@bf-meishijian/aip 0.0.5 → 0.0.7

package/dist/review-report.js

@@ -0,0 +1,61 @@
+import { createHash, randomUUID } from "node:crypto";
+import { link, mkdir, open, readFile, realpath, rename, unlink } from "node:fs/promises";
+import { dirname, isAbsolute, join, relative } from "node:path";
+import { deliveryDirectory, materialProjectRoot, } from "./delivery-files.js";
+export async function materializeReviewReport(runRoot, input, files, readMaterial) {
+    const directory = deliveryDirectory(runRoot, input);
+    const projectRoot = await realpath(materialProjectRoot(runRoot, input));
+    const root = await realpath(directory);
+    const rootRelative = relative(projectRoot, root);
+    if (rootRelative.startsWith("..") || isAbsolute(rootRelative))
+        throw new Error("REVIEW_REPORT_PATH_OUTSIDE_PROJECT");
+    const expectedPrefix = `${input.materialPreparation.directory}/`;
+    for (const file of files) {
+        const suffix = file.path.slice(expectedPrefix.length);
+        if (!file.path.startsWith(expectedPrefix) ||
+            !/^(?:reviews\/round-(?:0[1-9]|[1-9][0-9]+)\.md|system_review\.md)$/u.test(suffix))
+            throw new Error("REVIEW_REPORT_INVALID");
+        const body = await readMaterial(file.source);
+        const target = join(directory, suffix);
+        if (suffix.startsWith("reviews/"))
+            await mkdir(join(directory, "reviews"), { recursive: true });
+        const parent = await realpath(dirname(target));
+        const nested = relative(root, parent);
+        if (nested.startsWith("..") || isAbsolute(nested))
+            throw new Error("REVIEW_REPORT_PATH_OUTSIDE_PROJECT");
+        const temporary = join(parent, `.review-${randomUUID()}.tmp`);
+        try {
+            const handle = await open(temporary, "wx", 0o600);
+            try {
+                await handle.writeFile(body);
+                await handle.sync();
+            }
+            finally {
+                await handle.close();
+            }
+            await link(temporary, target);
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+            const existing = await realpath(target);
+            const rel = relative(root, existing);
+            if (rel.startsWith("..") || isAbsolute(rel))
+                throw new Error("REVIEW_REPORT_PATH_OUTSIDE_PROJECT");
+            if (suffix === "system_review.md")
+                await rename(temporary, target);
+            else if (createHash("sha256")
+                .update(await readFile(existing))
+                .digest("hex") !== file.source.contentHash)
+                throw new Error("REVIEW_REPORT_CONTENT_CONFLICT");
+        }
+        finally {
+            await unlink(temporary).catch((error) => {
+                if (error.code !== "ENOENT")
+                    throw error;
+            });
+        }
+    }
+    return files.map(({ path, source }) => ({ path, contentHash: source.contentHash }));
+}
+//# sourceMappingURL=review-report.js.map

package/dist/review-report.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"review-report.js","sourceRoot":"","sources":["../src/review-report.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAEL,iBAAiB,EAGjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAAoB,EACpB,KAAsD,EACtD,YAA4B;IAE5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACjD,IAAI,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,GAAG,KAAK,CAAC,mBAAmB,CAAC,SAAS,GAAG,CAAC;IACjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACtD,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;YACrC,CAAC,oEAAoE,CAAC,IAAI,CAAC,MAAM,CAAC;YAElF,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAC7B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,KAAK,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBACzC,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,MAAM,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;iBAC9D,IACH,UAAU,CAAC,QAAQ,CAAC;iBACjB,MAAM,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;iBAChC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,WAAW;gBAE5C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAA4B,EAAE,EAAE;gBAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAC3C,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/secure-json.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secure-json.d.ts","sourceRoot":"","sources":["../src/secure-json.ts"],"names":[],"mappings":"AAIA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,iBAajE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOjE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,oBAM9C"}
+{"version":3,"file":"secure-json.d.ts","sourceRoot":"","sources":["../src/secure-json.ts"],"names":[],"mappings":"AAKA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,iBAcjE;AAED,wBAAsB,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAOjE;AAED,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,oBAO9C"}

package/dist/secure-json.js

@@ -1,3 +1,4 @@
+import { spawn } from "node:child_process";
 import { randomBytes } from "node:crypto";
 import { chmod, mkdir, open, readFile, rename, stat } from "node:fs/promises";
 import { dirname } from "node:path";
@@ -12,9 +13,13 @@ export async function writeSecureJson(path, value) {
     finally {
         await handle.close();
     }
-    await chmod(temporary, 0o600);
+    if (process.platform === "win32")
+        await restrictWindowsAcl(temporary);
+    else
+        await chmod(temporary, 0o600);
     await rename(temporary, path);
-    await chmod(path, 0o600);
+    if (process.platform !== "win32")
+        await chmod(path, 0o600);
 }
 export async function readJson(path) {
     try {
@@ -28,10 +33,67 @@ export async function readJson(path) {
 }
 export async function isSecureFile(path) {
     try {
+        if (process.platform === "win32")
+            return await windowsAclIsPrivate(path);
         return ((await stat(path)).mode & 0o077) === 0;
     }
     catch {
         return false;
     }
 }
+async function windowsAclIsPrivate(path) {
+    const unsafeSids = [
+        "S-1-1-0", // Everyone
+        "S-1-5-7", // Anonymous
+        "S-1-5-11", // Authenticated Users
+        "S-1-5-32-545", // BUILTIN\\Users
+        "S-1-5-32-546", // BUILTIN\\Guests
+    ];
+    const script = [
+        "$ErrorActionPreference = 'Stop'",
+        "$acl = [System.IO.File]::GetAccessControl($env:AIP_SECURE_FILE_PATH)",
+        `$unsafe = @(${unsafeSids.map((sid) => `'${sid}'`).join(",")})`,
+        "$broadAllow = $acl.Access | Where-Object {",
+        "  if ($_.AccessControlType -ne 'Allow') { return $false }",
+        "  try { $sid = $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value } catch { return $true }",
+        "  return $unsafe -contains $sid",
+        "}",
+        "if ($broadAllow) { exit 1 }",
+    ].join("; ");
+    return runWindowsAclScript(script, path).then(({ code }) => code === 0);
+}
+async function restrictWindowsAcl(path) {
+    const script = [
+        "$ErrorActionPreference = 'Stop'",
+        "$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()",
+        "$acl = [System.Security.AccessControl.FileSecurity]::new()",
+        "$acl.SetOwner($identity.User)",
+        "$acl.SetAccessRuleProtection($true, $false)",
+        "$sids = @($identity.User, [System.Security.Principal.SecurityIdentifier]::new('S-1-5-18'), [System.Security.Principal.SecurityIdentifier]::new('S-1-5-32-544'))",
+        "foreach ($sid in $sids) {",
+        "  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new($sid, [System.Security.AccessControl.FileSystemRights]::FullControl, [System.Security.AccessControl.AccessControlType]::Allow)",
+        "  [void]$acl.AddAccessRule($rule)",
+        "}",
+        "[System.IO.File]::SetAccessControl($env:AIP_SECURE_FILE_PATH, $acl)",
+    ].join("; ");
+    const result = await runWindowsAclScript(script, path);
+    if (result.code !== 0)
+        throw new Error(`无法设置 Windows 凭证文件 ACL：${result.output || `exit ${result.code}`}`);
+}
+function runWindowsAclScript(script, path) {
+    return new Promise((resolveResult) => {
+        let output = "";
+        const child = spawn("powershell.exe", ["-NoProfile", "-NonInteractive", "-Command", script], {
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "pipe"],
+            env: { ...process.env, AIP_SECURE_FILE_PATH: path },
+        });
+        for (const stream of [child.stdout, child.stderr])
+            stream.on("data", (chunk) => {
+                output = `${output}${chunk.toString()}`.slice(-2000);
+            });
+        child.once("error", (error) => resolveResult({ code: 1, output: error.message }));
+        child.once("exit", (code) => resolveResult({ code: code ?? 1, output: output.trim() }));
+    });
+}
 //# sourceMappingURL=secure-json.js.map

package/dist/secure-json.js.map

@@ -1 +1 @@
-{"version":3,"file":"secure-json.js","sourceRoot":"","sources":["../src/secure-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAChE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9B,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"secure-json.js","sourceRoot":"","sources":["../src/secure-json.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAAc;IAChE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;IACjF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,kBAAkB,CAAC,SAAS,CAAC,CAAC;;QACjE,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACnC,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAI,IAAY;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAM,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,MAAM,UAAU,GAAG;QACjB,SAAS,EAAE,WAAW;QACtB,SAAS,EAAE,YAAY;QACvB,UAAU,EAAE,sBAAsB;QAClC,cAAc,EAAE,iBAAiB;QACjC,cAAc,EAAE,kBAAkB;KACnC,CAAC;IACF,MAAM,MAAM,GAAG;QACb,iCAAiC;QACjC,sEAAsE;QACtE,eAAe,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC/D,4CAA4C;QAC5C,2DAA2D;QAC3D,8HAA8H;QAC9H,iCAAiC;QACjC,GAAG;QACH,6BAA6B;KAC9B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,IAAY;IAC5C,MAAM,MAAM,GAAG;QACb,iCAAiC;QACjC,uEAAuE;QACvE,4DAA4D;QAC5D,+BAA+B;QAC/B,6CAA6C;QAC7C,iKAAiK;QACjK,2BAA2B;QAC3B,oMAAoM;QACpM,mCAAmC;QACnC,GAAG;QACH,qEAAqE;KACtE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,IAAI,QAAQ,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc,EAAE,IAAY;IACvD,OAAO,IAAI,OAAO,CAAmC,CAAC,aAAa,EAAE,EAAE;QACrE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE;YAC3F,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE;SACpD,CAAC,CAAC;QACH,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC;YAC/C,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC1B,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC,CAAC,CAAC;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/stage-delivery.js

@@ -8,48 +8,70 @@ export const DELIVERY_FILES = {
   IMPLEMENTATION_PLAN: "plan.md",
   TEST_PLAN: "test_plan.md",
   TEST_REPORT: "report.md",
+  DEPLOYMENT_REPORT: "deployment.md",
   CODE_REVIEW: "code_review.md",
+  SYSTEM_REVIEW: "system_review.md",
   RELEASE_CHECKLIST: "release_checklist.md",
 }         ;
 const communication =
-  "需要业务判断时正常提问，使用 update_question 维护待回应问题；不要以 report_blocker 表示普通提问。主负责人调用无参数完成工具；子成员只通过 submit_member_result 汇报任务结果，不负责全套交付。只有后端确认成功才完成阶段；上传失败重试已保存批次，不重写报告。";
+  "主负责人通过完成工具的 summary 参数提交本轮业务结果；子成员只通过 submit_member_result 汇报任务结果，不负责全套交付。只有后端确认成功才完成阶段；上传失败重试已保存批次，不重写报告。";
 const testWorkspace =
   "本工单测试部署仅授权项目已确认的 testBranch，不得推送生产分支或执行生产发布。共享 bare mirror 推送使用 git -c remote.origin.mirror=false push origin <已确认测试分支>；不要修改全局或共享缓存 mirror 配置，操作后回到工单分支。";
+const developmentPlan =
+  "plan.md 是研发任务清单，使用 - [ ] 与 - [x] 跟踪执行，不是需求摘要或另一份技术设计。先读取 PRD、适用的 design.md 并完成必要摸底，再由主负责人建立清单，之后派发实施任务或修改业务代码；恢复工作先读取已有清单并增量维护。主负责人负责拆分、分派、调整任务与核对整体完成情况，派发时提供主项目清单路径与对应任务项。谁执行谁在完成并取得对应验证结果后勾选自己负责的项；子 Agent 同样遵守，只更新分派给自己的项，不覆盖他人进度，编辑前读取最新内容并局部修改。派发成功不等于完成；代码修改、测试和审查按实际需要分别列项，阻塞或未验证保持未勾选并说明原因，取消项说明原因而不勾为完成。执行分工遵循员工提示词，不要求主负责人亲自编码或测试，不增加计划审批。清单按需要注明负责人、依赖和验证安排，过程中更新，交付时核对最终状态。design.md 说明技术方案、关键决策、接口与数据契约、风险及必要实现细节，深度按任务风险决定，不要求穷举逐文件修改步骤；清单引用设计，不重复背景、目标和设计正文。";
 export const STAGE_DELIVERY_PROTOCOLS = {
   DEVELOPMENT: {
     directory: "docs/aip/<工单编号>/",
     tool: "complete_development",
-    requiredFiles: ["summary.md", "plan.md", "code_review.md", "release_checklist.md"],
+    requiredFiles: ["plan.md", "code_review.md", "release_checklist.md"],
     optionalFiles: [],
     conditionalFiles: [],
     instructions:
-      "只约束阶段最终交付，不规定过程文档的目录、模板或顺序。将最终文件写入主项目收件目录，调用 complete_development()；后端确认成功才算完成。缺失或空文件按工具反馈补齐重交。" +
+      "开发交付必须提交 plan.md、code_review.md、release_checklist.md。plan.md 必须存在且内容非空，不校验格式、勾选状态或产出时机。调用 complete_development 前提交本轮改动并推送已分配开发分支；工具不代替 commit/push，不创建 MR。仅允许推送已分配开发分支，不推送基准、测试或生产分支，不强推。调用 complete_development({summary}) 后以后端结果为准；缺失文件按反馈补齐。" +
       communication,
   },
-  INTEGRATION: {
+  DEPLOYMENT: {
     directory: "docs/aip/<工单编号>/",
     tool: "submit_delivery",
-    requiredFiles: [
-      "summary.md",
-      "plan.md",
-      "code_review.md",
-      "release_checklist.md",
-      "prd.md",
-      "report.md",
-    ],
-    optionalFiles: ["test_plan.md"],
-    conditionalFiles: ["design.md"],
+    requiredFiles: ["plan.md", "code_review.md", "release_checklist.md"],
+    optionalFiles: ["prd.md", "design.md"],
+    conditionalFiles: [],
     instructions:
-      "只约束阶段最终交付，不规定过程文档的目录、模板或顺序。有技术设计时 design.md 必交。将最终文件写入主项目收件目录，调用 submit_delivery()；后端确认成功才算完成。缺失或空文件按工具反馈补齐重交，上传失败复用原批次重试。" +
+      "部署结果通过 summary 参数提交。工具从开发目录读取已有交付文件，调用 submit_delivery({summary,pipelineExecutions})，pipelineExecutions 必须逐一覆盖本次配置的所有流水线，包含项目名称、流水线ID、实际执行链接、SUCCESS或FAILED状态和执行说明；后端确认成功才算完成。缺失文件按工具反馈补齐重交，plan.md 必须有非空内容，不校验格式、勾选状态或产出时机，上传失败复用原批次重试。" +
       communication +
       testWorkspace,
   },
+  QA: {
+    directory: "当前测试工作区",
+    tool: "complete_qa_review",
+    requiredFiles: [],
+    optionalFiles: [],
+    conditionalFiles: [],
+    instructions:
+      "使用 read_qa_test_plan / submit_qa_test_plan 读取和提交结构化计划，沿用平台返回的测试项编号。使用 report_qa_defects 记录缺陷、request_qa_rework 请求返工、resolve_qa_defect 提交复测结果。complete_qa_review 提交人工验收；人工确认后用 report_qa_asset_merge 汇报实际资产合入结果。只读平台真实门禁，不伪造工具成功，不自行豁免测试项。" +
+      communication,
+  },
+  RELEASE: {
+    directory: "docs/aip/<工单编号>/",
+    tool: "submit_pull_requests",
+    requiredFiles: ["release_checklist.md"],
+    optionalFiles: [],
+    conditionalFiles: [],
+    instructions:
+      "submit_pull_requests({checklistSummary,projects}) 使用 Runtime GitLab 身份推送开发分支、创建或复用 MR 并登记工单，后端确认后完成上线准备。用户要求应用代码修改时通过 request_code_changes 返回开发。已打开 MR 可复用；已关闭 MR 仅在用户明确重提时创建新的 MR。此工具不执行实际发布或关单。" +
+      communication,
+  },
 }         ;
 const common =
-  "summary.md 说明问题、目标和范围，不是实现摘要。最终文件可独立阅读并包含实际结论，可引用过程证据，不得只放路径。release_checklist.md 核对设计与实际代码，覆盖 SQL、Apollo、定时任务、消息资源、监控、发布顺序、验证和回滚；未知标待核实，不涉及写原因。过程遵循项目已有框架，只在最终交付时整理材料。";
-export const DEFAULT_STAGE_DELIVERY_PROMPTS = {
-  DEVELOPMENT: common,
-  INTEGRATION: `${common}\n读取开发交接材料，最终交付时根据实际修复更新上线清单。report.md 记录各项目实际验证结果、版本、证据、未验证项和遗留问题。按已配置环境 Skill 观察部署目标和实际版本；在授权范围内修复、合并、等待部署并重测。人工打回时复用当前环境，不默认重新审核，报告区分审核版本与后续修复。`,
+  "最终文件可独立阅读并包含实际结论，可引用过程证据，不得只放路径。release_checklist.md 核对设计与实际代码，覆盖 SQL、Apollo、定时任务、消息资源、监控、发布顺序、验证和回滚；未知标待核实，不涉及写原因。过程遵循项目已有框架。";
+export const WORKFLOW_NODES = ["DEVELOPMENT", "DEPLOYMENT", "QA", "RELEASE"]         ;
+                                                           
+export const DEFAULT_STAGE_DELIVERY_PROMPTS                               = {
+  DEVELOPMENT: `${common}\n${developmentPlan}\n先阅读 PRD 和适用设计，按项目 AGENTS.md、CLAUDE.md 及其引用的 Skill 工作。仅实现 PRD 明确采用的范围。开发会话负责开发、自测与交付材料，不执行部署；普通咨询按用户范围处理，不自动扩张为旧阶段任务，只提交本轮任务内容，不夹带无关改动。`,
+  DEPLOYMENT:
+    "部署结果说明目标、分支、流水线、发布结果、入口、就绪检查及遗留问题，不以测试报告代替部署事实。读取部署配置与开发交接，完成测试侧合并、冲突适配、必要验证与 push，再执行或关联配置流水线。直接使用配置测试分支，不创建中间集成分支；不将测试分支合回开发分支，不修改开发分支业务代码。先检查分支、未提交修改及未完成合并，保留并处理已有现场，核实已有发布再决定操作，不盲目 reset、clean 或重放 push。账号、环境、配置问题在当前会话沟通解决。测试侧冲突、适配及流水线问题由部署员工处理；确认开发分支自身存在缺陷才请求研发修复，提供位置、证据和原因。共享环境被其他发布更新时如实说明，不反复部署抢回版本。结果未知先核实，不伪造成功。",
+  QA: "先读取已有测试计划，按确认的 PRD/AC 设计测试并按变更风险补充边界、异常、安全、并发等适用项目，不机械套用全部类别。API/浏览器是操作方式，自动化/Agent/人工是执行方式。测试代码与环境问题在 QA 处理，产品缺陷交研发。复测取得证据后关闭对应缺陷。控台检查使用浏览器，保存真实截图和检查点。测试资产遵守仓库 contract 与 support/cases/flows 规范，准备环境直至 doctor 通过。按需查询真实测试结果，不无意义轮询。资产合并冲突自行解决并验证，业务语义不明时请求人工决策，不强推或绕过分支保护。实质修改测试内容或结论后重新验证并提交人工验收，不沿用原确认。",
+  RELEASE: `${common}\n读取最新代码、上线清单和适用设计及已验收部署结果。以设计为预期、代码核实，没有设计时从代码提取；无法证明的环境事实标待核实，不涉及说明原因。核实清单后提交文档改动，准备 MR 标题说明，标题包含工单编号与本项目变更摘要。说明任务目的、本项目改动、测试验收、发布注意、跨项目依赖、风险回滚及材料入口。测试部署记录不能代替上线清单。缺口需要用户补充时说明具体问题，不宣称核实完成。仅讨论和文档更新不退回开发。`,
 };
 export function developmentTeamMemberEntries(members   
                        
@@ -61,15 +83,11 @@ export function developmentTeamMemberEntries(members
   ];
 }
 
-/** 阶段名单由用户显式配置；上线准备继续使用任务原有成员身份。 */
+/** 团队成员只有一套配置；部署由独立员工执行。 */
 export function stageEmployeeIds(input   
                         
                              
                                                        
-                                                                      
  )           {
-  const members = input.team?.members.employeeIds ?? [];
-  if (input.executionPurpose === "RELEASE" || input.phase === "PREPARATION") return members;
-  const selected = input.stageDeliverySnapshots?.[input.phase ?? ""]?.employeeIds ?? [];
-  return selected.filter((id) => members.includes(id));
+  return input.phase === "DEPLOYMENT" ? [] : (input.team?.members.employeeIds ?? []);
 }

package/dist/state.d.ts

@@ -18,8 +18,8 @@ export interface HostState {
     runtimeVersion: string;
     catalogRevision: number;
 }
-export declare const CLI_VERSION = "0.0.5";
-export declare const RUNTIME_VERSION = "0.0.5";
+export declare const CLI_VERSION = "0.0.7";
+export declare const RUNTIME_VERSION = "0.0.7";
 export declare function hostIdentity(): {
     fingerprint: string;
     hostName: string;

package/dist/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wBAAgB,YAAY;;;;;;;EAY3B;AACD,wBAAgB,cAAc,+BAE7B;AACD,wBAAgB,aAAa,8BAE5B;AACD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,iBAEhD;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,iBAE9C;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1E,MAAM,EAAE,MAAM,UAGf"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CACxC;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,eAAO,MAAM,WAAW,UAAU,CAAC;AACnC,eAAO,MAAM,eAAe,UAAU,CAAC;AAEvC,wBAAgB,YAAY;;;;;;;EAY3B;AACD,wBAAgB,cAAc,+BAE7B;AACD,wBAAgB,aAAa,8BAE5B;AACD,wBAAsB,eAAe,CAAC,KAAK,EAAE,UAAU,iBAGtD;AACD,wBAAgB,cAAc,CAAC,KAAK,EAAE,SAAS,iBAE9C;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,iBAAiB,CAAC,GAAG,IAAI,GAAG,SAAS,EAC1E,MAAM,EAAE,MAAM,UAGf"}

package/dist/state.js

@@ -1,10 +1,11 @@
 import { createHash } from "node:crypto";
 import { hostname } from "node:os";
 import { paths } from "./paths.js";
+import { bindPlatform } from "./profile.js";
 import { runtimeArchitecture } from "./platform.js";
 import { readJson, writeSecureJson } from "./secure-json.js";
-export const CLI_VERSION = "0.0.5";
-export const RUNTIME_VERSION = "0.0.5";
+export const CLI_VERSION = "0.0.7";
+export const RUNTIME_VERSION = "0.0.7";
 export function hostIdentity() {
     const hostName = hostname();
     return {
@@ -24,8 +25,9 @@ export function readDeviceAuth() {
 export function readHostState() {
     return readJson(paths().hostState);
 }
-export function writeDeviceAuth(value) {
-    return writeSecureJson(paths().deviceAuth, value);
+export async function writeDeviceAuth(value) {
+    const platformUrl = await bindPlatform(value.platformUrl);
+    return writeSecureJson(paths().deviceAuth, { ...value, platformUrl });
 }
 export function writeHostState(value) {
     return writeSecureJson(paths().hostState, value);

package/dist/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAoB7D,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC5B,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,mBAAmB,EAAE,EAAE,CAAC;aAClE,MAAM,CAAC,KAAK,CAAC;QAChB,QAAQ;QACR,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,IAAI,EAAE,mBAAmB,EAAE;QAC3B,UAAU,EAAE,WAAW;QACvB,cAAc,EAAE,eAAe;KAChC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAa,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,aAAa;IAC3B,OAAO,QAAQ,CAAY,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA0E,EAC1E,MAAc;IAEd,OAAO,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAoB7D,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;IAC5B,OAAO;QACL,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,GAAG,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,mBAAmB,EAAE,EAAE,CAAC;aAClE,MAAM,CAAC,KAAK,CAAC;QAChB,QAAQ;QACR,EAAE,EAAE,OAAO,CAAC,QAAQ;QACpB,IAAI,EAAE,mBAAmB,EAAE;QAC3B,UAAU,EAAE,WAAW;QACvB,cAAc,EAAE,eAAe;KAChC,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,cAAc;IAC5B,OAAO,QAAQ,CAAa,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,aAAa;IAC3B,OAAO,QAAQ,CAAY,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;AAChD,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAiB;IACrD,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACxE,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAgB;IAC7C,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAA0E,EAC1E,MAAc;IAEd,OAAO,QAAQ,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACpE,CAAC"}

package/dist/test-cli.d.ts

@@ -0,0 +1,2 @@
+export declare function testCli(action: string | undefined, args: string[]): Promise<void>;
+//# sourceMappingURL=test-cli.d.ts.map

package/dist/test-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-cli.d.ts","sourceRoot":"","sources":["../src/test-cli.ts"],"names":[],"mappings":"AAOA,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,iBAgDvE"}

package/dist/test-cli.js

@@ -0,0 +1,50 @@
+import { aipCommand } from "./paths.js";
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { parseQaContract } from "./qa-contract.js";
+import { executeQa, executeQaStage, gitQa, qaProcessEnvironment } from "./test-executor.js";
+export async function testCli(action, args) {
+    if (!["run", "collect", "check", "doctor"].includes(action ?? ""))
+        throw new Error(`用法：${aipCommand()} test run|collect|check|doctor --environment NAME [--repository PATH] [--branch BRANCH --commit SHA --cases IDS --domains DOMAINS]`);
+    const option = (name) => {
+        const index = args.indexOf(name);
+        return index < 0 ? undefined : args[index + 1];
+    };
+    const cwd = resolve(option("--repository") ?? process.cwd());
+    const environment = option("--environment");
+    if (!environment)
+        throw new Error("QA_ENVIRONMENT_REQUIRED");
+    const executionId = randomUUID();
+    const branch = option("--branch") ?? (await gitQa(["branch", "--show-current"], cwd));
+    const commitSha = option("--commit") ?? (await gitQa(["rev-parse", "HEAD"], cwd));
+    const input = {
+        executionId,
+        environment,
+        project: {
+            id: "cli",
+            name: "cli",
+            branch,
+            commitSha,
+            remoteUrl: await gitQa(["remote", "get-url", "origin"], cwd),
+        },
+        selection: {
+            caseIds: option("--cases")?.split(",").filter(Boolean) ?? [],
+            domains: option("--domains")?.split(",").filter(Boolean) ?? [],
+        },
+    };
+    if (action === "run") {
+        const { result } = await executeQa(input);
+        process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+        if (result.status !== "PASSED" || !result.invariants.trusted)
+            process.exitCode = 1;
+        return;
+    }
+    const contract = parseQaContract(JSON.parse(await readFile(resolve(cwd, "contract.json"), "utf8")));
+    const stage = action;
+    const result = await executeQaStage(stage, contract[stage], cwd, qaProcessEnvironment(input, resolve(cwd, "target/aip")));
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    if (result.exitCode !== 0)
+        process.exitCode = 1;
+}
+//# sourceMappingURL=test-cli.js.map

package/dist/test-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-cli.js","sourceRoot":"","sources":["../src/test-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE5F,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,MAA0B,EAAE,IAAc;IACtE,IAAI,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CACb,MAAM,UAAU,EAAE,oIAAoI,CACvJ,CAAC;IACJ,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG;QACZ,WAAW;QACX,WAAW;QACX,OAAO,EAAE;YACP,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,KAAK;YACX,MAAM;YACN,SAAS;YACT,SAAS,EAAE,MAAM,KAAK,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC;SAC7D;QACD,SAAS,EAAE;YACT,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;YAC5D,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE;SAC/D;KACF,CAAC;IACF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAC9B,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAClE,CAAC;IACF,MAAM,KAAK,GAAG,MAAwC,CAAC;IACvD,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,KAAK,EACL,QAAQ,CAAC,KAAK,CAAC,EACf,GAAG,EACH,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CACxD,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/test-executor.d.ts

@@ -0,0 +1,44 @@
+import type { QaCommandFact, QaHostCommandPayload, QaHostResult, QaManifest } from "@ai-platform/api-contracts";
+export { gitQa } from "./qa-project-checkout.js";
+export type QaExecutionInput = Pick<QaHostCommandPayload, "environment" | "groupId" | "catalogManifest" | "deploymentRef" | "selection"> & {
+    project: Omit<QaHostCommandPayload["project"], "mainBranch">;
+    executionId: string;
+    environmentVariables?: Record<string, string> | undefined;
+};
+export interface QaExecutionBundle {
+    result: QaHostResult;
+    checkout: string;
+    output: string;
+    files: Array<{
+        path: string;
+        filename: string;
+    }>;
+}
+export declare const qaExecutionDirectory: (id: string) => string;
+export declare const qaResultFile: (id: string) => string;
+/** 继承本机工具链变量，再应用用户显式配置；不继承 Host 进程的其他秘密。 */
+export declare function qaProcessEnvironment(input: QaExecutionInput, output: string): NodeJS.ProcessEnv;
+export declare function executeQaStage(stage: QaCommandFact["stage"], command: string[], cwd: string, env: NodeJS.ProcessEnv, timeoutMs?: number): Promise<QaCommandFact>;
+export declare function saveQaStartupFailure(input: QaExecutionInput, error: unknown): Promise<QaExecutionBundle>;
+export declare function executeQa(input: QaExecutionInput): Promise<QaExecutionBundle>;
+export declare function qaMediaType(filename: string): "image/png" | "image/jpeg" | "image/webp" | "application/json" | "application/octet-stream" | "text/plain" | "application/xml";
+/** 目录采集不检查被测环境，也不执行业务测试。 */
+export declare function executeQaCatalog(input: Pick<QaExecutionInput, "project"> & {
+    catalogId: string;
+    environmentVariables?: Record<string, string> | undefined;
+}): Promise<{
+    commitSha: string;
+    manifest: QaManifest | null;
+    commands: QaCommandFact[];
+    environments: string[];
+    groups: import("@ai-platform/api-contracts").QaTestGroup[];
+    error?: string;
+} | {
+    commitSha: string;
+    manifest: null;
+    commands: never[];
+    environments: never[];
+    groups: never[];
+    error: string;
+}>;
+//# sourceMappingURL=test-executor.d.ts.map

package/dist/test-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-executor.d.ts","sourceRoot":"","sources":["../src/test-executor.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,UAAU,EACX,MAAM,4BAA4B,CAAC;AAgBpC,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGjD,MAAM,MAAM,gBAAgB,GAAG,IAAI,CACjC,oBAAoB,EACpB,aAAa,GAAG,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,WAAW,CAC9E,GAAG;IACF,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,YAAY,CAAC,CAAC;IAC7D,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3D,CAAC;AACF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAClD;AAKD,eAAO,MAAM,oBAAoB,GAAI,IAAI,MAAM,WACW,CAAC;AAC3D,eAAO,MAAM,YAAY,GAAI,IAAI,MAAM,WAC0B,CAAC;AAoBlE,4CAA4C;AAC5C,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CA+B/F;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,EAC7B,OAAO,EAAE,MAAM,EAAE,EACjB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,CAAC,UAAU,EACtB,SAAS,SAAc,GACtB,OAAO,CAAC,aAAa,CAAC,CA6CxB;AA+CD,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,gBAAgB,EACvB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAOD,wBAAsB,SAAS,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAMnF;AA+OD,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,kIAQ3C;AAED,4BAA4B;AAC5B,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;CAC3D;eAkBY,MAAM;cACP,UAAU,GAAG,IAAI;cACjB,aAAa,EAAE;kBACX,MAAM,EAAE;YACd,OAAO,4BAA4B,EAAE,WAAW,EAAE;YAClD,MAAM;;;;;;;;GAbjB"}