feat: add tgo-device-agent and update RAG service configuration

- Implement `tgo-device-agent` in Go, providing file operations (read/write/edit) and shell execution tools for AI agents via TCP JSON-RPC 2.0.
- Add security sandbox for `tgo-device-agent` with path whitelisting and command blacklisting.
- Update `tgo-rag` service to support configurable default QA mode and change its default port to 18082 to avoid conflicts.
- Remove obsolete `docs/GET_REAL_IP.md` and update environment templates.

Author: tangtaoit

.env.dev.example

@@ -60,7 +60,7 @@ TGO_WIDGET_PORT=5174
 # ==========================================================
 API_SERVICE_URL=http://localhost:8000
 AI_SERVICE_URL=http://localhost:8081
-RAG_SERVICE_URL=http://localhost:8082
+RAG_SERVICE_URL=http://localhost:18082
 PLATFORM_SERVICE_URL=http://localhost:8003
 WORKFLOW_SERVICE_URL=http://localhost:8004
 PLUGIN_RUNTIME_URL=http://localhost:8090

Makefile

@@ -37,7 +37,7 @@ WIDGET_DIR := repos/tgo-widget-app
 # Development ports (to avoid conflicts)
 API_PORT := 8000
 AI_PORT := 8081
-RAG_PORT := 8082
+RAG_PORT := 18082
 PLATFORM_PORT := 8003
 WORKFLOW_PORT := 8004
 PLUGIN_PORT := 8090

docs/GET_REAL_IP.md

@@ -0,0 +1,32 @@
+# Binaries
+tgo-device-agent
+*.exe
+*.dll
+*.so
+*.dylib
+
+# Build output
+/bin/
+/dist/
+/build/
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Config with secrets
+configs/config.json
+*.env
+
+# Token files
+device_token
+
+# Build artifacts
+*.out

repos/tgo-device-agent/.gitignore

@@ -0,0 +1,49 @@
+# tgo-device-agent – AI Agent Guide
+
+## 概述
+
+`tgo-device-agent` 是一个 Go 编写的被控端程序，运行在受管设备上，通过 TCP JSON-RPC 2.0 协议连接到 `tgo-device-control` 服务。它向 AI Agent 暴露文件读写和 Shell 执行等工具能力。
+
+## 架构
+
+```
+cmd/agent/main.go          → 入口：CLI 参数解析、信号处理、启动 Client
+internal/config/config.go  → 配置结构与加载
+internal/protocol/         → JSON-RPC 2.0 消息类型（auth、tools/list、tools/call）
+internal/transport/client.go → TCP 客户端：连接、认证、心跳、重连、消息派发
+internal/tools/registry.go → 工具注册中心
+internal/tools/fs_read.go  → fs_read 工具
+internal/tools/fs_write.go → fs_write 工具
+internal/tools/fs_edit.go  → fs_edit 工具
+internal/tools/shell_exec.go → shell_exec 工具
+internal/sandbox/sandbox.go → 安全沙箱：路径验证、命令过滤
+```
+
+## 核心协议
+
+- 协议基础文档: `../tgo-device-control/docs/json-rpc.md`
+- 消息格式: 换行符分隔的 JSON (`\n`-delimited JSON)
+- 认证方法: `auth` (bindCode 或 deviceToken)
+- 设备主动上报: `tools/list` 响应、`pong` 心跳
+- 服务端下发: `tools/call`、`ping`
+
+## 关键接口
+
+### Tool 接口 (internal/tools/registry.go)
+
+```go
+type Tool interface {
+    Name() string
+    Definition() protocol.ToolDefinition
+    Execute(ctx context.Context, args map[string]interface{}) *protocol.ToolCallResult
+}
+```
+
+添加新工具时实现此接口并在 `NewRegistry()` 中调用 `r.Register()`。
+
+## 开发注意事项
+
+1. **不使用外部依赖** – 当前版本仅使用 Go 标准库。
+2. **类型安全** – 所有 JSON-RPC 消息均有对应的 Go struct，不使用 `interface{}`（工具参数除外，因为 MCP 规范要求动态 schema）。
+3. **安全优先** – 所有文件/命令操作必须经过 sandbox 验证。
+4. **幂等重连** – TCP 断线后自动重连，DeviceToken 持久化确保身份不变。

repos/tgo-device-agent/AGENTS.md

@@ -0,0 +1,28 @@
+FROM golang:1.22-alpine AS builder
+
+WORKDIR /build
+
+COPY go.mod ./
+# COPY go.sum ./  # uncomment when external dependencies are added
+# RUN go mod download
+
+COPY . .
+
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /tgo-device-agent ./cmd/agent/
+
+# ----
+FROM alpine:3.19
+
+RUN apk add --no-cache ca-certificates bash
+
+COPY --from=builder /tgo-device-agent /usr/local/bin/tgo-device-agent
+
+RUN mkdir -p /workspace && \
+    adduser -D -h /workspace agent && \
+    chown agent:agent /workspace
+
+USER agent
+WORKDIR /workspace
+
+ENTRYPOINT ["tgo-device-agent"]
+CMD ["--help"]

repos/tgo-device-agent/Dockerfile

@@ -0,0 +1,36 @@
+APP_NAME := tgo-device-agent
+VERSION  := 1.0.0
+GO       := go
+GOFLAGS  := -ldflags="-s -w -X main.version=$(VERSION)"
+BIN_DIR  := bin
+
+.PHONY: all build clean vet test run
+
+all: build
+
+build:
+	@mkdir -p $(BIN_DIR)
+	$(GO) build $(GOFLAGS) -o $(BIN_DIR)/$(APP_NAME) ./cmd/agent/
+
+build-linux:
+	@mkdir -p $(BIN_DIR)
+	GOOS=linux GOARCH=amd64 $(GO) build $(GOFLAGS) -o $(BIN_DIR)/$(APP_NAME)-linux-amd64 ./cmd/agent/
+
+build-darwin:
+	@mkdir -p $(BIN_DIR)
+	GOOS=darwin GOARCH=arm64 $(GO) build $(GOFLAGS) -o $(BIN_DIR)/$(APP_NAME)-darwin-arm64 ./cmd/agent/
+
+vet:
+	$(GO) vet ./...
+
+test:
+	$(GO) test -v -race ./...
+
+clean:
+	rm -rf $(BIN_DIR)
+
+run: build
+	$(BIN_DIR)/$(APP_NAME) --server localhost:9876 --bind-code TEST123 --log-level debug
+
+docker-build:
+	docker build -t $(APP_NAME):$(VERSION) .