@actiondock/cli 2.4.0 → 2.5.0

package/dist/commands/runs.js

@@ -1,7 +1,7 @@
 import { filterWithFallbackInfo, findProjectRoot, listLinkedPackages, loadProjectConfig, resolvePackageRoot, resolveTarget, } from "@actiondock/core";
 import { ArgumentError, ExecutionError } from "../errors.js";
 import { renderResult, renderRunDetail, renderRunsList } from "../renderer.js";
-import { getEffectiveOptions, resolveIntent, withRemoteTarget, withTarget } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, resolveIntent, withRemoteTarget, withTarget, } from "../utils/index.js";
 /**
  * 解析本地目标包根目录与工程配置（仅在 local 分支调用）。
  * 显式指定包且寻址失败时抛出参数错误；工程清单损坏时降级为链接包视图。
@@ -43,16 +43,13 @@ export function registerRunsCommands(program, context) {
         .command("runs")
         .description("Inspect action execution history");
     // runs list
-    runsCmd
+    applyTargetOptions(runsCmd
         .command("list [patterns...]")
         .description("List recent execution records")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
         .option("-a, --action <actionId>", "Filter by action ID")
-        .option("-n, --limit <count>", "Maximum number of records to return", "20")
-        .option("-p, --profile <name>", "Query against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-n, --limit <count>", "Maximum number of records to return", "20"))
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
         .option("--data-dir <path>", "Custom database storage directory")
         .option("--json", "Output as JSON")
@@ -107,13 +104,10 @@ export function registerRunsCommands(program, context) {
         }, { localRoot: scope.targetPackageRoot, scanLinkedPackages: true });
     });
     // runs show <id>
-    runsCmd
+    applyTargetOptions(runsCmd
         .command("show <id>")
         .description("Show details of a specific execution run")
-        .option("-p, --profile <name>", "Query run against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
-        .option("-P, --package <id>", "Target package ID or path")
+        .option("-P, --package <id>", "Target package ID or path"))
         .option("--data-dir <path>", "Custom database storage directory")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
@@ -146,12 +140,9 @@ export function registerRunsCommands(program, context) {
         }, { localRoot: scope.targetPackageRoot, scanLinkedPackages: true });
     });
     // runs cancel
-    runsCmd
+    applyTargetOptions(runsCmd
         .command("cancel <id>")
-        .description("Cancel a running action execution on a remote server")
-        .option("-p, --profile <name>", "Execute cancel against a specific profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .description("Cancel a running action execution on a remote server"))
         .option("-r, --reason <reason>", "Reason for cancellation")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
@@ -164,6 +155,7 @@ export function registerRunsCommands(program, context) {
             profile: options.profile,
             server: options.server,
             token: options.token,
+            insecure: options.insecure,
         }, context?.customHome);
         if (resolved.type === "local") {
             throw new ArgumentError("'ad runs cancel' is only supported for remote execution targets. Use --profile <name> or --server <url>.");
@@ -191,14 +183,11 @@ export function registerRunsCommands(program, context) {
         });
     });
     // runs clear
-    runsCmd
+    applyTargetOptions(runsCmd
         .command("clear")
         .description("Clear execution run records")
         .option("-P, --package <id>", "Target package ID or path")
-        .option("-a, --action <actionId>", "Filter by action ID")
-        .option("-p, --profile <name>", "Target profile")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-a, --action <actionId>", "Filter by action ID"))
         .option("--data-dir <path>", "Custom database storage directory")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")

package/dist/commands/serve.js

@@ -1,8 +1,9 @@
+import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { findProjectRoot, formatHostForUrl, loadProjectConfig, startActionDockServer } from "@actiondock/core";
+import { findProjectRoot, formatHostForUrl, loadProjectConfig, startActionDockServer, } from "@actiondock/core";
 import { ArgumentError, ExecutionError } from "../errors.js";
 import { writeStderr, writeStdout } from "../renderer.js";
-import { getEffectiveOptions, parseByteSize } from "../utils/index.js";
+import { ensureSelfSignedCertificate, getEffectiveOptions, parseByteSize } from "../utils/index.js";
 /**
  * 注册 serve HTTP 服务启动命令。
  *
@@ -23,6 +24,11 @@ export function registerServeCommand(program, context) {
         .option("--no-mcp", "Disable unified MCP protocol endpoint at /mcp")
         .option("--allow-query-token", "Allow passing authentication token via URL query parameter (?token=xxx)")
         .option("--management", "Enable config and state management API endpoints (disabled by default for security)")
+        .option("--https", "Enable native HTTPS transport (auto-generates self-signed certificate if none provided)")
+        .option("--tls-cert <path>", "Path to TLS certificate file (or set ACTIONDOCK_TLS_CERT)")
+        .option("--tls-key <path>", "Path to TLS private key file (or set ACTIONDOCK_TLS_KEY)")
+        .option("--tls-ca <path>", "Path to TLS CA certificate file (or set ACTIONDOCK_TLS_CA)")
+        .option("--tls-passphrase <passphrase>", "Passphrase for TLS private key (or set ACTIONDOCK_TLS_PASSPHRASE)")
         .option("-d, --dir <path>", "Project root directory (default: current working directory)")
         .action(async (rawOptions, cmd) => {
         const options = getEffectiveOptions(rawOptions, cmd);
@@ -34,6 +40,45 @@ export function registerServeCommand(program, context) {
         const enableManagement = Boolean(options.management);
         const corsOrigins = options.corsOrigin && options.corsOrigin.length > 0 ? options.corsOrigin : undefined;
         const exposeDebugInfo = Boolean(options.exposeDebugInfo);
+        const httpsEnabled = Boolean(options.https ||
+            options.tlsCert ||
+            options.tlsKey ||
+            process.env?.ACTIONDOCK_HTTPS === "true" ||
+            process.env?.ACTIONDOCK_HTTPS === "1" ||
+            process.env?.ACTIONDOCK_TLS_CERT ||
+            process.env?.ACTIONDOCK_TLS_KEY);
+        let tls;
+        if (httpsEnabled) {
+            const certPath = options.tlsCert || (typeof process !== "undefined" ? process.env?.ACTIONDOCK_TLS_CERT : undefined);
+            const keyPath = options.tlsKey || (typeof process !== "undefined" ? process.env?.ACTIONDOCK_TLS_KEY : undefined);
+            const caPath = options.tlsCa || (typeof process !== "undefined" ? process.env?.ACTIONDOCK_TLS_CA : undefined);
+            const passphrase = options.tlsPassphrase || (typeof process !== "undefined" ? process.env?.ACTIONDOCK_TLS_PASSPHRASE : undefined);
+            if (certPath && keyPath) {
+                try {
+                    tls = {
+                        certPath: resolve(certPath),
+                        keyPath: resolve(keyPath),
+                        ca: caPath ? readFileSync(resolve(caPath), "utf-8") : undefined,
+                        passphrase,
+                    };
+                }
+                catch (err) {
+                    throw new ArgumentError(`Failed to read TLS certificate/key files: ${err.message}`);
+                }
+            }
+            else if (certPath || keyPath) {
+                throw new ArgumentError("Both --tls-cert and --tls-key must be provided together");
+            }
+            else {
+                const selfSigned = await ensureSelfSignedCertificate({ host });
+                tls = {
+                    cert: selfSigned.cert,
+                    key: selfSigned.key,
+                    certPath: selfSigned.certPath,
+                    keyPath: selfSigned.keyPath,
+                };
+            }
+        }
         let maxBodyBytes;
         if (options.maxBody) {
             try {
@@ -95,18 +140,24 @@ export function registerServeCommand(program, context) {
                 enableMcp,
                 enableManagement,
                 mcpHandler,
+                tls,
                 projectRoot: projectRoot || undefined,
             });
             const displayHost = formatHostForUrl(host);
             const actualEndpointHost = formatHostForUrl(host === "0.0.0.0" ? "127.0.0.1" : host);
+            const scheme = tls ? "https" : "http";
             writeStdout(`\n======================================================`, context);
             writeStdout(`  ActionDock 2.0 HTTP Runner Server`, context);
             writeStdout(`======================================================`, context);
-            writeStdout(`  * Listening on:    http://${displayHost}:${server.port}`, context);
+            writeStdout(`  * Listening on:    ${scheme}://${displayHost}:${server.port}`, context);
             writeStdout(`  * Project:         ${projectName}`, context);
             if (projectRoot && exposeDebugInfo) {
                 writeStdout(`  * Root Path:       ${projectRoot}`, context);
             }
+            if (tls) {
+                const tlsDesc = tls.certPath ? `Enabled (${tls.certPath})` : "Enabled (Self-Signed)";
+                writeStdout(`  * TLS / HTTPS:     ${tlsDesc}`, context);
+            }
             const authDesc = token
                 ? (allowQueryToken ? "Bearer Token / Query Token Enabled" : "Bearer Token Enabled (Query Token Disabled)")
                 : "Disabled (Public/Local)";
@@ -114,9 +165,9 @@ export function registerServeCommand(program, context) {
             writeStdout(`  * Management APIs: ${enableManagement ? "Enabled" : "Disabled (Default)"}`, context);
             writeStdout(`  * CORS Origins:    ${corsOrigins ? corsOrigins.join(", ") : "Disabled (Default)"}`, context);
             writeStdout(`  * Max Body Size:   ${options.maxBody || "1mb"}`, context);
-            writeStdout(`  * Health Endpoint: http://${actualEndpointHost}:${server.port}/api/v1/health`, context);
+            writeStdout(`  * Health Endpoint: ${scheme}://${actualEndpointHost}:${server.port}/api/v1/health`, context);
             if (enableMcp) {
-                writeStdout(`  * MCP Endpoint:    http://${actualEndpointHost}:${server.port}/mcp`, context);
+                writeStdout(`  * MCP Endpoint:    ${scheme}://${actualEndpointHost}:${server.port}/mcp`, context);
             }
             writeStdout(`======================================================\n`, context);
             writeStdout(`Server is ready to accept remote requests.`, context);

package/dist/commands/state.js

@@ -1,7 +1,7 @@
 import { decodeStateKey, findProjectRoot, loadProjectConfig, resolvePackageRoot, } from "@actiondock/core";
 import { ArgumentError, ExecutionError } from "../errors.js";
 import { renderResult, renderStateList, writeStdout } from "../renderer.js";
-import { getEffectiveOptions, getTargetRoot, resolveIntent, withTarget } from "../utils/index.js";
+import { applyTargetOptions, getEffectiveOptions, getTargetRoot, resolveIntent, withTarget, } from "../utils/index.js";
 import { renderLinkedPackagesStateList, renderProjectScopedStateList, } from "./state-list.js";
 /**
  * 注册 state 状态管理命令（get、set、delete、clear、keys、list）。
@@ -70,15 +70,12 @@ export function registerStateCommands(program, context) {
         });
     };
     // state list
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("list [prefix]")
         .description("List state keys in current project or linked packages")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-a, --action <id>", "Action identifier scope")
-        .option("-n, --namespace <ns>", "Filter keys under specific namespace (omit to list all namespaces)")
-        .option("-p, --profile <name>", "Query state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-n, --namespace <ns>", "Filter keys under specific namespace (omit to list all namespaces)"))
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter; falls back to full list when no match")
         .option("--detail", "Include metadata (ttl, expiresAt, size, updatedAt) in JSON output")
         .option("--no-fallback", "Disable fallback to full list when no items match intent")
@@ -87,15 +84,12 @@ export function registerStateCommands(program, context) {
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(handleListKeys);
     // state keys 别名
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("keys [prefix]")
         .description("Alias for 'ad state list [prefix]'")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-a, --action <id>", "Action identifier scope")
-        .option("-n, --namespace <ns>", "Filter keys under specific namespace")
-        .option("-p, --profile <name>", "Query state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-n, --namespace <ns>", "Filter keys under specific namespace"))
         .option("-i, --intent <pattern>", "Regex or fuzzy intent filter")
         .option("--detail", "Include metadata in JSON output")
         .option("--no-fallback", "Disable fallback")
@@ -104,15 +98,12 @@ export function registerStateCommands(program, context) {
         .option("--envelope", "Wrap JSON output in standard envelope")
         .action(handleListKeys);
     // state get <key>
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("get <key>")
         .description("Get state value by key (supports composite 'ns:key' and detail mode)")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-a, --action <id>", "Action identifier scope")
-        .option("-n, --namespace <ns>", "Explicit namespace scope for key")
-        .option("-p, --profile <name>", "Query state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-n, --namespace <ns>", "Explicit namespace scope for key"))
         .option("--data-dir <path>", "Custom database storage directory")
         .option("--json", "Output as JSON")
         .option("--envelope", "Wrap JSON output in standard envelope")
@@ -164,16 +155,13 @@ export function registerStateCommands(program, context) {
         }, { localRoot: () => getTargetRoot(options.package, rawKey).root });
     });
     // state set <key> <value>
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("set <key> <value>")
         .description("Set state key-value (supports JSON value, composite 'ns:key', and --ttl)")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-a, --action <id>", "Action identifier scope")
         .option("-n, --namespace <ns>", "Explicit namespace scope for key")
-        .option("--ttl <seconds>", "Time-To-Live expiration in seconds")
-        .option("-p, --profile <name>", "Set state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("--ttl <seconds>", "Time-To-Live expiration in seconds"))
         .option("--data-dir <path>", "Custom database storage directory")
         .action(async (rawKey, rawVal, rawOptions, cmd) => {
         const options = getEffectiveOptions(rawOptions, cmd);
@@ -223,16 +211,13 @@ export function registerStateCommands(program, context) {
         }, { localRoot: () => getTargetRoot(options.package, rawKey).root });
     });
     // state delete <key>
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("delete <key>")
         .alias("rm")
         .description("Delete state key entry")
         .option("-P, --package <id>", "Target package ID or path")
         .option("-a, --action <id>", "Action identifier scope")
-        .option("-n, --namespace <ns>", "Explicit namespace scope for key")
-        .option("-p, --profile <name>", "Delete state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-n, --namespace <ns>", "Explicit namespace scope for key"))
         .option("--data-dir <path>", "Custom database storage directory")
         .action(async (rawKey, rawOptions, cmd) => {
         const options = getEffectiveOptions(rawOptions, cmd);
@@ -267,17 +252,14 @@ export function registerStateCommands(program, context) {
         }, { localRoot: () => getTargetRoot(options.package, rawKey).root });
     });
     // state clear
-    stateCmd
+    applyTargetOptions(stateCmd
         .command("clear")
         .alias("clean")
         .description("Clear state entries (supports namespace cleanup or global wipe via --all)")
         .option("-P, --package <id>", "Target package ID or path")
         .option("--action <id>", "Action identifier scope")
         .option("-n, --namespace <ns>", "Target namespace to clear (required unless --all is specified)")
-        .option("-a, --all", "Dangerously clear all state namespaces for the package")
-        .option("-p, --profile <name>", "Clear state on a remote target")
-        .option("-s, --server <url>", "Remote server URL")
-        .option("-t, --token <token>", "Auth token for remote server")
+        .option("-a, --all", "Dangerously clear all state namespaces for the package"))
         .option("--data-dir <path>", "Custom database storage directory")
         .action(async (rawOptions, cmd) => {
         const options = getEffectiveOptions(rawOptions, cmd);

package/dist/utils/cert.d.ts

@@ -0,0 +1,42 @@
+/**
+ * 证书与私钥数据对。
+ */
+export interface CertificatePair {
+    /** 证书 PEM 文本内容 */
+    cert: string;
+    /** 私钥 PEM 文本内容 */
+    key: string;
+    /** 证书物理文件路径 */
+    certPath: string;
+    /** 私钥物理文件路径 */
+    keyPath: string;
+}
+/**
+ * 收集自签名证书所需的 SAN (Subject Alternative Name) 扩展项列表。
+ * 全面支持 localhost、127.0.0.1、::1、系统主机名以及绑定 0.0.0.0 时的本机局域网 IP。
+ */
+export declare function collectSanEntries(bindHost?: string): Array<{
+    type: 2 | 7;
+    value?: string;
+    ip?: string;
+}>;
+/**
+ * 校验证书是否在有效期内且剩余天数大于设定阈值。
+ */
+export declare function isCertificateValid(certPem: string, minRemainingDays?: number): boolean;
+/**
+ * 校验证书是否涵盖目标主机名或 IP 地址。
+ * 读取 X509 证书的 subjectAltName，检验当前绑定主机是否已被该证书覆盖。
+ *
+ * @param certPem 证书 PEM 文本
+ * @param host 待校验的目标主机名或 IP 地址
+ */
+export declare function certificateCoversHost(certPem: string, host?: string): boolean;
+/**
+ * 自动加载或重新签发自签名证书。
+ * 遵循严格的存储路径规范、有效性校验与原子文件写入机制。
+ */
+export declare function ensureSelfSignedCertificate(options?: {
+    customHome?: string;
+    host?: string;
+}): Promise<CertificatePair>;

package/dist/utils/cert.js

@@ -0,0 +1,211 @@
+import { X509Certificate, randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { isIP } from "node:net";
+import { hostname, networkInterfaces } from "node:os";
+import { join } from "node:path";
+import { getActionDockHome } from "@actiondock/core";
+import { generate } from "selfsigned";
+/**
+ * 判定字符串是否为有效 IPv4 或 IPv6 地址。
+ */
+function isIpAddress(str) {
+    return isIP(str) !== 0;
+}
+/**
+ * 收集自签名证书所需的 SAN (Subject Alternative Name) 扩展项列表。
+ * 全面支持 localhost、127.0.0.1、::1、系统主机名以及绑定 0.0.0.0 时的本机局域网 IP。
+ */
+export function collectSanEntries(bindHost) {
+    const dnsSet = new Set();
+    const ipSet = new Set();
+    // 基础回环名称与 IP
+    dnsSet.add("localhost");
+    ipSet.add("127.0.0.1");
+    ipSet.add("::1");
+    // 系统主机名
+    const sysHostname = hostname();
+    if (sysHostname) {
+        if (isIpAddress(sysHostname)) {
+            ipSet.add(sysHostname);
+        }
+        else {
+            dnsSet.add(sysHostname);
+        }
+    }
+    // 显式指定的主机地址
+    if (bindHost && bindHost !== "0.0.0.0" && bindHost !== "::") {
+        if (isIpAddress(bindHost)) {
+            ipSet.add(bindHost);
+        }
+        else {
+            dnsSet.add(bindHost);
+        }
+    }
+    // 当绑定 0.0.0.0 或未指定时，枚举全部本机网络接口地址
+    if (!bindHost || bindHost === "0.0.0.0" || bindHost === "::") {
+        const interfaces = networkInterfaces();
+        for (const ifaceList of Object.values(interfaces)) {
+            if (!ifaceList)
+                continue;
+            for (const iface of ifaceList) {
+                if (!iface.address)
+                    continue;
+                let addr = iface.address;
+                const percentIdx = addr.indexOf("%");
+                if (percentIdx !== -1) {
+                    addr = addr.slice(0, percentIdx);
+                }
+                ipSet.add(addr);
+            }
+        }
+    }
+    const entries = [];
+    for (const dns of dnsSet) {
+        entries.push({ type: 2, value: dns });
+    }
+    for (const ip of ipSet) {
+        entries.push({ type: 7, ip });
+    }
+    return entries;
+}
+/**
+ * 校验证书是否在有效期内且剩余天数大于设定阈值。
+ */
+export function isCertificateValid(certPem, minRemainingDays = 7) {
+    try {
+        const x509 = new X509Certificate(certPem);
+        const validToMs = new Date(x509.validTo).getTime();
+        const minRemainingMs = minRemainingDays * 24 * 60 * 60 * 1000;
+        return validToMs - Date.now() > minRemainingMs;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 校验证书是否涵盖目标主机名或 IP 地址。
+ * 读取 X509 证书的 subjectAltName，检验当前绑定主机是否已被该证书覆盖。
+ *
+ * @param certPem 证书 PEM 文本
+ * @param host 待校验的目标主机名或 IP 地址
+ */
+export function certificateCoversHost(certPem, host) {
+    try {
+        const x509 = new X509Certificate(certPem);
+        const san = x509.subjectAltName;
+        if (!san) {
+            return false;
+        }
+        const dnsNames = new Set();
+        const ipAddresses = new Set();
+        const parts = san.split(",").map((s) => s.trim());
+        for (const part of parts) {
+            if (part.startsWith("DNS:")) {
+                dnsNames.add(part.slice(4).trim().toLowerCase());
+            }
+            else if (part.startsWith("IP Address:")) {
+                ipAddresses.add(part.slice(11).trim().toLowerCase());
+            }
+        }
+        // 基础回环覆盖检查
+        if (!dnsNames.has("localhost") || !ipAddresses.has("127.0.0.1")) {
+            return false;
+        }
+        // 若未显式指定主机，或指定为通配地址，需保证所有当前活动网卡 IP 均已被覆盖
+        if (!host || host === "0.0.0.0" || host === "::") {
+            const interfaces = networkInterfaces();
+            for (const ifaceList of Object.values(interfaces)) {
+                if (!ifaceList)
+                    continue;
+                for (const iface of ifaceList) {
+                    if (!iface.address)
+                        continue;
+                    let addr = iface.address.toLowerCase();
+                    const percentIdx = addr.indexOf("%");
+                    if (percentIdx !== -1) {
+                        addr = addr.slice(0, percentIdx);
+                    }
+                    if (!ipAddresses.has(addr)) {
+                        return false;
+                    }
+                }
+            }
+            return true;
+        }
+        const trimmedHost = host.trim().toLowerCase();
+        if (isIpAddress(trimmedHost)) {
+            return ipAddresses.has(trimmedHost);
+        }
+        return dnsNames.has(trimmedHost);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 自动加载或重新签发自签名证书。
+ * 遵循严格的存储路径规范、有效性校验与原子文件写入机制。
+ */
+export async function ensureSelfSignedCertificate(options) {
+    const baseHome = getActionDockHome(options?.customHome);
+    const certDir = join(baseHome, ".actiondock", "certs");
+    const certPath = join(certDir, "localhost.crt");
+    const keyPath = join(certDir, "localhost.key");
+    if (existsSync(certPath) && existsSync(keyPath)) {
+        try {
+            const cert = readFileSync(certPath, "utf-8");
+            const key = readFileSync(keyPath, "utf-8");
+            if (isCertificateValid(cert, 7) && certificateCoversHost(cert, options?.host)) {
+                return { cert, key, certPath, keyPath };
+            }
+        }
+        catch {
+            // 忽略读取失败并触发重新签发
+        }
+    }
+    mkdirSync(certDir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(certDir, 0o700);
+    }
+    catch {
+        // 忽略不支持 chmod 的环境
+    }
+    const altNames = collectSanEntries(options?.host);
+    const notAfterDate = new Date(Date.now() + 365 * 24 * 60 * 60 * 1000);
+    const pems = await generate([{ name: "commonName", value: "localhost" }], {
+        notAfterDate,
+        keySize: 2048,
+        algorithm: "sha256",
+        extensions: [
+            {
+                name: "subjectAltName",
+                altNames,
+            },
+        ],
+    });
+    const nonce = `${Date.now()}.${randomUUID()}`;
+    const tmpKeyPath = join(certDir, `localhost.key.tmp.${nonce}`);
+    const tmpCertPath = join(certDir, `localhost.crt.tmp.${nonce}`);
+    writeFileSync(tmpKeyPath, pems.private, { encoding: "utf-8", mode: 0o600 });
+    try {
+        chmodSync(tmpKeyPath, 0o600);
+    }
+    catch {
+        // 忽略不支持 chmod 的环境
+    }
+    writeFileSync(tmpCertPath, pems.cert, { encoding: "utf-8", mode: 0o644 });
+    renameSync(tmpKeyPath, keyPath);
+    try {
+        chmodSync(keyPath, 0o600);
+    }
+    catch {
+        // 忽略不支持 chmod 的环境
+    }
+    renameSync(tmpCertPath, certPath);
+    return {
+        cert: pems.cert,
+        key: pems.private,
+        certPath,
+        keyPath,
+    };
+}

package/dist/utils/index.d.ts

@@ -4,3 +4,4 @@ export * from "./duration.js";
 export * from "./filter.js";
 export * from "./target.js";
 export * from "./spawn.js";
+export * from "./cert.js";

package/dist/utils/index.js

@@ -4,3 +4,4 @@ export * from "./duration.js";
 export * from "./filter.js";
 export * from "./target.js";
 export * from "./spawn.js";
+export * from "./cert.js";

package/dist/utils/target.d.ts

@@ -1,5 +1,14 @@
 import { type ActionDockTarget, type ResolvedTarget } from "@actiondock/core";
+import type { Command } from "commander";
 import type { CliContext } from "../types.js";
+/**
+ * 统一为 Commander 命令节点挂载目标环境解析相关选项（单一事实源）。
+ * 包括：-p/--profile, -s/--server, -t/--token, -k/--insecure, --allow-insecure-http。
+ *
+ * @param command 目标 Commander 命令节点
+ * @returns 挂载选项后的命令节点
+ */
+export declare function applyTargetOptions(command: Command): Command;
 /**
  * 目标解析与 Target 创建所需的统一选项视图。
  * 与既有命令内联解析逻辑保持逐字段一致，作为唯一事实源供各命令复用。
@@ -15,6 +24,10 @@ export interface TargetResolutionOptions {
     token?: string;
     /** 自定义数据目录（对应 --data-dir） */
     dataDir?: string;
+    /** 是否跳过 TLS 证书合法性校验（对应 -k, --insecure） */
+    insecure?: boolean;
+    /** 是否允许向非回环地址发送明文 HTTP 请求（对应 --allow-insecure-http） */
+    allowInsecureHttp?: boolean;
 }
 /**
  * 高阶目标执行辅助：统一封装「目标解析 → Target 创建 → 业务回调 → try/finally close」样板。
@@ -22,7 +35,7 @@ export interface TargetResolutionOptions {
  * 回调获得创建好的 target 与解析后的目标拓扑信息；无论回调成功或抛出，
  * 都保证 target 资源被正确释放，业务异常原样透传。
  *
- * @param options 命令选项视图（profile/server/token/package/dataDir）
+ * @param options 命令选项视图（profile/server/token/package/dataDir/insecure/allowInsecureHttp）
  * @param context CLI 上下文
  * @param fn 业务回调（target 为已创建的门面实例，resolved 为拓扑解析结果）
  * @param localOptions 本地分支附加选项（如 scanLinkedPackages）与 localRoot 回退策略