lxy/DevFlow
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

新增: 知识图谱Phase3基础设施(父⑥) — project_services+D10凭证审查+IPC+AI工具

Browse Source 
父⑥ Phase 3(对标设计 §2.3):
- V31 迁移:project_services 表(id/project_id FK/name/service_type/endpoint/config_json/environment/remark)+ idx_project_services_project
- ProjectServiceRecord + ProjectServiceRepo(impl_repo! 宏 + insert_validated/update_full_validated/list_by_project/list_by_project_env)
- service_type 白名单(mysql/postgresql/sqlite/redis/mongodb/mq/api/other,应用层校验)
- D10 凭证审查:config_json/endpoint/remark 含 password/passwd/secret/api_key/apikey/token 拒绝(不存敏感凭证,凭证走环境变量)
- 4 IPC(add/update/remove/list_project_services,环境过滤)+ lib.rs 注册
- AI 工具 add/list_project_services(Medium/Low)+ 基线 39→41(data 25→27)+ 3 端到端测试

P2 修复(verify agent 发现):
- settings.rs project_services 白名单移除 service_type(对齐注释"不列入"+ status 收口,防 update_field 旁路绕过 validate_service_type)

df-storage 117(105+12) + df-ai 331 + 基线 41 测试全过。
This commit is contained in:
绝尘
2026-06-27 00:49:09 +08:00
parent 0c348f2311
commit e33e8f86d3
11 changed files with 1231 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

280
src-tauri/src/commands/ai/tool_registry.rs
View File

@@ -9,7 +9,7 @@ use tokio::sync::{Mutex as TokioMutex, RwLock};
use df_ai::ai_tools::{AiToolRegistry, RiskLevel};
use df_execute::shell::{execute, ShellRequest};
use df_storage::db::Database;
use df_storage::models::{ProjectRecord, TaskRecord, IdeaRecord};
use df_storage::models::{ProjectRecord, ProjectServiceRecord, TaskRecord, IdeaRecord};
use df_types::types::new_id;
@@ -500,6 +500,8 @@ fn register_http_tools(registry: &mut AiToolRegistry) {
/// + 父子树 + 跨池移动 + content 更新),data 层 18→24。
/// 知识图谱 Phase 2(2026-06-26):register_task_graph_tools 增 get_project_timeline(项目事件流查询),
/// data 层 24→25。
/// 知识图谱 Phase 3(2026-06-27):register_task_graph_tools 增 add_project_service(Medium)/
/// list_project_services(Low 只读) 项目基础设施配置,data 层 25→27。
///
/// SMELL-P0-2:抽自原 build_ai_tool_registry 1091 行单函数(数据+文件混合)。
/// 18 个 register 调用【原样移入】,零行为变更,仅机械搬运。
@@ -514,6 +516,8 @@ fn register_http_tools(registry: &mut AiToolRegistry) {
/// - register_task_graph_tools(6):task_link CRUD + 父子树 + 跨池移动 + content 更新
/// 知识图谱 Phase 2(2026-06-26):register_task_graph_tools 增 get_project_timeline(项目事件流,只读),
/// 该子函数 6→7 工具,data 层 24→25。
/// 知识图谱 Phase 3(2026-06-27):register_task_graph_tools 增 add_project_service(Medium)/
/// list_project_services(Low 只读) 项目基础设施配置(D10 不存凭证),该子函数 7→9 工具,data 层 25→27。
/// AiToolRegistry 底层 HashMap(注册顺序无关),拆分后工具集合与原一致 + 新增,
/// 行为零变更(create_task 扩展参数 + 7 新工具,基线测试 test_build_ai_tool_registry_baseline_tool_count 守护)。
fn register_data_tools(registry: &mut AiToolRegistry, db: &Arc<Database>) {
@@ -1148,6 +1152,136 @@ fn register_task_graph_tools(registry: &mut AiToolRegistry, db: &Arc<Database>)
})
})},
);
// ── add_project_service (Medium,设计 §2.3 + §五 + D10) ──
// 添加项目依赖的基础设施配置(数据库/缓存/MQ/API 等)。为 AI 执行任务时提供基础设施上下文:
// "这项目用了什么数据库、Redis 在哪、有没有 MQ"。
// service_type 白名单 + D10 凭证审查下沉 Repo::insert_validated(单一真相源,与 IPC
// add_project_service 同源)。
//
// ⚠️ D10 安全边界:config_json / endpoint / remark 不含敏感凭证(密码/密钥/Token)。
// Repo 层审查 password/secret/token/api_key 子串,命中即拒。凭证走环境变量。
registry.register(
"add_project_service", "为项目添加基础设施配置(为 AI 执行任务时提供\"用了什么数据库/缓存/MQ/API\"上下文)。参数:project_id(项目 ID)、name(服务名,如 主库/Redis 缓存)、service_type(类型,白名单 mysql/postgresql/sqlite/redis/mongodb/mq/api/other)、environment(环境 development/staging/production,默认 development)、endpoint(可选,连接地址 localhost:3306 或 URL,不含凭证)、config_json(可选,类型相关配置 JSON 字符串,如 {\"pool_size\":10},⚠️不含密码字段,凭证走环境变量)、remark(可选,备注)。返回新增完整记录。约束:service_type 白名单;D10 安全边界 config_json/endpoint/remark 含 password/secret/token/api_key 子串拒绝",
df_ai::ai_tools::object_schema(vec![
("project_id", "string", true),
("name", "string", true),
("service_type", "string", true),
("environment", "string", false),
("endpoint", "string", false),
("config_json", "string", false),
("remark", "string", false),
]),
RiskLevel::Medium,
{ let db = db.clone(); Box::new(move |args: serde_json::Value| {
let db = db.clone();
Box::pin(async move {
let project_id = args["project_id"].as_str()
.ok_or_else(|| anyhow::anyhow!("缺少 project_id"))?
.trim()
.to_string();
let name = args["name"].as_str()
.ok_or_else(|| anyhow::anyhow!("缺少 name"))?
.trim()
.to_string();
let service_type = args["service_type"].as_str()
.ok_or_else(|| anyhow::anyhow!("缺少 service_type"))?
.trim()
.to_string();
if project_id.is_empty() {
anyhow::bail!("project_id 不能为空");
}
if name.is_empty() {
anyhow::bail!("name 不能为空");
}
if service_type.is_empty() {
anyhow::bail!("service_type 不能为空");
}
let endpoint = args.get("endpoint")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|s| !s.is_empty())
.map(|s| s.to_string());
let config_json = args.get("config_json")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|s| !s.is_empty())
.map(|s| s.to_string());
let environment = args.get("environment")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|s| !s.is_empty())
.unwrap_or("development")
.to_string();
let remark = args.get("remark")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|s| !s.is_empty())
.map(|s| s.to_string());
let record = ProjectServiceRecord {
id: new_id(),
project_id: project_id.clone(),
name,
service_type,
endpoint,
config_json,
environment,
remark,
created_at: now_millis(),
updated_at: now_millis(),
};
let repo = df_storage::crud::ProjectServiceRepo::new(&db);
// insert_validated 内含 service_type 白名单 + D10 凭证审查(密码/token/api_key 子串拒绝)。
let id = repo.insert_validated(record).await?;
let inserted = repo.get_by_id(&id).await?
.ok_or_else(|| anyhow::anyhow!("插入后回读失败"))?;
Ok(serde_json::to_value(&inserted)?)
})
})},
);
// ── list_project_services (Low 只读,设计 §2.3 + §五) ──
// 查询项目基础设施配置。AI 执行任务时按需取基础设施上下文:
// 部署 production 任务只取 production 服务,开发调试取 development(环境隔离避免误连生产库)。
registry.register(
"list_project_services", "查询项目基础设施配置(AI 执行任务时取\"用了什么数据库/缓存/MQ/API\"上下文)。参数:project_id(项目 ID)、environment(可选,按环境过滤 development/staging/production,空=返回所有环境)。返回 { items: 配置列表(时间倒序), total, project_id }。环境隔离:production 部署任务取 production 服务,开发调试取 development,避免误连生产库",
df_ai::ai_tools::object_schema(vec![
("project_id", "string", true),
("environment", "string", false),
]),
RiskLevel::Low,
{ let db = db.clone(); Box::new(move |args: serde_json::Value| {
let db = db.clone();
Box::pin(async move {
let project_id = args["project_id"].as_str()
.ok_or_else(|| anyhow::anyhow!("缺少 project_id"))?
.trim()
.to_string();
if project_id.is_empty() {
anyhow::bail!("project_id 不能为空");
}
let env_filter = args.get("environment")
.and_then(|v| v.as_str())
.map(str::trim)
.filter(|s| !s.is_empty())
.map(|s| s.to_string());
let repo = df_storage::crud::ProjectServiceRepo::new(&db);
let items = if let Some(env) = &env_filter {
repo.list_by_project_env(&project_id, env).await?
} else {
repo.list_by_project(&project_id).await?
};
let total = items.len();
Ok(serde_json::json!({
"items": items,
"total": total,
"project_id": project_id,
}))
})
})},
);
}
/// 抽自 register_data_tools(SMELL-P0-2 续拆),【原样移入】,零行为变更。
@@ -2830,7 +2964,7 @@ mod tests {
// 任一层漏移 register 调用,此测试立即红。工具名集合也断言,防 rename 致 LLM tool 突变。
// ============================================================
/// build_ai_tool_registry 应注册恰好 39 个工具(25 data + 13 file + 1 http),且工具名集合稳定。
/// build_ai_tool_registry 应注册恰好 41 个工具(27 data + 13 file + 1 http),且工具名集合稳定。
///
/// 用 in-memory SQLite(Database::open_in_memory 自跑迁移),构造零外部依赖的 db,
// 不实际执行任何 handler——仅断言注册阶段的定义完整性,故无需真实数据。
@@ -2843,7 +2977,7 @@ mod tests {
let allowed_dirs = Arc::new(RwLock::new(AllowedDirs::default_with_root()));
let registry = build_ai_tool_registry(&db, &allowed_dirs);
// 总量基线:39(25 data + 13 file + 1 http)。拆分前后必须一致。
// 总量基线:41(27 data + 13 file + 1 http)。拆分前后必须一致。
// F-260621: file 层 10→11(新增 grep 跨文件内容搜索工具)。
// L1 环境感知(设计 §2.1): file 层 11→12(新增 detect_environment 环境探测工具)。
// AST 代码智能(7c2e3b2): file 层 12→13(新增 read_symbol 符号解析,治 read_file 全文回灌 prompt 爆)。
@@ -2851,18 +2985,20 @@ mod tests {
// create_task_link/remove_task_link/list_task_links/get_task_tree/move_task_queue/update_content)。
// 知识图谱 Phase 2(2026-06-26): data 层 24→25(新增 get_project_timeline 项目事件流查询,
// register_task_graph_tools 6→7)。
// 知识图谱 Phase 3(2026-06-27): data 层 25→27(新增 add_project_service/list_project_services
// 项目基础设施配置 D10 不存凭证,register_task_graph_tools 7→9)。
assert_eq!(
registry.len(),
39,
"工具总数应为 39(25 data + 13 file + 1 http),实际 {}", registry.len()
41,
"工具总数应为 41(27 data + 13 file + 1 http),实际 {}", registry.len()
);
// 工具名集合基线:防 rename / 漏注册 / 误删除。
// data 层 25 个(持 db):CRUD/状态机/工作流/知识图谱任务关联 + 项目事件流
// data 层 27 个(持 db):CRUD/状态机/工作流/知识图谱任务关联 + 项目事件流 + 基础设施配置
// file 层 13 个(不持 db):命令/读/列/写/改/元/追加/删/移/搜/grep/环境探测/符号解析
// http 层 1 个(不持 db):http_request
let mut expected: Vec<&str> = vec![
// ── data 层 (25) ──
// ── data 层 (27) ──
"list_projects", "list_tasks", "list_ideas",
"update_project", "create_project", "bind_directory",
"create_task", "update_task", "advance_task",
@@ -2874,6 +3010,8 @@ mod tests {
"get_task_tree", "move_task_queue", "update_content",
// 知识图谱 Phase 2 项目事件流(register_task_graph_tools 7 个,本工具为第 7)
"get_project_timeline",
// 知识图谱 Phase 3 项目基础设施配置(register_task_graph_tools 9 个,9/10 为这 2 工具)
"add_project_service", "list_project_services",
// ── file 层 (13) ──（run_command 注册顺序已移至末位降低 LLM 偏好,
// 集合断言经 sort 后与顺序无关,仅守护工具名不漂移。grep 新增 F-260621;
// detect_environment 新增 L1 环境感知 设计 §2.1;read_symbol 新增 AST 代码智能）
@@ -3565,4 +3703,132 @@ mod tests {
// 空字符串 pattern 不合法(handler 内 bail,此处锁定 regex 接受空但 handler 显式拒)
assert!(regex::Regex::new("").is_ok(), "regex 接受空串,handler 层显式 bail 空 pattern");
}
// ============================================================
// 知识图谱 Phase 3(2026-06-27):add_project_service / list_project_services
// AI 工具 handler 端到端串联测试(经 registry.execute 验证参数装配 → Repo 落库 → 回读)。
// service_type 白名单 + D10 凭证审查下沉 Repo 层(已在 project_service_repo.rs 单元测试覆盖),
// 此处锁定 AI handler 的参数装配 / 调用路径正确(防 handler 拼参错位 / 漏调 insert_validated)。
// ============================================================
/// 造占位项目(project_services.project_id FK 要求 projects 存在)+ registry fixture。
async fn setup_services_registry() -> (Arc<Database>, AiToolRegistry) {
let db = Database::open_in_memory().await.expect("in-memory db");
let db = Arc::new(db);
// 占位 project 满足 FK
let repo = df_storage::crud::ProjectRepo::new(&db);
repo.insert(ProjectRecord {
id: "proj-svc-1".to_string(),
name: "proj-svc-1".to_string(),
description: String::new(),
status: "planning".to_string(),
idea_id: None,
path: None,
stack: None,
created_at: now_millis(),
updated_at: now_millis(),
})
.await
.unwrap();
let allowed_dirs = Arc::new(RwLock::new(AllowedDirs::default_with_root()));
let registry = build_ai_tool_registry(&db, &allowed_dirs);
(db, registry)
}
/// add_project_service 正常路径:合法 service_type + 无凭证 → 落库 + 回读完整记录。
#[tokio::test]
async fn test_add_project_service_tool_inserts() {
let (_db, registry) = setup_services_registry().await;
let args = serde_json::json!({
"project_id": "proj-svc-1",
"name": "主库",
"service_type": "mysql",
"environment": "production",
"endpoint": "localhost:3306",
"config_json": "{\"pool_size\":10}",
"remark": "主库"
});
let res = registry
.execute("add_project_service", args)
.await
.expect("add_project_service 执行失败");
assert_eq!(res["project_id"], "proj-svc-1");
assert_eq!(res["name"], "主库");
assert_eq!(res["service_type"], "mysql");
assert_eq!(res["environment"], "production");
assert_eq!(res["endpoint"], "localhost:3306");
assert!(res["id"].as_str().is_some(), "应返回生成的 id");
}
/// add_project_service D10 安全边界:config_json 含 password → handler 返 Err(不落库)。
#[tokio::test]
async fn test_add_project_service_tool_rejects_credential() {
let (db, registry) = setup_services_registry().await;
let args = serde_json::json!({
"project_id": "proj-svc-1",
"name": "主库",
"service_type": "mysql",
"config_json": "{\"password\":\"secret123\"}"
});
let err = registry.execute("add_project_service", args).await;
assert!(err.is_err(), "config_json 含 password 应被 D10 拒绝");
// 未落库
let repo = df_storage::crud::ProjectServiceRepo::new(&db);
let all = repo.list_by_project("proj-svc-1").await.unwrap();
assert!(all.is_empty(), "拒绝后不应有记录");
}
/// list_project_services 查询:插 2 条(不同环境)→ 不带 environment 返回全部,
/// 带 environment 仅返回匹配。
#[tokio::test]
async fn test_list_project_services_tool_filters_environment() {
let (_db, registry) = setup_services_registry().await;
// 插 development + production 各 1 条
for (st, env) in [("mysql", "development"), ("redis", "production")] {
registry
.execute(
"add_project_service",
serde_json::json!({
"project_id": "proj-svc-1",
"name": format!("svc-{env}"),
"service_type": st,
"environment": env,
}),
)
.await
.unwrap();
}
// 不带 environment:返回全部 2 条
let all = registry
.execute(
"list_project_services",
serde_json::json!({ "project_id": "proj-svc-1" }),
)
.await
.unwrap();
assert_eq!(all["total"], 2);
assert_eq!(all["items"].as_array().unwrap().len(), 2);
// 仅 development:1 条
let dev = registry
.execute(
"list_project_services",
serde_json::json!({ "project_id": "proj-svc-1", "environment": "development" }),
)
.await
.unwrap();
assert_eq!(dev["total"], 1);
assert_eq!(dev["items"][0]["environment"], "development");
assert_eq!(dev["items"][0]["service_type"], "mysql");
// 不存在的环境:0 条
let staging = registry
.execute(
"list_project_services",
serde_json::json!({ "project_id": "proj-svc-1", "environment": "staging" }),
)
.await
.unwrap();
assert_eq!(staging["total"], 0);
}
}