feat: harden local shell, SFTP, and desktop session reliability
Finder-launched terminals now inherit a login PATH so tools like ollama resolve, destructive SFTP/editor actions require confirmation, and terminal search plus window dragging work again. SSH forwards and RDP sessions keep listeners and survive reconnect without FastPath crashes. Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Logan.LiandCursor committed
1 parent
188f3556ed
commit
08696896f9
223 files changed
+13493
-3423
No files matched your search
Executable
+281
@@ -0,0 +1,281 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Create an OpsXShell Gitee Release and upload native installers.
|
||||
|
||||
The script is intentionally non-destructive: release artifacts stay in the
|
||||
local ``release/`` directory after a successful upload.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import netrc
|
||||
import os
|
||||
import subprocess
|
||||
import sys
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
from urllib.parse import urlparse
|
||||
|
||||
import requests
|
||||
|
||||
|
||||
API_BASE = "https://gitee.com/api/v5"
|
||||
DEFAULT_REPO = "opsx-tools/opsxshell"
|
||||
ALLOWED_SUFFIXES = {".dmg", ".exe", ".msi"}
|
||||
CHECKSUM_NAMES = {"SHA256SUMS.txt"}
|
||||
MAX_ASSET_BYTES = 100 * 1024 * 1024
|
||||
|
||||
|
||||
def info(message: str) -> None:
|
||||
print(f"[release] {message}")
|
||||
|
||||
|
||||
def fail(message: str) -> None:
|
||||
raise RuntimeError(message)
|
||||
|
||||
|
||||
def normalize_version(value: str) -> str:
|
||||
version = value if value.startswith("v") else f"v{value}"
|
||||
parts = version.removeprefix("v").split(".")
|
||||
if len(parts) != 3 or not all(part.isdigit() for part in parts):
|
||||
fail(f"版本号必须是 vX.Y.Z，当前输入：{value}")
|
||||
return version
|
||||
|
||||
|
||||
def detect_repo() -> str:
|
||||
result = subprocess.run(
|
||||
["git", "remote", "get-url", "origin"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if result.returncode != 0:
|
||||
return DEFAULT_REPO
|
||||
|
||||
remote = result.stdout.strip().removesuffix(".git")
|
||||
if remote.startswith("git@gitee.com:"):
|
||||
return remote.split(":", 1)[1]
|
||||
parsed = urlparse(remote)
|
||||
if parsed.hostname == "gitee.com" and parsed.path.strip("/"):
|
||||
return parsed.path.strip("/")
|
||||
return DEFAULT_REPO
|
||||
|
||||
|
||||
def load_token() -> str:
|
||||
token = os.environ.get("GITEE_TOKEN", "").strip()
|
||||
if token:
|
||||
return token
|
||||
try:
|
||||
auth = netrc.netrc().authenticators("gitee.com")
|
||||
except (FileNotFoundError, netrc.NetrcParseError, OSError):
|
||||
auth = None
|
||||
if auth and auth[2]:
|
||||
return auth[2]
|
||||
fail("缺少 Gitee Token：请设置 GITEE_TOKEN 或 ~/.netrc 的 gitee.com password")
|
||||
|
||||
|
||||
def collect_assets(root: Path, version: str) -> list[Path]:
|
||||
version_dir = root / "release" / version
|
||||
if not version_dir.is_dir():
|
||||
fail(f"发布目录不存在：{version_dir}")
|
||||
|
||||
assets = sorted(
|
||||
path
|
||||
for path in version_dir.rglob("*")
|
||||
if path.is_file()
|
||||
and (path.suffix.lower() in ALLOWED_SUFFIXES or path.name in CHECKSUM_NAMES)
|
||||
)
|
||||
installers = [path for path in assets if path.suffix.lower() in ALLOWED_SUFFIXES]
|
||||
checksums = [path for path in assets if path.name in CHECKSUM_NAMES]
|
||||
if not installers:
|
||||
fail(f"{version_dir} 中没有安装包")
|
||||
if not checksums:
|
||||
fail(f"{version_dir} 中没有 SHA256SUMS.txt")
|
||||
|
||||
duplicate_names = {path.name for path in assets if sum(item.name == path.name for item in assets) > 1}
|
||||
if duplicate_names:
|
||||
fail(f"附件文件名重复：{', '.join(sorted(duplicate_names))}")
|
||||
for path in assets:
|
||||
if path.stat().st_size > MAX_ASSET_BYTES:
|
||||
fail(f"附件超过 Gitee 100 MB 限制：{path.name}")
|
||||
return assets
|
||||
|
||||
|
||||
def release_body(version: str, repo: str, assets: list[Path]) -> str:
|
||||
installers = [path for path in assets if path.suffix.lower() in ALLOWED_SUFFIXES]
|
||||
lines = [
|
||||
f"## OpsXShell {version}",
|
||||
"",
|
||||
"轻量原生的 SSH/SFTP 远程运维工作台，基于 Rust 与 Tauri v2。",
|
||||
"",
|
||||
"### 本版更新",
|
||||
"",
|
||||
"- SSH 终端内置单入口 AI Agent，可执行、观察并继续处理远程任务",
|
||||
"- 完善命令风险分级、危险命令拒绝、执行前确认与循环保护",
|
||||
"- 优化远程 Shell 超时退出后的单窗格恢复和错误提示",
|
||||
"- 完善 SSH/SFTP、终端交互与原生发布验收门禁",
|
||||
"",
|
||||
"### 下载",
|
||||
"",
|
||||
]
|
||||
for path in installers:
|
||||
lower = path.name.lower()
|
||||
if path.suffix.lower() == ".dmg" and ("aarch64" in lower or "arm64" in lower):
|
||||
platform = "macOS Apple Silicon"
|
||||
elif path.suffix.lower() == ".dmg":
|
||||
platform = "macOS Intel"
|
||||
elif path.suffix.lower() in {".exe", ".msi"}:
|
||||
platform = "Windows x86_64"
|
||||
else:
|
||||
platform = "安装包"
|
||||
url = f"https://gitee.com/{repo}/releases/download/{version}/{path.name}"
|
||||
lines.append(f"- **{platform}**：[{path.name}]({url})")
|
||||
|
||||
lines.extend(
|
||||
[
|
||||
"",
|
||||
"### macOS 安装",
|
||||
"",
|
||||
"1. 打开 DMG，将 OpsXShell 拖入 Applications。",
|
||||
"2. 当前公开包为 ad-hoc 开发签名且尚未 Apple 公证；首次启动如被 Gatekeeper 拦截，请在 Finder 中右键应用并选择“打开”。",
|
||||
"",
|
||||
"### 完整性校验",
|
||||
"",
|
||||
"下载 `SHA256SUMS.txt` 后，在安装包所在目录执行：",
|
||||
"",
|
||||
"```bash",
|
||||
"shasum -a 256 -c SHA256SUMS.txt",
|
||||
"```",
|
||||
"",
|
||||
"> 本 Release 仅声明附件中实际提供的平台与架构。",
|
||||
]
|
||||
)
|
||||
return "\n".join(lines)
|
||||
|
||||
|
||||
class GiteeRelease:
|
||||
def __init__(self, token: str, repo: str) -> None:
|
||||
self.repo = repo
|
||||
self.headers = {
|
||||
"Authorization": f"token {token}",
|
||||
"User-Agent": "opsxshell-release-uploader",
|
||||
}
|
||||
|
||||
def request(self, method: str, path: str, **kwargs: Any) -> requests.Response:
|
||||
response = requests.request(
|
||||
method,
|
||||
f"{API_BASE}/repos/{self.repo}{path}",
|
||||
headers=self.headers,
|
||||
timeout=kwargs.pop("timeout", 30),
|
||||
**kwargs,
|
||||
)
|
||||
return response
|
||||
|
||||
def get_by_tag(self, version: str) -> dict[str, Any] | None:
|
||||
response = self.request("GET", f"/releases/tags/{version}")
|
||||
if response.status_code == 404:
|
||||
return None
|
||||
if response.status_code != 200:
|
||||
fail(f"读取 Gitee Release 失败：HTTP {response.status_code} {response.text[:300]}")
|
||||
return response.json()
|
||||
|
||||
def upsert(self, version: str, body: str) -> dict[str, Any]:
|
||||
release = self.get_by_tag(version)
|
||||
payload = {
|
||||
"tag_name": version,
|
||||
"name": f"OpsXShell {version}",
|
||||
"body": body,
|
||||
"prerelease": False,
|
||||
}
|
||||
if release:
|
||||
response = self.request("PATCH", f"/releases/{release['id']}", json=payload)
|
||||
action = "更新"
|
||||
else:
|
||||
payload["target_commitish"] = subprocess.check_output(
|
||||
["git", "branch", "--show-current"], text=True
|
||||
).strip()
|
||||
response = self.request("POST", "/releases", json=payload)
|
||||
action = "创建"
|
||||
if response.status_code not in {200, 201}:
|
||||
fail(f"{action} Gitee Release 失败：HTTP {response.status_code} {response.text[:300]}")
|
||||
info(f"{action} Release 成功：{version}")
|
||||
return response.json()
|
||||
|
||||
def details(self, release_id: int) -> dict[str, Any]:
|
||||
response = self.request("GET", f"/releases/{release_id}")
|
||||
if response.status_code != 200:
|
||||
fail(f"读取 Release 附件失败：HTTP {response.status_code} {response.text[:300]}")
|
||||
return response.json()
|
||||
|
||||
def upload(self, release_id: int, asset: Path, existing: dict[str, int]) -> None:
|
||||
expected_size = asset.stat().st_size
|
||||
if existing.get(asset.name) == expected_size:
|
||||
info(f"跳过同名同大小附件：{asset.name}")
|
||||
return
|
||||
if asset.name in existing:
|
||||
fail(f"Release 已存在同名但大小不同的附件，请先人工删除：{asset.name}")
|
||||
info(f"上传 {asset.name}（{expected_size / 1024 / 1024:.1f} MB）")
|
||||
with asset.open("rb") as stream:
|
||||
response = self.request(
|
||||
"POST",
|
||||
f"/releases/{release_id}/attach_files",
|
||||
files={"file": (asset.name, stream, "application/octet-stream")},
|
||||
timeout=600,
|
||||
)
|
||||
if response.status_code != 201:
|
||||
fail(f"上传 {asset.name} 失败：HTTP {response.status_code} {response.text[:300]}")
|
||||
|
||||
def verify(self, release_id: int, assets: list[Path]) -> dict[str, Any]:
|
||||
release = self.details(release_id)
|
||||
remote = {item["name"]: int(item.get("size", -1)) for item in release.get("assets", [])}
|
||||
mismatches = [
|
||||
path.name
|
||||
for path in assets
|
||||
if path.name not in remote or remote[path.name] not in {-1, path.stat().st_size}
|
||||
]
|
||||
if mismatches:
|
||||
fail(f"Release 附件核验失败：{', '.join(mismatches)}")
|
||||
return release
|
||||
|
||||
|
||||
def parse_args() -> argparse.Namespace:
|
||||
parser = argparse.ArgumentParser(description="发布 OpsXShell 原生安装包到 Gitee")
|
||||
parser.add_argument("version", help="版本号，例如 v2.1.1")
|
||||
parser.add_argument("--repo", default=detect_repo(), help="Gitee 仓库，默认从 origin 检测")
|
||||
parser.add_argument("--root", type=Path, default=Path(__file__).resolve().parent.parent)
|
||||
parser.add_argument("--dry-run", action="store_true", help="只检查并列出待上传附件")
|
||||
return parser.parse_args()
|
||||
|
||||
|
||||
def main() -> int:
|
||||
args = parse_args()
|
||||
version = normalize_version(args.version)
|
||||
assets = collect_assets(args.root, version)
|
||||
info(f"仓库：{args.repo}")
|
||||
info(f"版本：{version}")
|
||||
for asset in assets:
|
||||
info(f"附件：{asset.relative_to(args.root)}")
|
||||
if args.dry_run:
|
||||
info("dry-run 完成，未访问 Gitee API")
|
||||
return 0
|
||||
|
||||
uploader = GiteeRelease(load_token(), args.repo)
|
||||
release = uploader.upsert(version, release_body(version, args.repo, assets))
|
||||
details = uploader.details(int(release["id"]))
|
||||
existing = {item["name"]: int(item.get("size", -1)) for item in details.get("assets", [])}
|
||||
for asset in assets:
|
||||
uploader.upload(int(release["id"]), asset, existing)
|
||||
verified = uploader.verify(int(release["id"]), assets)
|
||||
info(f"发布完成：https://gitee.com/{args.repo}/releases/tag/{version}")
|
||||
info(f"附件核验通过：{len(assets)} 个")
|
||||
if verified.get("tag_name") != version:
|
||||
fail("Release tag 核验失败")
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
raise SystemExit(main())
|
||||
except (RuntimeError, requests.RequestException, subprocess.SubprocessError) as exc:
|
||||
print(f"[release] ERROR: {exc}", file=sys.stderr)
|
||||
raise SystemExit(1)
|
||||
Reference in new issue
Block a user