@actionway/cli 0.18.1 → 0.18.2

package/README.md

@@ -27,8 +27,9 @@ actionway init
 
 - **auth 唯一途径：Clerk OAuth（PKCE）**。issuer / client_id 运行时从
   `{public origin}/api/auth/cli-config` 发现；浏览器授权走随机 `127.0.0.1` 回调端口；
-  凭据存 `~/.actionway/credentials.json`（0600 owner-only 文件，可用
-  `ACTIONWAY_CONFIG_DIR` 重定向）。CLI 从不打印或存储 OAuth client secret。
+  凭据存 `~/.actionway/credentials.json`（POSIX 上为 0600 owner-only 文件；
+  Windows 上 chmod 无效，保密性依赖 `%USERPROFILE%` 的继承 ACL——不要把
+  `ACTIONWAY_CONFIG_DIR` 指到共享目录）。CLI 从不打印或存储 OAuth client secret。
 - **命令面 = 明码写出的注册表**（无 profile flag、无运行期分叉）：
   - `tools search / inspect / call` 是长尾 capability 的规范发现与执行面；
   - 高频 typed command 继续提供参数与文件 UX，但投影到同一个 Tool Call；

package/dist/index.js

@@ -12209,28 +12209,63 @@ function resultDetail(result) {
   const error = result.error instanceof Error ? result.error.message : "";
   return sanitizeDetail(error || result.stderr || result.stdout || `exit ${result.status ?? "signal"}`);
 }
+var HINTS = {
+  E_NODE_UNSUPPORTED: "install Node.js 20 or newer, open a new terminal, and retry",
+  E_NPM_NOT_FOUND: "install Node.js with npm and make sure npm/npm.cmd is available in PATH",
+  E_GLOBAL_PREFIX: "use a user-writable npm global prefix; do not elevate without reviewing the target path",
+  E_NPM_REGISTRY: "check the npm registry, @actionway scope mapping, proxy, and corporate CA configuration"
+};
+var NPM_ERROR_CODE_MAP = {
+  EBADENGINE: "E_NODE_UNSUPPORTED",
+  EACCES: "E_GLOBAL_PREFIX",
+  EPERM: "E_GLOBAL_PREFIX",
+  E401: "E_NPM_REGISTRY",
+  E403: "E_NPM_REGISTRY",
+  E404: "E_NPM_REGISTRY",
+  E407: "E_NPM_REGISTRY",
+  E408: "E_NPM_REGISTRY",
+  E429: "E_NPM_REGISTRY",
+  ETIMEDOUT: "E_NPM_REGISTRY",
+  ECONNRESET: "E_NPM_REGISTRY",
+  ECONNREFUSED: "E_NPM_REGISTRY",
+  ENETUNREACH: "E_NPM_REGISTRY",
+  EHOSTUNREACH: "E_NPM_REGISTRY",
+  EAI_AGAIN: "E_NPM_REGISTRY",
+  ENOTFOUND: "E_NPM_REGISTRY",
+  SELF_SIGNED_CERT_IN_CHAIN: "E_NPM_REGISTRY",
+  UNABLE_TO_GET_ISSUER_CERT_LOCALLY: "E_NPM_REGISTRY",
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: "E_NPM_REGISTRY",
+  CERT_HAS_EXPIRED: "E_NPM_REGISTRY",
+  DEPTH_ZERO_SELF_SIGNED_CERT: "E_NPM_REGISTRY"
+  // npm 自身的 ENOENT（缓存/rename 竞态等本地文件问题）可重试，
+  // 不属于"npm 未安装"——那只由 spawn 层的 error/9009 判定。
+};
+function classifyNpmFailure(result, searchable) {
+  const spawnError = result.error;
+  if (spawnError?.code === "ENOENT") return "E_NPM_NOT_FOUND";
+  if (result.status === 9009) return "E_NPM_NOT_FOUND";
+  const codeToken = /npm (?:ERR!|error) code ([A-Z0-9_]+)/i.exec(searchable)?.[1]?.toUpperCase();
+  if (codeToken) {
+    const mapped = NPM_ERROR_CODE_MAP[codeToken];
+    if (mapped) return mapped;
+    if (/^(?:CERT_|ERR_TLS_|UNABLE_TO_)/.test(codeToken)) return "E_NPM_REGISTRY";
+    return "E_UPDATE_FAILED";
+  }
+  if (/unsupported engine|not compatible with your version of node/i.test(searchable)) return "E_NODE_UNSUPPORTED";
+  if (/not recognized as an internal or external command|npm(?:\.cmd)?: (?:command )?not found/i.test(searchable))
+    return "E_NPM_NOT_FOUND";
+  if (/permission denied|operation not permitted/i.test(searchable)) return "E_GLOBAL_PREFIX";
+  if (/self[- ]signed certificate|unable to (?:get|verify) .*certificate|getaddrinfo|socket hang up|network timeout/i.test(searchable))
+    return "E_NPM_REGISTRY";
+  return "E_UPDATE_FAILED";
+}
 function npmFailure(result, operation) {
   const detail = resultDetail(result);
   const searchable = `${detail}
 ${result.stderr}
 ${result.stdout}`;
-  let code = "E_UPDATE_FAILED";
-  let hint = "retry from a normal host terminal or reinstall @actionway/cli@latest (use npm.cmd on Windows)";
-  if (/EBADENGINE|unsupported engine|not compatible with your version of node/i.test(searchable)) {
-    code = "E_NODE_UNSUPPORTED";
-    hint = "install Node.js 20 or newer, open a new terminal, and retry";
-  } else if (/ENOENT|not recognized as an internal or external command|npm(?:\.cmd)?: not found/i.test(searchable)) {
-    code = "E_NPM_NOT_FOUND";
-    hint = "install Node.js with npm and make sure npm/npm.cmd is available in PATH";
-  } else if (/EACCES|EPERM|permission denied|operation not permitted/i.test(searchable)) {
-    code = "E_GLOBAL_PREFIX";
-    hint = "use a user-writable npm global prefix; do not elevate without reviewing the target path";
-  } else if (/E401|E403|E404|E407|SELF_SIGNED_CERT|CERT_|UNABLE_TO_GET_ISSUER|UNABLE_TO_VERIFY_LEAF_SIGNATURE|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENETUNREACH|EHOSTUNREACH|EAI_AGAIN|ENOTFOUND|registry/i.test(
-    searchable
-  )) {
-    code = "E_NPM_REGISTRY";
-    hint = "check the npm registry, @actionway scope mapping, proxy, and corporate CA configuration";
-  }
+  const code = classifyNpmFailure(result, searchable);
+  const hint = HINTS[code] ?? "retry from a normal host terminal or reinstall @actionway/cli@latest (use npm.cmd on Windows)";
   return new CliError(code, `${operation} failed: ${detail || "npm exited unsuccessfully"}`, hint);
 }
 function runNpmText(args, operation, options = {}) {
@@ -12965,9 +13000,10 @@ function registerAccountCommands(program2, getTransport3) {
 
 // src/commands/doctor.ts
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { accessSync, constants, existsSync as existsSync2, statSync } from "node:fs";
+import { existsSync as existsSync2, rmSync as rmSync2, statSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { createServer as createServer2 } from "node:http";
-import { dirname as dirname3, posix, win32 } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { dirname as dirname3, join as join3, posix, win32 } from "node:path";
 var PACKAGE_NAME3 = "@actionway/cli";
 function pass(id, message) {
   return { id, status: "pass", message };
@@ -13010,7 +13046,9 @@ function defaultWritable(path) {
   while (!existsSync2(candidate) && dirname3(candidate) !== candidate) candidate = dirname3(candidate);
   try {
     if (!statSync(candidate).isDirectory()) return false;
-    accessSync(candidate, constants.W_OK);
+    const probe = join3(candidate, `.actionway-doctor-${randomBytes2(6).toString("hex")}`);
+    writeFileSync3(probe, "");
+    rmSync2(probe, { force: true });
     return true;
   } catch {
     return false;
@@ -13023,6 +13061,11 @@ function checkLoopback() {
     server.listen(0, "127.0.0.1", () => server.close((error) => error ? reject(error) : resolve3()));
   });
 }
+function defaultResolveCommand(name) {
+  const result = process.platform === "win32" ? spawnSync2("where.exe", [name], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 5e3, windowsHide: true }) : spawnSync2("/bin/sh", ["-c", `command -v -- ${name}`], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 5e3 });
+  if (result.error || result.status !== 0) return null;
+  return result.stdout.split(/\r?\n/).map((line) => line.trim()).find(Boolean) ?? null;
+}
 function powerShellPolicy() {
   const result = spawnSync2(
     "powershell.exe",
@@ -13048,6 +13091,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   const fetchOAuth = dependencies.fetchOAuth ?? fetchCliOAuthConfig;
   const loopback = dependencies.checkLoopback ?? checkLoopback;
   const readPolicy = dependencies.readPowerShellPolicy ?? powerShellPolicy;
+  const resolveCommand = dependencies.resolveCommand ?? defaultResolveCommand;
   const checks = [];
   const configDir = actionwayConfigDir(env);
   const nodeMajor = Number.parseInt(nodeVersion.split(".")[0] ?? "", 10);
@@ -13068,11 +13112,11 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   checks.push(
     pathWritable(configDir) ? pass("config_dir", `Configuration directory is writable: ${configDir}`) : fail2("config_dir", `Configuration directory is not writable: ${configDir}`, "set ACTIONWAY_CONFIG_DIR to a user-writable directory")
   );
-  const registryResult = npm(["config", "get", "registry"], { env, platform, timeoutMs: 5e3 });
+  const registryResult = npm(["config", "get", "registry"], { env, platform, timeoutMs: 15e3 });
   checks.push(
     npmCheck("npm", registryResult, "npm discovery", (registry) => pass("npm", `npm is available; registry is ${safeRegistry(registry)}.`))
   );
-  const scopeResult = npm(["config", "get", "@actionway:registry"], { env, platform, timeoutMs: 5e3 });
+  const scopeResult = npm(["config", "get", "@actionway:registry"], { env, platform, timeoutMs: 15e3 });
   const scopeRegistry = commandOutput(scopeResult);
   if (scopeRegistry && !["null", "undefined"].includes(scopeRegistry.toLowerCase())) {
     const safe = safeRegistry(scopeRegistry);
@@ -13088,7 +13132,7 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
   } else {
     checks.push(pass("scope_registry", "No custom @actionway npm registry mapping is configured."));
   }
-  const prefixResult = npm(["prefix", "--global"], { env, platform, timeoutMs: 5e3 });
+  const prefixResult = npm(["prefix", "--global"], { env, platform, timeoutMs: 15e3 });
   const prefix = commandOutput(prefixResult);
   if (!prefix) {
     const error = npmFailure(prefixResult, "npm global prefix lookup");
@@ -13097,11 +13141,13 @@ async function diagnoseActionway(options = {}, dependencies = {}) {
     const api = pathApi(platform);
     const binDir = platform === "win32" ? prefix : api.join(prefix, "bin");
     const binName = platform === "win32" ? "actionway.cmd" : "actionway";
+    let resolvedCache;
+    const resolved = () => resolvedCache !== void 0 ? resolvedCache : resolvedCache = resolveCommand("actionway");
     checks.push(
-      pathContains(binDir, env, platform) ? pass("global_path", `npm global executable directory is in PATH: ${binDir}`) : fail2("global_path", `npm global executable directory is not in PATH: ${binDir}`, "add it to the user PATH and open a new terminal")
+      pathContains(binDir, env, platform) ? pass("global_path", `npm global executable directory is in PATH: ${binDir}`) : resolved() ? pass("global_path", `actionway resolves from PATH at ${resolved()} (outside the npm global prefix ${binDir}).`) : fail2("global_path", `npm global executable directory is not in PATH: ${binDir}`, "add it to the user PATH and open a new terminal")
     );
     checks.push(
-      pathExists(api.join(binDir, binName)) ? pass("command", `${binName} is installed in the npm global prefix.`) : fail2("command", `${binName} was not found in the npm global prefix.`, "reinstall @actionway/cli@latest in the same Node/npm environment")
+      pathExists(api.join(binDir, binName)) ? pass("command", `${binName} is installed in the npm global prefix.`) : resolved() ? pass("command", `actionway command resolves at ${resolved()}.`) : fail2("command", `${binName} was not found in the npm global prefix.`, "reinstall @actionway/cli@latest in the same Node/npm environment")
     );
   }
   if (platform === "win32") {
@@ -13176,8 +13222,8 @@ function registerDoctorCommand(program2) {
 import { randomUUID as randomUUID5 } from "node:crypto";
 
 // src/lib/skill.ts
-import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, realpathSync as realpathSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname4, join as join3, resolve as resolve2 } from "node:path";
+import { cpSync, existsSync as existsSync3, mkdirSync as mkdirSync3, readFileSync as readFileSync4, realpathSync as realpathSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4, join as join4, resolve as resolve2 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 var InitError = class extends Error {
   hint;
@@ -13191,12 +13237,12 @@ var ACTIONWAY_SKILL_INSTRUCTION = "Install this skill from `source` into your ag
 function resolveBundledSkill(moduleUrl = import.meta.url) {
   const here = dirname4(fileURLToPath3(moduleUrl));
   for (const candidate of [resolve2(here, "../assets/skill/actionway"), resolve2(here, "../../assets/skill/actionway")]) {
-    if (existsSync3(join3(candidate, "SKILL.md"))) return realpathSync2(candidate);
+    if (existsSync3(join4(candidate, "SKILL.md"))) return realpathSync2(candidate);
   }
   throw new InitError("the bundled Actionway Skill is missing", "reinstall @actionway/cli, then run `actionway init` again");
 }
 function skillSourcePath(env = process.env) {
-  return join3(actionwayConfigDir(env), "skill", "actionway");
+  return join4(actionwayConfigDir(env), "skill", "actionway");
 }
 function stampSkillVersion(skillMarkdown, version) {
   const newline = skillMarkdown.includes("\r\n") ? "\r\n" : "\n";
@@ -13236,16 +13282,16 @@ function stampSkillVersion(skillMarkdown, version) {
 function materializeSkill(options = {}) {
   const env = options.env ?? process.env;
   const source = options.source ? realpathSync2(options.source) : resolveBundledSkill();
-  if (!existsSync3(join3(source, "SKILL.md"))) {
+  if (!existsSync3(join4(source, "SKILL.md"))) {
     throw new InitError("the Actionway Skill source is invalid", "reinstall @actionway/cli and retry init");
   }
   const version = options.version ?? readOwnVersion();
   const target = skillSourcePath(env);
   mkdirSync3(dirname4(target), { recursive: true, mode: 448 });
-  rmSync2(target, { recursive: true, force: true });
+  rmSync3(target, { recursive: true, force: true });
   cpSync(source, target, { recursive: true });
-  const skillPath = join3(target, "SKILL.md");
-  writeFileSync3(skillPath, stampSkillVersion(readFileSync4(skillPath, "utf8"), version));
+  const skillPath = join4(target, "SKILL.md");
+  writeFileSync4(skillPath, stampSkillVersion(readFileSync4(skillPath, "utf8"), version));
   return { source: target, version, instruction: ACTIONWAY_SKILL_INSTRUCTION };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actionway/cli",
-  "version": "0.18.1",
+  "version": "0.18.2",
   "description": "actionway CLI 的本地端壳：Clerk OAuth 鉴权 + cli-core 共享命令面 + init / update / skill 物化 / 版本三链路（终端用户本地 Codex / Claude Code 使用）",
   "type": "module",
   "bin": {