mirror of
https://gitcode.com/JianFeeeee/HomeAgent.git
synced 2026-10-15 12:15:16 +00:00
6d38a164eb
## 背景 仓库早已迁移到 GitHub（`github.com/JianFeeeee/HomeAgent`，CI/CD 都在那边跑）， gitcode 保留为**国内只读镜像**（`ci.yml` 的 sync-gitcode-main 快进推送）。 但 go.mod 的 module 路径一直是 `gitcode.com/JianFeeeee/...` —— 既与权威源 不符，`meta.SourceURL`（AGPL §13 的源码提供入口）也指向镜像而非实际运行的代码。 ## 关键区分（这是本次改动安全的前提） 两个 module 是**不同**的，影响面差一个数量级： | module | 谁依赖 | 改它的后果 | |---|---|---| | `.../HomeAgent`（主仓） | **只有主仓自己** | 内部重构，零外部影响 | | `.../homeagent-sdk`（SDK 仓） | 主仓 49 文件 + 所有外部插件 | 需重编插件 | ★ 实测确认：**插件不 import 主仓 module**（`strings qq/plugin.bin | grep HomeAgent` = 0）， 只依赖 SDK 仓。而插件与内核的边界是 **RPC 方法名字符串** （`plugin.init` / `tool.invoke`…，见 proc/protocol.go），**与 Go module 名无关**。 ⇒ module 改名**不改变任何 wire 协议**，现网已装的插件照常运行。 SDK 的 GitHub 仓名是 `homeagentsdk`（无连字符），module 路径必须与之精确匹配， 否则 `go get` 会因路径不符失败，故取 `github.com/JianFeeeee/homeagentsdk`。 ## 改动 - `go.mod` / `go.sum`：两个 module 路径 + require/replace - 277 个 Go 文件 + Makefile + 打包脚本的 import 与 ldflags 路径 - SDK 仓 `meta.CoreModule`、`tools/hmapdev` 的 module 声明与工程模板 - 对外文档/链接的仓库地址（README、PLUGIN_DEV、OVERVIEW 等） ## 明确**保留** gitcode 的地方（镜像机制，不能动） - `GITCODE_TOKEN`、`GC_URL="…@gitcode.com"`（CI 同步 job） - `gitcode.com/api/v5/...`（release 附件上传） - git remote `gitcode`（镜像拉取/推送） - `docs/zh/ci-cd-runbook.md`（整篇讲镜像运维） ## 验证 - `go build ./...` / `go vet ./...` 绿 - `go test ./... -count=1` → 48 包 ok / 0 FAIL - hmapdev 工具链编译通过（`third_party/homeagent-sdk/tools/hmapdev`） - 全仓残留检查：module 形态的 `gitcode.com/JianFeeeee` = 0 - 镜像机制抽验：GC_URL / @gitcode / api/v5 / remote 均完好 ## 顺带修正 `hmapdev/templates.go` 的注释此前写「gitcode 的模块不在 proxy.golang.org 上」—— module 已迁 GitHub，该论断不再成立。改为如实说明**为何仍默认 replace 到本机 SDK**： 离线可构建、避免版本漂移、内网可用。理由与托管地无关，故 replace 保留。
349 lines
11 KiB
Go
349 lines
11 KiB
Go
package webui
|
||
|
||
import (
|
||
"log"
|
||
"math"
|
||
"sort"
|
||
"strings"
|
||
|
||
"encoding/json"
|
||
sdk "github.com/JianFeeeee/HomeAgent/internal/sdk"
|
||
"github.com/JianFeeeee/HomeAgent/pkg/types"
|
||
"net/http"
|
||
)
|
||
|
||
// 设置与插件面：配置读写、插件列表/详情（含 pluginmgr 反代）。
|
||
|
||
func (h *Handler) handleConfig(w http.ResponseWriter, r *http.Request) {
|
||
if h.config == nil {
|
||
writeJSON(w, http.StatusServiceUnavailable, map[string]string{"error": "config not available"})
|
||
return
|
||
}
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
writeJSON(w, http.StatusOK, h.config.Get())
|
||
case http.MethodPut:
|
||
var cfg types.Config
|
||
if err := json.NewDecoder(r.Body).Decode(&cfg); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid config"})
|
||
return
|
||
}
|
||
h.config.Put(&cfg)
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "config_updated"})
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
// isInternalSetting 判断某个插件的配置键是不是**内部数据**（不是用户设置项）。
|
||
//
|
||
// chathistory 是 webui 自己持久化的整段聊天记录（生产实例实测 5.2MB）。它躺在
|
||
// 插件配置表里，于是会被设置接口当成普通配置项整块吐出：GET /api/v1/settings
|
||
// 因此返回 8MB+，并且前端把它渲染成一个巨大的文本框。它只应由 chat 相关
|
||
// 接口的 handleChatHistory 读，不进设置面。
|
||
func isInternalSetting(plugin, key string) bool {
|
||
return plugin == "webui" && key == "chathistory"
|
||
}
|
||
|
||
func (h *Handler) handleSettings(w http.ResponseWriter, r *http.Request) {
|
||
if h.settings == nil {
|
||
writeJSON(w, http.StatusNotFound, map[string]string{"error": "config registry not available"})
|
||
return
|
||
}
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
prefix := r.URL.Query().Get("prefix")
|
||
values := make(map[string]interface{})
|
||
meta := make(map[string]*sdk.ConfigDef)
|
||
|
||
if strings.HasPrefix(prefix, "plugin.") {
|
||
// 插件配置：从插件自身 config_<name> 表读取
|
||
pluginName := prefix[7:]
|
||
keys, _ := h.settings.ListPlugin(pluginName, "")
|
||
for _, k := range keys {
|
||
if isInternalSetting(pluginName, k) {
|
||
continue
|
||
}
|
||
v, _ := h.settings.GetPlugin(pluginName, k)
|
||
fullKey := prefix + "." + k
|
||
values[fullKey] = v
|
||
}
|
||
for _, def := range h.settings.DefsPlugin(pluginName, "") {
|
||
fullKey := prefix + "." + def.Key
|
||
meta[fullKey] = def
|
||
}
|
||
} else {
|
||
// 核心配置：从 core config 表读取（键可为任意前缀，如 core.llm.*、webui.*）
|
||
all := h.settings.Dump()
|
||
var keys []string
|
||
for k := range all {
|
||
if strings.HasPrefix(k, prefix) {
|
||
keys = append(keys, k)
|
||
}
|
||
}
|
||
sort.Strings(keys)
|
||
for _, k := range keys {
|
||
values[k] = all[k]
|
||
}
|
||
for _, d := range h.settings.DefsCore(prefix) {
|
||
meta[d.Key] = d
|
||
// 有 def 但 DB 中尚无值的 key，用 default 填充以便在 WebUI 中显示和编辑
|
||
if _, exists := values[d.Key]; !exists {
|
||
values[d.Key] = d.Default
|
||
}
|
||
}
|
||
// 无前缀时同时加载所有插件配置
|
||
if prefix == "" {
|
||
for _, p := range h.settings.Plugins() {
|
||
if p == "core" {
|
||
continue
|
||
}
|
||
pkeys, _ := h.settings.ListPlugin(p, "")
|
||
for _, k := range pkeys {
|
||
if isInternalSetting(p, k) {
|
||
continue
|
||
}
|
||
v, _ := h.settings.GetPlugin(p, k)
|
||
fullKey := "plugin." + p + "." + k
|
||
values[fullKey] = v
|
||
}
|
||
for _, def := range h.settings.DefsPlugin(p, "") {
|
||
fullKey := "plugin." + p + "." + def.Key
|
||
meta[fullKey] = def
|
||
}
|
||
}
|
||
}
|
||
}
|
||
|
||
plugins := []string{"core"}
|
||
for _, p := range h.settings.Plugins() {
|
||
if p != "core" {
|
||
plugins = append(plugins, "plugin."+p)
|
||
}
|
||
}
|
||
var pm map[string]sdk.PluginMeta
|
||
if h.pluginMgr != nil {
|
||
pm = h.pluginMgr.PluginMetas()
|
||
}
|
||
var disabledPlugins []sdk.DisabledPluginInfo
|
||
if h.pluginMgr != nil {
|
||
disabledPlugins = h.pluginMgr.ListDisabledPlugins()
|
||
}
|
||
sort.Strings(plugins)
|
||
writeJSON(w, http.StatusOK, map[string]interface{}{
|
||
"settings": values,
|
||
"meta": meta,
|
||
"plugins": plugins,
|
||
"plugin_meta": pm,
|
||
"disabled_plugins": disabledPlugins,
|
||
})
|
||
case http.MethodPut:
|
||
var body struct {
|
||
Key string `json:"key"`
|
||
Value interface{} `json:"value"`
|
||
}
|
||
if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid request"})
|
||
return
|
||
}
|
||
// 整数型 float64（如 QQ 号 2.198972886e+09）规范化为 int64，
|
||
// 避免被 fmt.Sprint 以科学计数法存库导致后续读取/解析失败。
|
||
if f, ok := body.Value.(float64); ok && f == math.Trunc(f) && math.Abs(f) < 1e15 {
|
||
body.Value = int64(f)
|
||
}
|
||
deleting := body.Value == nil
|
||
if strings.HasPrefix(body.Key, "plugin.") {
|
||
parts := strings.SplitN(body.Key, ".", 3)
|
||
if len(parts) >= 3 {
|
||
if isInternalSetting(parts[1], parts[2]) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "该键属于插件内部数据，不经设置接口读写"})
|
||
return
|
||
}
|
||
var err error
|
||
if deleting {
|
||
err = h.settings.RemovePlugin(parts[1], parts[2])
|
||
} else {
|
||
err = h.settings.SetPlugin(parts[1], parts[2], body.Value)
|
||
}
|
||
if err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
}
|
||
} else {
|
||
var err error
|
||
if deleting {
|
||
err = h.settings.RemoveCore(body.Key)
|
||
} else {
|
||
err = h.settings.SetCore(body.Key, body.Value)
|
||
}
|
||
if err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
}
|
||
if strings.HasPrefix(body.Key, "core.llm.") && h.llm != nil {
|
||
if err := h.llm.ReloadFromConfig(); err != nil {
|
||
log.Printf("[webui] failed to reload LLM providers: %v", err)
|
||
}
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "ok"})
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
// ======== Plugin Management (proxied to pluginmgr HTTP API) ========
|
||
|
||
func (h *Handler) pluginmgrAddr() string {
|
||
addr := "127.0.0.1:9876"
|
||
if h.settings == nil {
|
||
return addr
|
||
}
|
||
if v, err := h.settings.GetPlugin("pluginmgr", "http_addr"); err == nil {
|
||
if s, ok := v.(string); ok && s != "" {
|
||
addr = s
|
||
}
|
||
}
|
||
return addr
|
||
}
|
||
|
||
func (h *Handler) proxyToPluginmgr(w http.ResponseWriter, r *http.Request, path string) {
|
||
addr := h.pluginmgrAddr()
|
||
url := "http://" + addr + path
|
||
// 与设备网关反代共用同一实现：原来两处各抄一份，于是同一个 bug
|
||
//（跟随 3xx / 不逐帧 flush / 不透传 X-Forwarded）修了两遍还漏了两处。
|
||
h.reverseToUpstream(w, r, url, "")
|
||
}
|
||
|
||
func (h *Handler) handlePlugins(w http.ResponseWriter, r *http.Request) {
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
h.proxyToPluginmgr(w, r, "/plugins")
|
||
case http.MethodPost:
|
||
h.proxyToPluginmgr(w, r, "/plugins")
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|
||
|
||
func (h *Handler) handlePluginByID(w http.ResponseWriter, r *http.Request) {
|
||
path := strings.TrimPrefix(r.URL.Path, "/api/v1/plugins/")
|
||
path = strings.TrimSuffix(path, "/")
|
||
|
||
// 插件名白名单：仅允许单段安全名称，阻断路径穿越/空名/嵌套路径
|
||
validPluginName := func(s string) bool {
|
||
if s == "" || len(s) > 128 {
|
||
return false
|
||
}
|
||
// 禁止路径分隔符、连续点(父目录穿越)、冒号、空格等危险字符
|
||
if strings.Contains(s, "..") || strings.ContainsAny(s, "/\\: \t\r\n\x00") {
|
||
return false
|
||
}
|
||
for _, c := range s {
|
||
if !(c >= 'a' && c <= 'z' || c >= 'A' && c <= 'Z' || c >= '0' && c <= '9' || c == '_' || c == '-' || c == '.') {
|
||
return false
|
||
}
|
||
}
|
||
return true
|
||
}
|
||
|
||
if path == "disabled" && r.Method == http.MethodGet {
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]interface{}{"disabled": h.pluginMgr.ListDisabledPlugins()})
|
||
return
|
||
}
|
||
|
||
if path == "reload" {
|
||
if r.Method == http.MethodPost {
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin registry not available"})
|
||
return
|
||
}
|
||
if _, err := h.pluginMgr.ReloadPlugins(); err != nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "reloaded"})
|
||
return
|
||
}
|
||
// reload/disabled 是保留字，不允许 DELETE/GET 等其它操作误把其当作插件名
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
return
|
||
}
|
||
|
||
if idx := strings.LastIndex(path, "/"); idx > 0 {
|
||
name := path[:idx]
|
||
action := path[idx+1:]
|
||
if r.Method == http.MethodPost {
|
||
switch action {
|
||
case "disable":
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.DisablePlugin(name, "webui"); err != nil {
|
||
// 未安装 → 404；已禁用 → 409；其余为真实内部错误
|
||
status := http.StatusInternalServerError
|
||
msg := err.Error()
|
||
switch {
|
||
case strings.HasSuffix(msg, "not installed"):
|
||
status = http.StatusNotFound
|
||
case strings.HasSuffix(msg, "already disabled"):
|
||
status = http.StatusConflict
|
||
}
|
||
writeJSON(w, status, map[string]string{"error": msg})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "disabled"})
|
||
return
|
||
|
||
case "enable":
|
||
if h.pluginMgr == nil {
|
||
writeJSON(w, http.StatusInternalServerError, map[string]string{"error": "plugin manager not available"})
|
||
return
|
||
}
|
||
if !validPluginName(name) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
if err := h.pluginMgr.EnablePlugin(name); err != nil {
|
||
// 启用失败多数是“插件不存在/加载失败” → 404 更贴切
|
||
status := http.StatusInternalServerError
|
||
if strings.Contains(err.Error(), "failed") {
|
||
status = http.StatusNotFound
|
||
}
|
||
writeJSON(w, status, map[string]string{"error": err.Error()})
|
||
return
|
||
}
|
||
writeJSON(w, http.StatusOK, map[string]string{"status": "enabled"})
|
||
return
|
||
}
|
||
}
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
return
|
||
}
|
||
|
||
// 单段插件名路径（GET 详情 / DELETE 卸载）
|
||
if !validPluginName(path) {
|
||
writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid plugin name"})
|
||
return
|
||
}
|
||
|
||
switch r.Method {
|
||
case http.MethodGet:
|
||
h.proxyToPluginmgr(w, r, "/plugins/"+path)
|
||
case http.MethodDelete:
|
||
h.proxyToPluginmgr(w, r, "/plugins/"+path)
|
||
default:
|
||
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
|
||
}
|
||
}
|