第十六章：Webhook 与外部事件

// 来自 packages/webhook/webhook/src/index.ts（概念性）
class WebhookVerifier {
  /** 验证签名 */
  verify(payload: string, signature: string, secret: string): boolean {
    // 计算期望的签名
    const expectedSignature = crypto
      .createHmac('sha256', secret)
      .update(payload)
      .digest('hex')
    
    // 比较签名
    return crypto.timingSafeEqual(
      Buffer.from(signature),
      Buffer.from(expectedSignature)
    )
  }
}

// 来自 packages/webhook/webhook/src/index.ts（概念性）
interface WebhookRule {
  /** 规则名称 */
  name: string
  /** 匹配条件 */
  match: {
    /** 来源 */
    source?: string  // 'github' | 'gitlab' | 'custom'
    /** 事件类型 */
    eventType?: string
    /** 路径模式 */
    pathPattern?: string
  }
  /** 触发的行为 */
  action: {
    /** Agent 预设 */
    agentPreset?: string
    /** 系统提示 */
    systemPrompt?: string
    /** 工具限制 */
    allowedTools?: string[]
  }
}

# cordis.patch.yml
- id: webhook
  config:
    # 可信规则
    rules:
      - name: 'github-push'
        match:
          source: 'github'
          eventType: 'push'
        action:
          agentPreset: 'code-reviewer'
          systemPrompt: 'Review the pushed changes'
          allowedTools:
            - 'file_read'
            - 'bash'
      
      - name: 'github-issue'
        match:
          source: 'github'
          eventType: 'issues'
        action:
          agentPreset: 'issue-handler'
          systemPrompt: 'Handle the new issue'
    
    # 端点配置
    endpoint:
      port: 3001
      path: '/webhook'
    
    # 签名密钥
    secrets:
      github: '${GITHUB_WEBHOOK_SECRET}'
      gitlab: '${GITLAB_WEBHOOK_SECRET}'

// 来自 packages/webhook/webhook/src/index.ts（概念性）
class WebhookRuntime {
  /** 处理 Webhook 事件 */
  async handleEvent(event: WebhookEvent): Promise<void> {
    // 1. 验证签名
    const isValid = this.verifier.verify(
      event.payload,
      event.signature,
      this.getSecret(event.source)
    )
    
    if (!isValid) {
      throw new Error('Invalid webhook signature')
    }
    
    // 2. 匹配规则
    const rule = this.matchRule(event)
    if (!rule) {
      console.log('No matching rule for event')
      return
    }
    
    // 3. 创建 Workspace Session
    const session = await this.createWorkspaceSession(event, rule)
    
    // 4. 触发 Agent
    await this.triggerAgent(session, rule)
  }
  
  /** 创建 Workspace Session */
  private async createWorkspaceSession(
    event: WebhookEvent,
    rule: WebhookRule
  ): Promise<Session> {
    return this.ctx.agents.create({
      sessionId: generateSessionId(),
      meta: {
        origin: 'webhook',
        cwd: '/workspace'
      }
    })
  }
}

# .github/workflows/dsh-webhook.yml
name: DSH Webhook
on:
  push:
    branches: [main]
  pull_request:
    types: [opened, synchronize]

jobs:
  trigger-dsh:
    runs-on: ubuntu-latest
    steps:
      - name: Trigger DSH Webhook
        run: |
          curl -X POST \
            -H "Content-Type: application/json" \
            -H "X-Hub-Signature-256: sha256=${{ secrets.WEBHOOK_SIGNATURE }}" \
            -d '{"event": "push", "ref": "${{ github.ref }}"}' \
            https://your-dsh-instance.com/webhook

# .gitlab-ci.yml
stages:
  - trigger

trigger-dsh:
  stage: trigger
  script:
    - |
      curl -X POST \
        -H "Content-Type: application/json" \
        -H "X-Gitlab-Token: ${WEBHOOK_SECRET}" \
        -d '{"event": "push", "ref": "${CI_COMMIT_REF_NAME}"}' \
        https://your-dsh-instance.com/webhook
  only:
    - main

// 确保使用 timing-safe 比较
function timingSafeEqual(a: Buffer, b: Buffer): boolean {
  if (a.length !== b.length) return false
  
  let result = 0
  for (let i = 0; i < a.length; i++) {
    result |= a[i] ^ b[i]
  }
  
  return result === 0
}

// 概念性描述
class RateLimiter {
  private requests = new Map<string, number[]>()
  
  /** 检查速率限制 */
  check(source: string, limit: number, window: number): boolean {
    const now = Date.now()
    const timestamps = this.requests.get(source) ?? []
    
    // 清理过期的请求
    const validTimestamps = timestamps.filter(t => now - t < window)
    
    if (validTimestamps.length >= limit) {
      return false  // 超过速率限制
    }
    
    validTimestamps.push(now)
    this.requests.set(source, validTimestamps)
    
    return true
  }
}

# cordis.patch.yml
- id: webhook
  config:
    # 端点
    endpoint:
      port: 3001
      path: '/webhook'
    
    # 签名验证
    verification:
      enabled: true
      tolerance: 300  # 5 分钟
    
    # 速率限制
    rateLimit:
      enabled: true
      limit: 100
      window: 60000  # 1 分钟
    
    # 会话配置
    session:
      autoCleanup: true
      maxAge: 3600000  # 1 小时