@cnbcool/cnb-api-generate 2.5.0 → 2.6.0

package/built/skills-tools/generate-shortcuts-config.js

@@ -0,0 +1,32 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateShortcutsConfig = generateShortcutsConfig;
+const debug_1 = __importDefault(require("debug"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const get_skills_codegen_target_1 = require("../utils/get-skills-codegen-target");
+const logger = (0, debug_1.default)('csg:shortcuts-config');
+/**
+ * 把解析后的快捷命令配置写入 client 运行时可读取的 JSON。
+ * 文件路径为 `<skillScriptDir>/core/shortcuts.config.json`，
+ * 与编译后的 `core/shortcuts.js` 同级，运行时通过相对路径读取。
+ *
+ * 写入的字段就是 ResolvedQuickCommand 透传后的内容（包含 module 冗余字段，
+ * 以及配置里给的 shortName / realTool / description / repoOnly / upload /
+ * custom / autoData / dataTip）；下游 client/shortcuts.ts 只用其中的
+ * 运行时字段，文档相关字段被忽略也不影响。
+ */
+async function generateShortcutsConfig(byModule) {
+    const skillScriptDir = (0, get_skills_codegen_target_1.getSkillScriptCodegenTarget)();
+    const skillScriptCoreDir = path_1.default.join(skillScriptDir, 'core');
+    if (!fs_1.default.existsSync(skillScriptCoreDir)) {
+        fs_1.default.mkdirSync(skillScriptCoreDir, { recursive: true });
+    }
+    const targetFile = path_1.default.join(skillScriptCoreDir, 'shortcuts.config.json');
+    fs_1.default.writeFileSync(targetFile, JSON.stringify(byModule, null, 2));
+    const total = Object.values(byModule).reduce((n, arr) => n + arr.length, 0);
+    logger(`wrote ${targetFile} (${Object.keys(byModule).length} modules, ${total} commands)`);
+}

package/built/skills-tools/generate-skill-md.js

@@ -10,8 +10,14 @@ const fs_1 = __importDefault(require("fs"));
 const get_skills_codegen_target_1 = require("../utils/get-skills-codegen-target");
 const get_config_1 = require("../utils/get-config");
 const skills_1 = require("../constants/skills");
+const render_quick_commands_md_1 = require("./render-quick-commands-md");
 const logger = (0, debug_1.default)('csg:skills');
-async function generateSkillMd(helpData, requestMap) {
+async function generateSkillMd(
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_helpData, 
+// requestMap 由调用方传入但当前未使用，保留以维持稳定签名
+// eslint-disable-next-line @typescript-eslint/no-unused-vars
+_requestMap, quickCommandsByModule) {
     const skillMDTempateDir = path_1.default.join(__dirname, '../../skills-template');
     const skillMDDir = path_1.default.join((0, get_skills_codegen_target_1.getSkillCodegenTarget)());
     // 复制skills.md
@@ -19,7 +25,16 @@ async function generateSkillMd(helpData, requestMap) {
     const targetSkillMD = path_1.default.join(skillMDDir, 'SKILL.md');
     const skillMDContent = fs_1.default.readFileSync(SKILL_MD, 'utf8');
     const config = (0, get_config_1.getConfig)();
-    const newSkillMDContent = skillMDContent.replaceAll('<$CNB_CLI_CMD$>', config.skillsDev ? skills_1.CNB_CLI_DEV_CMD : skills_1.CNB_CLI_PROD_CMD);
+    const cliCmd = config.skillsDev ? skills_1.CNB_CLI_DEV_CMD : skills_1.CNB_CLI_PROD_CMD;
+    // 仅替换两类占位符：
+    // - <$QUICK_COMMANDS$>：配置驱动的快捷命令清单（标题/注意事项写在模板里即可）
+    // - <$CNB_CLI_CMD$>   ：CLI 命令前缀
+    const quickCommandsMd = (0, render_quick_commands_md_1.renderQuickCommandsMarkdown)(quickCommandsByModule, cliCmd);
+    const total = Object.values(quickCommandsByModule).reduce((n, arr) => n + arr.length, 0);
+    logger(`quick commands rendered: ${Object.keys(quickCommandsByModule).length} modules, ${total} commands`);
+    const newSkillMDContent = skillMDContent
+        .replaceAll('<$QUICK_COMMANDS$>', quickCommandsMd)
+        .replaceAll('<$CNB_CLI_CMD$>', cliCmd);
     fs_1.default.writeFileSync(targetSkillMD, newSkillMDContent);
     logger(`generate ${SKILL_MD} to ${targetSkillMD}`);
 }

package/built/skills-tools/render-quick-commands-md.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderQuickCommandsMarkdown = renderQuickCommandsMarkdown;
+/**
+ * 把解析后的快捷命令渲染为 markdown 文本，对应模板里的 <$QUICK_COMMANDS$> 占位符。
+ *
+ * 仅渲染命令列表本身——"## 快捷命令" 标题、"## 注意事项" 等静态文案直接
+ * 写在 skills-template/SKILL.md 模板里，没必要再加占位符。
+ *
+ * 渲染规则：
+ * - 每个模块先输出 `<moduleName>:` 标题行
+ * - 每条命令渲染为 ``- `<cliCmd> <module> <shortName>[ <dataTip>]` — <description>`` 的列表项
+ * - 没有任何模块/命令时返回空字符串（让模板里的占位符消失）
+ */
+function renderQuickCommandsMarkdown(byModule, cliCmd) {
+    const moduleNames = Object.keys(byModule);
+    if (!moduleNames.length)
+        return '';
+    const lines = [];
+    for (const moduleName of moduleNames) {
+        const items = byModule[moduleName];
+        if (!items.length)
+            continue;
+        lines.push(`${moduleName}:`);
+        for (const cmd of items) {
+            const dataPart = cmd.dataTip ? ` ${cmd.dataTip}` : '';
+            const cmdLine = `${cliCmd} ${moduleName} ${cmd.shortName}${dataPart}`;
+            lines.push(`- \`${cmdLine}\` — ${cmd.description}`);
+        }
+        lines.push('');
+    }
+    // 去掉末尾多余空行
+    while (lines.length && lines[lines.length - 1] === '') {
+        lines.pop();
+    }
+    return lines.join('\n');
+}

package/built/skills-tools/resolve-quick-commands.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveQuickCommands = resolveQuickCommands;
+const debug_1 = __importDefault(require("debug"));
+const get_config_1 = require("../utils/get-config");
+const logger = (0, debug_1.default)('csg:quick-commands');
+/**
+ * 把 cag.config.js 的 quickCommands 配置 + helpData 元数据，
+ * 解析为下游（client 产物 / SKILL.md 渲染）共用的结构化数据。
+ *
+ * 关键校验：
+ * - 非 custom 命令的 realTool 必须能在 helpData.modulesHelp 中命中，
+ *   否则立即抛错，防止 swagger 改名/下线后产物默默漂移。
+ * - 校验时按"任一 category 命中"匹配（realTool 在 swagger 里全局唯一即可，
+ *   不强制要求 module 名等于 swagger category）。
+ */
+function resolveQuickCommands(helpData) {
+    const { quickCommands } = (0, get_config_1.getConfig)();
+    if (!quickCommands)
+        return {};
+    const { modulesHelp } = helpData;
+    // 建一个 realTool → true 的全局集合，便于 O(1) 校验
+    const allTools = new Set();
+    for (const category of Object.values(modulesHelp)) {
+        for (const filename of Object.keys(category)) {
+            allTools.add(filename);
+        }
+    }
+    const result = {};
+    for (const [moduleName, items] of Object.entries(quickCommands)) {
+        if (!Array.isArray(items)) {
+            throw new Error(`[quickCommands] 模块 "${moduleName}" 的值必须是数组，请检查 cag.config.js。`);
+        }
+        const resolved = [];
+        for (const item of items) {
+            if (!(item === null || item === void 0 ? void 0 : item.shortName) || !(item === null || item === void 0 ? void 0 : item.realTool) || !(item === null || item === void 0 ? void 0 : item.description)) {
+                throw new Error(`[quickCommands] 模块 "${moduleName}" 下存在缺失必填字段（shortName / realTool / description）的命令：` +
+                    JSON.stringify(item));
+            }
+            // custom 命令跳过 swagger 校验
+            if (!item.custom && !allTools.has(item.realTool)) {
+                throw new Error(`[quickCommands] 命令 "${moduleName} ${item.shortName}" 的 realTool="${item.realTool}" ` +
+                    `在 swagger 生成结果中不存在。请检查 cag.config.js 是否与最新 swagger 同步，` +
+                    `或对自定义命令显式标记 custom: true。`);
+            }
+            resolved.push({ ...item, module: moduleName });
+            logger(`resolved: ${moduleName} ${item.shortName} -> ${item.realTool}`);
+        }
+        result[moduleName] = resolved;
+    }
+    return result;
+}

package/built/skills.js

@@ -13,6 +13,8 @@ const generate_skill_cli_scripts_1 = require("./skills-tools/generate-skill-cli-
 const generate_skill_md_1 = require("./skills-tools/generate-skill-md");
 const generate_config_1 = require("./skills-tools/generate-config");
 const printer_skills_client_loader_1 = require("./codegen/printer/printer-skills-client-loader");
+const resolve_quick_commands_1 = require("./skills-tools/resolve-quick-commands");
+const generate_shortcuts_config_1 = require("./skills-tools/generate-shortcuts-config");
 const logger = (0, debug_1.default)('csg:main');
 async function start() {
     process.env.CNB_GENERATE_MODE = 'skills';
@@ -31,8 +33,12 @@ async function start() {
     const helpData = (0, generate_skill_cli_help_1.generateSkillCliHelp)(requestMap, defintionsMap);
     // 编译core
     await (0, printer_skills_client_core_1.printerSkillsClientCore)(helpData);
-    // 编译skills.md
-    await (0, generate_skill_md_1.generateSkillMd)(helpData, requestMap);
+    // 解析快捷命令配置（cag.config.js → 校验 → 结构化），同时驱动 client 运行时数据与 SKILL.md 文档
+    const quickCommandsByModule = (0, resolve_quick_commands_1.resolveQuickCommands)(helpData);
+    // 写入 client 运行时配置（core/shortcuts.config.json），替代 client/shortcuts.ts 中的硬编码常量
+    await (0, generate_shortcuts_config_1.generateShortcutsConfig)(quickCommandsByModule);
+    // 编译skills.md（使用同一份解析结果渲染 <$QUICK_COMMANDS$>）
+    await (0, generate_skill_md_1.generateSkillMd)(helpData, requestMap, quickCommandsByModule);
     // 生成config文件
     await (0, generate_config_1.generateConfig)();
 }

package/client/core.ts

@@ -135,6 +135,8 @@ async function clientFetch(data: any): Promise<any> {
     headers: {
       Authorization: `Bearer ${token}`,
       Accept: 'application/vnd.cnb.api+json',
+      // 当请求体存在时，附加 Content-Type，避免后端无法识别 JSON body
+      ...(data.data ? { 'Content-Type': 'application/vnd.cnb.api+json' } : {}),
       ...(data?.header || {}),
     },
   });

package/client/fetch-response-handler.ts

@@ -31,7 +31,10 @@ export async function fetchResponseHandler(fetchOriginParams: Record<string, any
     try {
       const converterExample = loadPlugin(converter);
       if (converterExample && typeof converterExample === 'function') {
-        return handler(converterExample, fetchOriginParams, response.data);
+        // handler 返回的是处理后的 data，应回填到 response.data，
+        // 然后返回完整的 response 对象（保留 status/trace/header/page 等包装字段）
+        const convertedData = await handler(converterExample, fetchOriginParams, response.data);
+        return { ...response, data: convertedData };
       }
     } catch (e) {
       console.error(`converter ${converter} not found`);

package/client/index.ts

@@ -7,6 +7,7 @@ import { registerFallbackAction } from './lib/register-fallback';
 import { registerLoginCommand } from './lib/login';
 import { registerLogoutCommand } from './lib/logout';
 import { registerStatusCommand } from './lib/status';
+import { registerGitCredentialCommand } from './lib/git-credential';
 
 // ============================================================
 // Commander 程序定义
@@ -30,6 +31,7 @@ program
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerStatusCommand(program);
+registerGitCredentialCommand(program);
 registerModuleCommands(program);
 registerFallbackAction(program);
 

package/client/lib/format-params.ts

@@ -70,7 +70,10 @@ export function formatParams(
 
     for (const [key, value] of Object.entries(params)) {
       if (reservedKeys.has(key)) continue;
-      // boolean 值需要特殊处理：嵌套对象的 boolean 子字段不能跳过
+      // boolean 值需要特殊处理：
+      //  1) 嵌套对象的 boolean 子字段应展开到 nestedObjectCollector
+      //  2) 顶层 body 中的 boolean 字段应直接写入 formatted.data
+      //  3) 其余未知 boolean 字段才跳过
       if (typeof value === 'boolean') {
         const nestedMapping = nestedFieldMap.get(key);
         if (nestedMapping && nestedMapping.leafSchema?.type === 'boolean') {
@@ -88,6 +91,23 @@ export function formatParams(
             target = target[subPathKeys[pi]];
           }
           target[subPathKeys[subPathKeys.length - 1]] = value;
+          continue;
+        }
+        // 顶层 body boolean 字段：直接写入 formatted.data
+        if (bodyProps[key] && bodyProps[key].type === 'boolean') {
+          if (!formatted.data) formatted.data = {};
+          formatted.data[key] = value;
+          continue;
+        }
+        // body 字段与 path/query 冲突时会被加 `d-` 前缀（详见 flatten-*-options.ts）；
+        // `d_` 形式与同文件下方非 boolean 分支保持一致兼容
+        if (key.startsWith('d-') || key.startsWith('d_')) {
+          const originalKey = key.replace(/^d[-_]/, '');
+          if (bodyProps[originalKey] && bodyProps[originalKey].type === 'boolean') {
+            if (!formatted.data) formatted.data = {};
+            formatted.data[originalKey] = value;
+            continue;
+          }
         }
         continue;
       }

package/client/lib/git-credential.ts

@@ -0,0 +1,182 @@
+import { Command } from 'commander';
+import { resolveToken } from '../utils/resolve-token';
+
+/**
+ * 用作 git credential helper。
+ *
+ * 在 .gitconfig 中配置：
+ * [credential]
+ *   helper = "<cli> git-credential"
+ *   useHttpPath = true
+ *
+ * git 在执行需要凭据的操作时，会以 `get`、`store`、`erase` 之一作为 action 调用本命令，
+ * 并通过 stdin 传入若干 `key=value` 形式的字段（protocol/host/path 等）。
+ * 我们仅处理 `get`：根据 host 白名单校验后，从后端获取凭据，按 git-credential
+ * 协议把 `username=...` / `password=...` 写到 stdout；`store` / `erase` 直接忽略。
+ */
+
+interface GitCredentialInput {
+  protocol?: string;
+  host?: string;
+  path?: string;
+  [key: string]: string | undefined;
+}
+
+interface Credential {
+  username: string;
+  password: string;
+}
+
+const ALLOWED_HOSTS = ['cnb.cool', 'cnb.woa.com'];
+
+/** git-credential get 等待 stdin 的最长时间，避免 git 无限挂起。 */
+const GET_INPUT_TIMEOUT_MS = 8000;
+
+export function registerGitCredentialCommand(program: Command): void {
+  program
+    .command('git-credential <action>')
+    .description('作为 git credential helper，向 git 提供 CNB 凭据（仅供 git 内部调用）')
+    .allowUnknownOption()
+    .allowExcessArguments()
+    .helpOption('-h, --help', '显示帮助文档')
+    .action(async (action: string, _opts, cmd: Command) => {
+      // 透传给用户：剩余的位置参数都视为自定义参数
+      const customArgs = cmd.args.slice(0, -1);
+      if (customArgs.length > 0) {
+        console.error(`[git-credential]: custom args: ${customArgs.join(' ')}`);
+      }
+
+      // store / erase：保持与原 helper 一致，忽略并退出 0
+      if (action === 'store' || action === 'erase') {
+        console.error(`[git-credential]: ${action} ignored`);
+        process.exit(0);
+      }
+
+      if (action !== 'get') {
+        console.error(`[git-credential]: unknown action: ${action}`);
+        process.exit(1);
+      }
+
+      // get：从 stdin 读取字段并输出凭据
+      try {
+        const input = await readStdin(GET_INPUT_TIMEOUT_MS);
+        const data = parseText(input, '=') as GitCredentialInput;
+        normalizePath(data);
+
+        await auth(data);
+        process.exit(0);
+      } catch (err: any) {
+        console.error(err?.message ? err.message : String(err));
+        process.exit(2);
+      }
+    });
+}
+
+/**
+ * 校验白名单并向后端获取凭据，按照 git-credential 协议输出 username/password。
+ */
+async function auth(data: GitCredentialInput): Promise<void> {
+  const { host } = data;
+  console.error(
+    `[git-credential]: for ${data.protocol}://${data.host}/${data.path ?? ''}`,
+  );
+
+  // 必须校验域名，否则传入第三方域名就会被盗密码
+  if (!host || !ALLOWED_HOSTS.includes(host)) {
+    throw new Error(`unknown host: ${host}`);
+  }
+
+  const credential = await fetchCredential(data);
+
+  // git-credential 协议：通过 stdout 输出 key=value
+  process.stdout.write(`username=${credential.username}\n`);
+  process.stdout.write(`password=${credential.password}\n`);
+
+  console.error('[git-credential]: done');
+}
+
+async function fetchCredential(_data: GitCredentialInput): Promise<Credential> {
+  // 使用 resolveToken 获取 access_token 作为 password，username 固定为 cnb
+  const token = await resolveToken();
+  return {
+    username: 'cnb',
+    password: token,
+  };
+}
+
+/**
+ * git-credential 协议中 path 通常包含仓库目录，需要规范化。
+ */
+function normalizePath(data: GitCredentialInput): void {
+  if (!data.path) return;
+  if (data.path.endsWith('.git')) {
+    data.path = data.path.slice(0, -4);
+  } else if (data.path.endsWith('.git/info/lfs')) {
+    data.path = data.path.slice(0, -13);
+  }
+}
+
+/**
+ * 从 stdin 收集所有数据。
+ *
+ * 同原始 helper 一致：必须设置超时，否则 git 在拿不到响应时会让用户输入账号密码，
+ * 进而把进程挂起。同时支持单字节回车（0x0a）作为提前结束的信号。
+ */
+function readStdin(timeoutMs: number): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const buff: Buffer[] = [];
+    let settled = false;
+
+    const finish = (): void => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(Buffer.concat(buff).toString('utf-8'));
+    };
+
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      console.error('[git-credential]: timeout occurred');
+      reject(new Error('stdin timeout'));
+    }, timeoutMs);
+
+    process.stdin.on('data', (chunk: Buffer) => {
+      buff.push(chunk);
+      // git 会在最后发送一个空行（仅一个 \n）作为结束标志
+      if (chunk.length === 1 && chunk[0] === 0x0a) {
+        finish();
+      }
+    });
+
+    process.stdin.on('end', () => {
+      finish();
+    });
+
+    process.stdin.on('error', (err) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+
+/**
+ * 把 git 通过 stdin 传入的多行 key=value 文本解析为对象。
+ */
+function parseText(content: string, separator: string): Record<string, string> {
+  return content
+    .split(/(?:\r\n|\r|\n)/)
+    .filter(Boolean)
+    .map((line) => {
+      const idx = line.indexOf(separator);
+      const key = idx >= 0 ? line.substring(0, idx).trim() : line.trim();
+      const value = idx >= 0 ? line.substring(idx + 1).trim() : '';
+      return { key, value };
+    })
+    .reduce<Record<string, string>>((acc, { key, value }) => {
+      if (key) acc[key] = value;
+      return acc;
+    }, {});
+}

package/client/shortcuts.ts

@@ -28,6 +28,8 @@ export interface ShortcutDefinition {
   autoData?: Record<string, any>;
   /** --data 的使用提示（展示用） */
   dataTip?: string;
+  /** 上传命令的资源种类（file/image），仅 upload 命令使用，默认 'file' */
+  kind?: 'file' | 'image';
 }
 
 export interface ResolvedShortcut {
@@ -41,6 +43,8 @@ export interface ResolvedShortcut {
   autoData: Record<string, any> | null;
   /** 是否为上传命令 */
   upload: boolean;
+  /** 上传命令的资源种类（file/image），仅 upload 时有意义 */
+  kind?: 'file' | 'image';
 }
 
 // ============================================================
@@ -69,36 +73,39 @@ function getPRNumber(): string {
 // 快捷命令定义
 // ============================================================
 
-export const ISSUE_SHORTCUTS: ShortcutDefinition[] = [
-  { shortName: 'get',            realTool: 'get-issue',            description: '获取详情' },
-  { shortName: 'list-comments',  realTool: 'list-issue-comments',  description: '获取评论列表' },
-  { shortName: 'comment',        realTool: 'post-issue-comment',   description: '评论',           dataTip: "--body 内容" },
-  { shortName: 'close',          realTool: 'update-issue',         description: '关闭',           autoData: { state: 'closed', state_reason: 'completed' } },
-  { shortName: 'open',           realTool: 'update-issue',         description: '打开',           autoData: { state: 'open', state_reason: 'reopened' } },
-  { shortName: 'list-labels',    realTool: 'list-issue-labels',    description: '查看标签' },
-  { shortName: 'add-labels',     realTool: 'post-issue-labels',    description: '添加标签',        dataTip: "--labels bug --labels feature" },
-  { shortName: 'list-assignees', realTool: 'list-issue-assignees', description: '查看处理人' },
-  { shortName: 'add-assignees',  realTool: 'post-issue-assignees', description: '添加处理人',      dataTip: "--assignees username" },
-  { shortName: 'upload-file',    realTool: 'post-issue-file-asset-upload-url',  description: '上传文件', upload: true, dataTip: "--file 文件路径" },
-  { shortName: 'upload-image',   realTool: 'post-issue-image-asset-upload-url', description: '上传图片', upload: true, dataTip: "--file 图片路径" },
-];
-
-export const PR_SHORTCUTS: ShortcutDefinition[] = [
-  { shortName: 'get',            realTool: 'get-pull',                description: '获取详情' },
-  { shortName: 'list-files',     realTool: 'list-pull-files',         description: '获取文件变更' },
-  { shortName: 'list-commits',   realTool: 'list-pull-commits',       description: '获取提交记录' },
-  { shortName: 'list-comments',  realTool: 'list-pull-comments',      description: '获取评论列表' },
-  { shortName: 'comment',        realTool: 'post-pull-comment',       description: '评论',           dataTip: "--body 内容" },
-  { shortName: 'list-labels',    realTool: 'list-pull-labels',        description: '查看标签' },
-  { shortName: 'add-labels',     realTool: 'post-pull-labels',        description: '添加标签',        dataTip: "--labels ready --labels approved" },
-  { shortName: 'check-status',   realTool: 'list-pull-commit-statuses', description: '查看 CI 状态' },
-  { shortName: 'list-reviews',   realTool: 'list-pull-reviews',       description: '查看评审列表' },
-  { shortName: 'list-assignees', realTool: 'list-pull-assignees',     description: '查看处理人' },
-  { shortName: 'upload-file',    realTool: 'upload-files',  description: '上传文件', repoOnly: true, upload: true, dataTip: "--file 文件路径" },
-  { shortName: 'upload-image',   realTool: 'upload-imgs',  description: '上传图片', repoOnly: true, upload: true, dataTip: "--file 图片路径" },
-  { shortName: 'get-ci-logs', realTool: '__get-ci-logs__', description: '获取 CI 失败日志', repoOnly: true, custom: true, dataTip: "--sn 构建号（可选）" },
-  { shortName: 'get-ci-timing', realTool: '__get-ci-timing__', description: '分析 CI 耗时瓶颈', repoOnly: true, custom: true, dataTip: "--sn 构建号（可选）" },
-];
+// ============================================================
+// 快捷命令定义
+// ============================================================
+//
+// 数据由 csg 构建期从 cag.config.js 的 quickCommands 字段派生，
+// 写入同级目录下的 shortcuts.config.json。本文件仅负责加载并暴露给
+// 其它模块（register-modules.ts / execute-action.ts / utils/upload.ts）。
+//
+// 编译产物中本文件位于 <skillScriptDir>/core/shortcuts.js，
+// JSON 文件位于 <skillScriptDir>/core/shortcuts.config.json，二者同级。
+// 源码态时 client/shortcuts.config.json 不存在（只在 csg 构建后生成），
+// 因此用 try/catch 兜底，源码态返回空数组以便单元测试与类型检查。
+
+interface ShortcutsConfigJson {
+  [moduleName: string]: ShortcutDefinition[];
+}
+
+function loadShortcutsConfig(): ShortcutsConfigJson {
+  try {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    return require('./shortcuts.config.json') as ShortcutsConfigJson;
+  } catch {
+    // 源码/测试态没有产物 JSON，返回空配置。
+    return {};
+  }
+}
+
+const SHORTCUTS_CONFIG = loadShortcutsConfig();
+
+export const ISSUE_SHORTCUTS: ShortcutDefinition[] =
+  SHORTCUTS_CONFIG.issues || [];
+
+export const PR_SHORTCUTS: ShortcutDefinition[] = SHORTCUTS_CONFIG.pulls || [];
 
 // ============================================================
 // --short 帮助输出
@@ -267,6 +274,7 @@ export function resolveShortcut(
     autoPath,
     autoData,
     upload: !!matched.upload,
+    kind: matched.kind,
   };
 }
 

package/client/utils/get-token-env-key.ts

@@ -0,0 +1,7 @@
+// connector name 由 WorkBuddy 与 CLI 团队约定，CLI 写死
+const CONNECTOR_NAME = 'cnb-app';
+
+export function getTokenEnvKey(): string {
+  // cnb-app → WORKBUDDY_TOKEN_URL_CNB_APP
+  return `WORKBUDDY_TOKEN_URL_${CONNECTOR_NAME.toUpperCase().replace(/-/g, '_')}`;
+}

package/client/utils/is-workbuddy-sandbox.ts

@@ -0,0 +1,3 @@
+export function isWorkBuddySandbox(): boolean {
+  return !!process.env.AGENTOS_RUNTIME_ID;
+}

package/client/utils/refresh-token.ts

@@ -10,7 +10,7 @@ export async function refreshAccessToken(store: TokenStore): Promise<string> {
     throw new Error('no refresh_token');
   }
 
-  const platformURL = store.platform_url || 'https://cnb-dev.woa.com';
+  const platformURL = store.platform_url || 'https://cnb.cool';
   const clientID = store.client_id || process.env.OAUTH2_CLIENT_ID || 'cnb_cli';
   const tokenURL = `${platformURL.replace(/\/+$/, '')}/oauth2/token`;
 

package/client/utils/resolve-token.ts

@@ -1,3 +1,5 @@
+import { getTokenEnvKey } from './get-token-env-key';
+import { isWorkBuddySandbox } from './is-workbuddy-sandbox';
 import { loadToken } from './load-token';
 import { refreshAccessToken } from './refresh-token';
 
@@ -9,6 +11,38 @@ import { refreshAccessToken } from './refresh-token';
  * 刷新失败或无 refresh_token 时终止进程并提示用户重新登录。
  */
 export async function resolveToken(): Promise<string> {
+  // WorkBuddy 沙箱环境，从远程接口获取 token
+  if (isWorkBuddySandbox()) {
+    const tokenURL = process.env[getTokenEnvKey()];
+    if (!tokenURL) {
+      console.error(`未找到环境变量 ${getTokenEnvKey()}，无法在 WorkBuddy 沙箱环境中获取 token。`);
+      process.exit(1);
+    }
+
+    try {
+      const resp = await fetch(tokenURL, {
+        method: 'GET',
+        headers: { Accept: 'application/json' },
+      });
+
+      if (!resp.ok) {
+        console.error(`从 WorkBuddy 获取 token 失败，HTTP 状态码: ${resp.status} ${resp.statusText}`);
+        process.exit(1);
+      }
+
+      const body: any = await resp.json();
+      if (body?.code !== 0 || !body?.data?.access_token) {
+        console.error(`从 WorkBuddy 获取 token 失败，响应内容异常: ${JSON.stringify(body)}`);
+        process.exit(1);
+      }
+
+      return body.data.access_token as string;
+    } catch (err: any) {
+      console.error(`从 WorkBuddy 获取 token 失败: ${err?.message || err}`);
+      process.exit(1);
+    }
+  }
+
   // 环境变量优先 CodeBuddy
   if (process.env.CNB_TOKEN_FOR_CODEBUDDY) {
     if (!process.env.CNB_NPC_SLUG && process.env.CNB_NPC_NAME === 'CodeBuddy') {

package/client/utils/upload.ts

@@ -72,42 +72,57 @@ function mimeLookup(filePath: string): string {
 // 上传文件大小上限：100MB
 const MAX_FILE_SIZE = 100 * 1024 * 1024;
 
-/** 上传 API 的 path 参数 */
+/** 上传 API 的 path 参数（issue 走 asset-group 流程时只需要 repo） */
 interface UploadPathParams {
   repo: string;
   number?: string;
 }
 
-/** Issue 上传请求体 */
-interface IssueUploadBody {
+/** Issue asset-group 单条附件的描述（请求体里的元素） */
+interface AssetItem {
   name: string;
   size: number;
   content_type: string;
 }
 
+/** Issue asset-group 创建请求体 */
+interface IssueAssetGroupBody {
+  file_assets?: AssetItem[];
+  image_assets?: AssetItem[];
+}
+
 /** Pull 上传请求体 */
 interface PullUploadBody {
   name: string;
   size: number;
 }
 
-/** 上传 API 函数签名 */
-type UploadApiFunction = (
-  params: UploadPathParams,
-  body: IssueUploadBody | PullUploadBody,
-) => Promise<UploadApiResponse>;
-
-/** 上传 API 响应 */
-interface UploadApiResponse {
-  status?: number;
-  data?: {
-    upload_url?: string;
-    asset_link?: string;
-    assets?: { name?: string; path?: string };
-    token?: string;
-  };
+/** Issue asset-group 接口响应（与 swagger 一致；只列出我们用到的字段） */
+interface AssetUploadEntry {
+  name?: string;
+  path?: string;
+  asset_link?: string;
+  upload_url?: string;
+}
+interface IssueAssetGroupResponseData {
+  asset_group_id?: string;
+  file_upload_urls?: AssetUploadEntry[];
+  image_upload_urls?: AssetUploadEntry[];
+}
+
+/** Pull 上传 API 响应 */
+interface PullUploadResponseData {
+  upload_url?: string;
+  assets?: { name?: string; path?: string };
+  token?: string;
 }
 
+/** 上传 API 函数签名（issue 与 pull 分别由对应的 swagger 函数承担，统一为 (firstArg, body)） */
+type UploadApiFunction = (
+  firstArg: UploadPathParams | string,
+  body: IssueAssetGroupBody | PullUploadBody,
+) => Promise<{ status?: number; data?: IssueAssetGroupResponseData | PullUploadResponseData }>;
+
 /** 上传失败时的 data */
 interface UploadErrorData {
   error: string;
@@ -117,6 +132,7 @@ interface UploadErrorData {
 /** Issue 上传成功时的 data */
 interface IssueUploadData {
   asset_link?: string;
+  asset_group_id?: string;
   name: string;
   size: number;
 }
@@ -137,10 +153,21 @@ interface UploadResult {
 
 /**
  * 处理完整上传流程
- * @param shortcut 解析后的快捷命令
- * @param filePath 本地文件路径
- * @param toolFunction 原始上传 API 函数（获取 upload_url）
- * @param pathParams API 调用的 path 参数（repo 或 {repo, number}）
+ *
+ * Issue 路径（走 asset-group 一次性接口）：
+ *   1. POST /{repo}/-/issues/asset-groups 携带 file_assets 或 image_assets
+ *      → 服务端创建 asset_group 并返回 upload_url + asset_link
+ *   2. PUT 文件流到 upload_url
+ *   3. 返回 asset_link 给调用方拼到评论或 issue 描述里
+ *
+ * Pull 路径（保留原有的 upload-files / upload-imgs 一步上传）：
+ *   1. POST /{repo}/upload-files（或 imgs） 拿 upload_url
+ *   2. PUT 文件流到 upload_url
+ *
+ * @param shortcut    解析后的快捷命令；shortcut.kind 决定 issue 上传走 file 还是 image 通道
+ * @param filePath    本地文件路径
+ * @param toolFunction 原始上传 API 函数
+ * @param pathParams  API 调用的 path 参数（issue 只需 repo；pull 也只需 repo）
  */
 export async function handleUpload(
   shortcut: ResolvedShortcut,
@@ -177,21 +204,46 @@ export async function handleUpload(
 
   // 2. 调用上传 API 获取 upload_url
   const isIssueUpload = shortcut.module === 'issues';
-  const requestBody = isIssueUpload
-    ? { name: fileName, size: fileSize, content_type: contentType }
-    : { name: fileName, size: fileSize };
+  const isImageKind = shortcut.kind === 'image';
+
+  let uploadUrl: string | undefined;
+  let issueAssetLink: string | undefined;
+  let issueAssetGroupId: string | undefined;
+  let pullResponseData: PullUploadResponseData | undefined;
+
+  if (isIssueUpload) {
+    // Issue: 调 post-asset-group，一次拿 asset_group_id + upload_url + asset_link
+    // 函数签名：(repo: string, { file_assets | image_assets }, ...)
+    const assetItem: AssetItem = { name: fileName, size: fileSize, content_type: contentType };
+    const requestBody: IssueAssetGroupBody = isImageKind
+      ? { image_assets: [assetItem] }
+      : { file_assets: [assetItem] };
+
+    const apiResponse = await toolFunction(pathParams.repo, requestBody);
+    const data = apiResponse?.data as IssueAssetGroupResponseData | undefined;
 
-  // Issue API 签名: fn({ repo, number }, body)
-  // PR API 签名:    fn(repo, body)
-  const apiFirstArg: any = isIssueUpload ? pathParams : pathParams.repo;
-  const uploadResponse = await toolFunction(apiFirstArg, requestBody);
+    // 服务端可能返回 201/200，从对应数组里取第一条 upload 描述
+    const entries = isImageKind ? data?.image_upload_urls : data?.file_upload_urls;
+    const entry = entries?.[0];
+    uploadUrl = entry?.upload_url;
+    issueAssetLink = entry?.asset_link;
+    issueAssetGroupId = data?.asset_group_id;
 
-  // 提取 upload_url
-  const responseData = uploadResponse?.data;
-  const uploadUrl = responseData?.upload_url;
+    if (!uploadUrl) {
+      // 拿 URL 失败：把原始响应作为错误返回，便于排查
+      return apiResponse as unknown as UploadResult;
+    }
+  } else {
+    // Pull: 沿用原有"一步走"上传接口
+    // 函数签名：(repo: string, { name, size }, ...)
+    const requestBody: PullUploadBody = { name: fileName, size: fileSize };
+    const apiResponse = await toolFunction(pathParams.repo, requestBody);
+    pullResponseData = apiResponse?.data as PullUploadResponseData | undefined;
+    uploadUrl = pullResponseData?.upload_url;
 
-  if (!uploadUrl) {
-    return uploadResponse as unknown as UploadResult; // 获取 URL 失败，直接返回原始错误
+    if (!uploadUrl) {
+      return apiResponse as unknown as UploadResult;
+    }
   }
 
   // 3. PUT 文件内容到 upload_url（流式读取，避免大文件撑爆内存）
@@ -230,7 +282,8 @@ export async function handleUpload(
     return {
       status: 200,
       data: {
-        asset_link: responseData.asset_link,
+        asset_link: issueAssetLink,
+        asset_group_id: issueAssetGroupId,
         name: fileName,
         size: fileSize,
       },
@@ -240,10 +293,10 @@ export async function handleUpload(
   return {
     status: 200,
     data: {
-      name: responseData.assets?.name || fileName,
-      path: responseData.assets?.path,
+      name: pullResponseData?.assets?.name || fileName,
+      path: pullResponseData?.assets?.path,
       size: fileSize,
-      token: responseData.token,
+      token: pullResponseData?.token,
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cnbcool/cnb-api-generate",
-  "version": "2.5.0",
+  "version": "2.6.0",
   "main": "./built/index.js",
   "module": "./src/index.ts",
   "types": "./src/index.ts",

package/skills-template/SKILL.md

@@ -9,33 +9,7 @@ description: CNB 平台交互命令，支持仓库、Issue、PR、流水线、
 
 ## 快捷命令
 
-issues:
-- `<$CNB_CLI_CMD$> issues get` — 获取当前 Issue 详情
-- `<$CNB_CLI_CMD$> issues list-comments` — 列出当前 Issue 评论
-- `<$CNB_CLI_CMD$> issues comment --body '内容'` — 发表评论到当前 Issue
-- `<$CNB_CLI_CMD$> issues close` — 关闭当前 Issue
-- `<$CNB_CLI_CMD$> issues open` — 打开当前 Issue
-- `<$CNB_CLI_CMD$> issues list-labels` — 列出当前 Issue 标签
-- `<$CNB_CLI_CMD$> issues add-labels --labels bug --labels feature` — 添加标签到当前 Issue
-- `<$CNB_CLI_CMD$> issues list-assignees` — 查看当前 Issue 处理人
-- `<$CNB_CLI_CMD$> issues add-assignees --assignees username` — 添加处理人到当前 Issue
-- `<$CNB_CLI_CMD$> issues upload-file --file 文件路径` — 上传文件到当前 Issue
-- `<$CNB_CLI_CMD$> issues upload-image --file 图片路径` — 上传图片到当前 Issue
-
-pulls:
-- `<$CNB_CLI_CMD$> pulls get` — 获取当前 PR 详情
-- `<$CNB_CLI_CMD$> pulls list-files` — 列出当前 PR 变更文件
-- `<$CNB_CLI_CMD$> pulls list-commits` — 列出当前 PR 提交记录
-- `<$CNB_CLI_CMD$> pulls list-comments` — 列出当前 PR 评论
-- `<$CNB_CLI_CMD$> pulls comment --body '内容'` — 发表 PR 评论
-- `<$CNB_CLI_CMD$> pulls list-labels` — 列出当前 PR 标签
-- `<$CNB_CLI_CMD$> pulls add-labels --labels ready --labels approved` — 添加标签到当前 PR
-- `<$CNB_CLI_CMD$> pulls check-status` — 获取当前 PR 的 CI 状态
-- `<$CNB_CLI_CMD$> pulls get-ci-logs` — 获取当前 PR 的 CI 构建日志
-- `<$CNB_CLI_CMD$> pulls list-reviews` — 查看当前当前的评审列表
-- `<$CNB_CLI_CMD$> pulls list-assignees` — 查看当前 PR 处理人
-- `<$CNB_CLI_CMD$> pulls upload-file --file 文件路径` — 上传文件到当前 PR
-- `<$CNB_CLI_CMD$> pulls upload-image --file 图片路径` — 上传图片到当前 PR
+<$QUICK_COMMANDS$>
 
 注意事项：
 - **链接结构**：Issue 链接格式为 `<host>/<slug>/-/issues/<number>`，PR 链接格式为 `<host>/<slug>/-/pulls/<number>`。在生成或引用链接时请遵循此结构。