPEN) sendJson(c, obj);
-    }
-  };
-
-  server.on('error', (err) => {
-    if (err.code === 'EADDRINUSE' && triesLeft > 0) {
-      logger.warn(`[ws] 端口 ${port} 被占用，尝试 ${port + 1}`);
-      tryListen(port + 1, triesLeft - 1);
-    } else {
-      logger.error(`[ws] 启动失败: ${err.message}`);
-      process.exit(1);
-    }
-  });
-
-  server.listen(port, '127.0.0.1', () => {
-    configRef.config = saveConfig({ port });
-    logger.info(`[ws] Agent 已启动 ws://127.0.0.1:${port}`);
-    console.log(`ysagc-agent 运行中: ws://127.0.0.1:${port}`);
-    // ---- 心跳 ----
-    const heartbeat = setInterval(() => {
-      for (const ws of wss.clients) {
-        if (ws.isAlive === false) {
-          ws.terminate();
-          continue;
-        }
-        ws.isAlive = false;
-        ws.missed = (ws.missed || 0) + 1;
-        if (ws.missed > HEARTBEAT_MISS_LIMIT) {
-          ws.terminate();
-          continue;
-        }
-        try {
-          ws.ping();
-        } catch {
-          /* ignore */
-        }
-      }
-    }, HEARTBEAT_INTERVAL_MS);
-    heartbeat.unref();
-    // ---- 配对码 ----
-    startPairing(() => configRef.config);
-  });
-
-  return server;
-}
-
-console.log(`ysagc-agent v${AGENT_VERSION} 启动中（配置目录: ${CONFIG_DIR}，端口: ${config.port}）`);
-console.log(`免配对码直连已启用：打开网站「工作台」即可自动识别本机代理（agentId: ${agentId().slice(0, 8)}...）`);
-console.log('提示: 输入 --help 查看完整选项。');
-tryListen(config.port, MAX_PORT_TRIES);
-
-process.on('SIGINT', () => {
-  stopPairing();
-  logger.info('[agent] 收到 SIGINT，退出');
-  process.exit(0);
-});
-process.on('SIGTERM', () => {
-  stopPairing();
-  logger.info('[agent] 收到 SIGTERM，退出');
-  process.exit(0);
-});
-
-// Agent 守护进程韧性：单个会话/pty 的异步错误不得打崩整个 Agent。
-// 快速连续崩溃（如 10 秒内 5 次）视为致命，退出。
-let crashCount = 0;
-let crashWindowStart = 0;
-function guardCrash(level, err) {
-  const now = Date.now();
-  if (now - crashWindowStart > 10000) {
-    crashWindowStart = now;
-    crashCount = 0;
-  }
-  crashCount++;
-  logger.error(`[guard:${level}]`, err);
-  if (crashCount >= 5) {
-    logger.error('[guard] 短时间多次致命异常，Agent 退出');
-    process.exit(1);
-  }
-}
-process.on('uncaughtException', (err) => guardCrash('uncaughtException', err));
-process.on('unhandledRejection', (reason) => guardCrash('unhandledRejection', reason));

package/src/logger.js

@@ -1,84 +0,0 @@
-/**
- * 滚动日志：~/.ysagc-agent/logs/agent.log（按日滚动，保留 7 份）
- * 红线：永不记录密钥文件内容、Git 凭证、密码类数据
- */
-'use strict';
-
-const fs = require('fs');
-const path = require('path');
-const { CONFIG_DIR } = require('./config');
-
-const LOG_DIR = path.join(CONFIG_DIR, 'logs');
-const LOG_FILE = path.join(LOG_DIR, 'agent.log');
-const MAX_KEEP = 7;
-const MAX_SIZE = 5 * 1024 * 1024; // 5MB 滚动
-
-let levelRank = { debug: 10, info: 20, warn: 30, error: 40 };
-let currentLevel = 'info';
-
-function ensureLogDir() {
-  try {
-    fs.mkdirSync(LOG_DIR, { recursive: true });
-  } catch {
-    /* 日志目录创建失败时降级为 console */
-  }
-}
-
-function rotateIfNeeded() {
-  try {
-    if (!fs.existsSync(LOG_FILE)) return;
-    const stat = fs.statSync(LOG_FILE);
-    if (stat.size < MAX_SIZE) return;
-    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
-    fs.renameSync(LOG_FILE, path.join(LOG_DIR, `agent.log.${stamp}`));
-    // 清理旧日志，保留最近 MAX_KEEP 份
-    const backups = fs
-      .readdirSync(LOG_DIR)
-      .filter((f) => f.startsWith('agent.log.') && f !== LOG_FILE)
-      .map((f) => ({ f, t: fs.statSync(path.join(LOG_DIR, f)).mtimeMs }))
-      .sort((a, b) => b.t - a.t);
-    for (const b of backups.slice(MAX_KEEP)) {
-      try {
-        fs.unlinkSync(path.join(LOG_DIR, b.f));
-      } catch {
-        /* ignore */
-      }
-    }
-  } catch {
-    /* ignore */
-  }
-}
-
-function sanitize(msg) {
-  // 脱敏：常见的密钥/凭证形态（预防性兜底，正常流程不应写入）
-  return String(msg).replace(
-    /(sk-[A-Za-z0-9_\-]{8,}|ghp_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[bap]-[A-Za-z0-9\-]{10,}|password\s*[:=]\s*\S+)/gi,
-    '[REDACTED]'
-  );
-}
-
-function write(level, args) {
-  if (levelRank[level] < levelRank[currentLevel]) return;
-  ensureLogDir();
-  rotateIfNeeded();
-  const line = `[${new Date().toISOString()}] [${level.toUpperCase()}] ${args
-    .map((a) => (a instanceof Error ? a.stack || a.message : typeof a === 'object' ? JSON.stringify(a) : String(a)))
-    .join(' ')}`;
-  try {
-    fs.appendFileSync(LOG_FILE, sanitize(line) + '\n');
-  } catch {
-    /* ignore */
-  }
-}
-
-const logger = {
-  setLevel(level) {
-    if (levelRank[level]) currentLevel = level;
-  },
-  debug: (...a) => write('debug', a),
-  info: (...a) => write('info', a),
-  warn: (...a) => write('warn', a),
-  error: (...a) => write('error', a),
-};
-
-module.exports = logger;

package/src/methods/dialog.js

@@ -1,84 +0,0 @@
-/**
- * dialog.* RPC 方法：本机原生对话框（T-M3-xx）
- * - dialog.pickFolder {} → { path }  打开系统文件夹选择器，返回绝对路径（取消返回 E_DIALOG_CANCELED）
- * 实现：
- *   Windows: PowerShell FolderBrowserDialog（Agent 运行在用户本机，可弹原生窗口）
- *   macOS:   osascript choose folder
- *   Linux:   zenity / kdialog（依次尝试）
- * 用途：添加项目时"点击选择文件夹"替代手输绝对路径（需求 4.3.1 方式 A）
- */
-'use strict';
-
-const { execFile } = require('child_process');
-const { RpcError } = require('../rpc');
-
-const DIALOG_TIMEOUT_MS = 5 * 60 * 1000; // 用户可能挑很久，5 分钟上限
-
-function run(cmd, args, timeoutMs) {
-  return new Promise((resolve, reject) => {
-    execFile(
-      cmd,
-      args,
-      { timeout: timeoutMs || DIALOG_TIMEOUT_MS, windowsHide: true, maxBuffer: 4 * 1024 * 1024 },
-      (err, stdout) => {
-        if (err) return reject(err);
-        resolve(String(stdout || ''));
-      }
-    );
-  });
-}
-
-/** Windows：PowerShell FolderBrowserDialog */
-async function pickFolderWindows() {
-  const ps = [
-    'Add-Type -AssemblyName System.Windows.Forms',
-    "$f = New-Object System.Windows.Forms.FolderBrowserDialog",
-    "$f.Description = '选择要添加到工作台的项目文件夹'",
-    '$f.ShowNewFolderButton = $true',
-    "if ($f.ShowDialog() -eq [System.Windows.Forms.DialogResult]::OK) { Write-Output $f.SelectedPath }",
-  ].join('; ');
-  const out = await run('powershell.exe', ['-NoProfile', '-NonInteractive', '-STA', '-Command', ps]);
-  const p = String(out || '').trim().split(/\r?\n/).filter(Boolean).pop() || '';
-  return p;
-}
-
-/** macOS：osascript choose folder */
-async function pickFolderMac() {
-  const out = await run('osascript', ['-e', 'POSIX path of (choose folder with prompt "选择要添加到工作台的项目文件夹")']);
-  return String(out || '').trim();
-}
-
-/** Linux：zenity → kdialog 依次尝试 */
-async function pickFolderLinux() {
-  for (const [cmd, args] of [
-    ['zenity', ['--file-selection', '--directory', '--title=选择要添加到工作台的项目文件夹']],
-    ['kdialog', ['--getexistingdirectory', '选择要添加到工作台的项目文件夹']],
-  ]) {
-    try {
-      const out = await run(cmd, args, 30000);
-      const p = String(out || '').trim();
-      if (p) return p;
-    } catch {
-      /* 尝试下一种 */
-    }
-  }
-  throw new RpcError('E_DIALOG_UNSUPPORTED', '当前系统未安装文件夹选择工具（zenity/kdialog），请手动输入路径');
-}
-
-function createDialogMethods() {
-  return {
-    register(reg) {
-      reg('dialog.pickFolder', async () => {
-        let p = '';
-        if (process.platform === 'win32') p = await pickFolderWindows();
-        else if (process.platform === 'darwin') p = await pickFolderMac();
-        else p = await pickFolderLinux();
-        p = String(p || '').trim();
-        if (!p) throw new RpcError('E_DIALOG_CANCELED', '已取消选择文件夹');
-        return { path: p.replace(/\\/g, '/') };
-      });
-    },
-  };
-}
-
-module.exports = { createDialogMethods };