绝尘
f217e39bfe
依据 F-260619-02 设计,对外暴露数据层接入 Claude Code/Cursor: - 新建 df-mcp crate:JSON-RPC 2.0 over stdio(initialize/tools/list/tools/call) - 暴露 19 数据层工具(项目/任务/灵感/工作流/回收站),复用 df-storage Repo 零重复 CRUD - 三层安全降级:High 风险(delete/purge/run_workflow)tools/list 不暴露+dispatch 拒+handler 二次拒;Medium 允许+审计日志;--read-only 仅 Low - 不暴露文件系统工具(防绕过应用内路径校验) - Tauri CLI 子命令 devflow mcp-server [--db/--read-only/--print-config] - SQLite WAL 已启用(复用 Database::open),应用与 MCP server 并发写安全 自验: df-mcp 8 passed + workspace EXIT 0
50 lines
1.8 KiB
TOML
50 lines
1.8 KiB
TOML
[package]
|
|
name = "devflow"
|
|
version = "0.1.0"
|
|
description = "DevFlow Desktop App"
|
|
authors = [""]
|
|
edition = "2021"
|
|
|
|
[lib]
|
|
name = "devflow_lib"
|
|
crate-type = ["staticlib", "cdylib", "rlib"]
|
|
|
|
[build-dependencies]
|
|
tauri-build = { version = "2", features = [] }
|
|
|
|
[dependencies]
|
|
tauri = { version = "2", features = [] }
|
|
tauri-plugin-dialog = "2"
|
|
tauri-plugin-opener = "2"
|
|
tauri-plugin-window-state = "2"
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
tokio.workspace = true
|
|
anyhow.workspace = true
|
|
tracing.workspace = true
|
|
chrono.workspace = true
|
|
|
|
# 后端 crate
|
|
df-types = { path = "../crates/df-types" }
|
|
df-storage = { path = "../crates/df-storage" }
|
|
df-workflow = { path = "../crates/df-workflow" }
|
|
df-nodes = { path = "../crates/df-nodes" }
|
|
df-execute = { path = "../crates/df-execute" }
|
|
df-ai = { path = "../crates/df-ai" }
|
|
df-ideas = { path = "../crates/df-ideas" }
|
|
df-project = { path = "../crates/df-project" }
|
|
df-mcp = { path = "../crates/df-mcp" }
|
|
futures = "0.3"
|
|
# write_file base64 编码:写二进制/非 UTF-8 文件(图片/PDF/Excel 等)
|
|
base64 = "0.22"
|
|
# validate_path URL 解码:防 %2e%2e 等 URL 编码绕过路径遍历检查(BUG-260617-03)
|
|
percent-encoding = "2"
|
|
# keyring:密钥解析下沉到 df-storage(workspace 统一声明平台 feature),
|
|
# src-tauri 经 workspace 引用(转发壳 build_provider_for 不直接碰 keyring,但旧路径/兼容保留)。
|
|
# 根因见 docs/09-问题排查/aichat-apikey-401排查-2026-06-15.md
|
|
keyring = { workspace = true }
|
|
# http_request AI 工具:结构化 HTTP(GET/POST/...)。
|
|
# 复用 df-ai 同款 reqwest 0.12(同版本锁定,避免双 TLS 后端)。默认 native-tls(与 df-ai 一致),
|
|
# 启用 json(响应解析)/gzip/brotli(透明解压,常见 API 必备)。重定向手动接管(见 http.rs SSRF)。
|
|
reqwest = { version = "0.12", features = ["json", "gzip", "brotli"] }
|