@dinoxx/dinox-cli 2.9.0 → 2.11.0

package/README.md

@@ -103,7 +103,7 @@ winget install OpenJS.NodeJS.LTS
 dino update
 ```
 
-它会自动根据你当前的安装方式选择合适的包管理器执行更新。
+它会自动根据你当前的安装方式选择合适的包管理器执行更新。升级完成后会检查本机已安装的 Agent：有 `claude` 但没有 ACP 命令时安装 `@agentclientprotocol/claude-agent-acp`，有 `codex` 时安装 `@agentclientprotocol/codex-acp`，有 `zcode` 时安装 `zcode-acp`。已经装过的适配器会跳过；某个适配器安装失败只给出警告，不影响 CLI 升级本身。
 
 ---
 
@@ -113,42 +113,38 @@ dino update
 
 ### 第 1 步：登录
 
+在自己的终端运行：
+
 ```bash
-read -rs DINOX_TOKEN
-printf '%s' "$DINOX_TOKEN" | dino auth login --token-stdin
-unset DINOX_TOKEN
+dino auth login
 ```
 
-说明：
-
-- 第一行会在当前终端隐藏输入 token，避免 token 出现在命令参数和 shell 历史中
-- `--token-stdin` 接受 token 本体或 `Bearer ...`
-- 登录时 CLI 会顺便验证连接是否可用
-- 自动化或 CI 可以改用 `DINOX_TOKEN` 环境变量注入 token；它优先于本地配置，并支持 token 本体或 `Bearer ...`
-
-### 第 2 步：同步数据到本地
+终端会显示二维码。用 Dinox App 打开 **设置 → 设备配对 → 扫一扫**，扫码确认即可。登录时会完成首次同步，之后的读取命令会自动启动本地 daemon，一般不用再手动执行 `dino sync` 或 `dino auth status`。
 
-```bash
-dino sync
-```
+如果 App 提示二维码无效，先升级 Dinox App。这条命令最长等待 10 分钟。
 
-这一步会把 Dinox 数据同步到本地 SQLite 数据库，后续很多查询都会直接使用本地缓存。
+#### CI / 自动化
 
-### 第 3 步：确认当前状态
+没有人可以扫码时，继续用 token。token 可在 App 的 **设置 → 同步设置 → API Token** 获取。
 
 ```bash
-dino auth status
+read -rs DINOX_TOKEN
+printf '%s' "$DINOX_TOKEN" | dino auth login --token-stdin
+unset DINOX_TOKEN
 ```
 
-你会看到当前是否已登录、本地数据库位置、最近同步状态等信息。
+说明：
+
+- `--token-stdin` 接受 token 本体或 `Bearer ...`
+- 也可以只在当前进程注入 `DINOX_TOKEN`（优先于本地配置，支持 token 本体或 `Bearer ...`），不写入配置文件
 
-### 第 4 步：搜索一条笔记试试
+### 第 2 步：搜索一条笔记试试
 
 ```bash
 dino note search "AI"
 ```
 
-### 第 5 步：新建一条笔记试试
+### 第 3 步：新建一条笔记试试
 
 ```bash
 dino note create \
@@ -157,7 +153,7 @@ dino note create \
   --type note
 ```
 
-如果你能顺利完成上面 5 步，说明 CLI 已经可以正常使用。
+如果你能顺利完成上面 3 步，说明 CLI 已经可以正常使用。
 
 ---
 
@@ -692,6 +688,7 @@ dino note search "AI" --offline --format json
 ### 6.2 `auth`：登录与状态
 
 ```bash
+dino auth login
 read -rs DINOX_TOKEN
 printf '%s' "$DINOX_TOKEN" | dino auth login --token-stdin
 unset DINOX_TOKEN
@@ -702,7 +699,8 @@ dino auth logout --clear-local-db
 
 用途说明：
 
-- `login`：保存 token 并验证连接
+- `login`：不带 token 时在终端显示二维码，用 Dinox App「设置 → 设备配对 → 扫一扫」确认登录；也可以保存 token 并验证连接
+- 登录会完成首次同步。CI / 自动化没有扫码条件时，用 `--token-stdin` 或 `DINOX_TOKEN`
 - `status`：查看登录状态、本地库位置、同步状态
 - `logout`：退出登录
 - `logout --clear-local-db`：退出并删除本地 SQLite 缓存
@@ -949,7 +947,7 @@ dino gateway reload
 dino gateway remove Hermes
 ```
 
-`detect` 会在 `PATH` 上查找 ACP agent，并用真实握手确认能否启动。`--add` 把已确认的 agent 写入当前账号的 gateway 配置，并由 daemon 托管。`gateway list` 只显示环境变量名，不显示值。`dino gateway mcp` 由这些 agent 拉起，对外提供只读的 Dinox 知识工具。
+`detect` 会在 `PATH` 上查找 ACP agent，并用真实握手确认能否启动。覆盖范围与 [Paseo 的 ACP catalog](https://github.com/getpaseo/paseo/blob/main/packages/app/src/data/acp-provider-catalog.ts) 对齐，只认本机已经装好的命令，不会为了探测去 `npx -y` 下载。每个 agent 一握手完就打印，不用等最慢的那个。某个启动方式一直不应答时，不再换参数重试。`--add` 把已确认的 agent 写入当前账号的 gateway 配置，并由 daemon 托管。`gateway list` 只显示环境变量名，不显示值。`dino gateway mcp` 由这些 agent 拉起，对外提供只读的 Dinox 知识工具。
 
 ### 6.16 `info`：查看版本与技能仓库地址
 
@@ -963,6 +961,8 @@ dino info
 dino update
 ```
 
+升级 CLI 之后，会为本机已有、但还没有 ACP 命令的 Agent 安装适配器（Claude Code、Codex、ZCode）。`--format json` 的 `acpAdapters` 返回每一项的 `installed` 或 `failed`。
+
 ---
 
 ## 7. AI / 脚本自动化
@@ -1008,13 +1008,12 @@ schema 包含命令路径、风险级别、参数、选项、输出字段和示
 
 原因：你还没有完成登录，或当前 `DINOX_TOKEN` 环境变量覆盖了本地 token，CLI 需要先在线解析这个 token 对应的用户身份。
 
-解决：
+解决：在自己的终端运行 `dino auth login`，用 Dinox App 扫码。CI 或已有 token 时：
 
 ```bash
 read -rs DINOX_TOKEN
 printf '%s' "$DINOX_TOKEN" | dino auth login --token-stdin
 unset DINOX_TOKEN
-dino sync
 ```
 
 如果你使用环境变量登录，确认 `DINOX_TOKEN` 已设置后直接运行一次在线命令：
@@ -1193,11 +1192,10 @@ dino schema <path> --format json
 如果你是第一次用，建议按下面顺序熟悉：
 
 1. `dino auth login`
-2. `dino sync`
-3. `dino note search`
-4. `dino note create`
-5. `dino todo search`
-6. `dino tag add` / `dino box add`
-7. `dino schema`
+2. `dino note search`
+3. `dino note create`
+4. `dino todo search`
+5. `dino tag add` / `dino box add`
+6. `dino schema`
 
 这样会最快建立完整使用感。

package/dist/auth/devicePair.d.ts

@@ -0,0 +1,62 @@
+import type { DinoxConfig } from '../config/types.js';
+export declare const CLI_DEVICE_TYPE = "cli";
+export declare const DEVICE_PAIR_POLL_INTERVAL_MS = 2000;
+export declare const DEVICE_PAIR_MAX_WAIT_MS: number;
+export declare class DevicePairCancelled extends Error {
+    constructor();
+}
+export type DevicePairConfigStore = {
+    load: () => Promise<DinoxConfig>;
+    update: (update: (current: DinoxConfig) => DinoxConfig | Promise<DinoxConfig>) => Promise<DinoxConfig>;
+};
+type FetchLike = typeof fetch;
+export declare function deviceNameFromHostname(hostname: string): string;
+export declare function buildDevicePairQrUrl(ticket: string, deviceName: string): string;
+/** Origin of the configured PowerSync token endpoint. Pairing routes live on that same host. */
+export declare function authApiBaseFromTokenEndpoint(tokenEndpoint: string): string;
+export declare function renderTerminalQr(url: string): Promise<string>;
+export declare function delay(ms: number, signal?: AbortSignal): Promise<void>;
+export declare function ensureCliDeviceId(store: DevicePairConfigStore, randomUUID: () => string): Promise<string>;
+export declare function revokeDeviceBinding(input: {
+    apiBase: string;
+    deviceBindingId: string;
+    authorization: string;
+    fetchImpl?: FetchLike;
+}): Promise<{
+    revoked: boolean;
+    warning?: string;
+}>;
+export declare function prepareCliDevice(input: {
+    store: DevicePairConfigStore;
+    apiBase: string;
+    authorization?: string;
+    deviceBindingId?: string;
+    fetchImpl?: FetchLike;
+    randomUUID: () => string;
+}): Promise<{
+    deviceId: string;
+    revokeWarning?: string;
+}>;
+export declare function saveDevicePairResult(input: {
+    store: DevicePairConfigStore;
+    deviceBindingId: string;
+}): Promise<void>;
+export type DevicePairLoginResult = {
+    token: string;
+    deviceBindingId?: string;
+    userNo?: string;
+};
+export declare function pollDevicePairLogin(input: {
+    apiBase: string;
+    deviceId: string;
+    deviceName: string;
+    fetchImpl?: FetchLike;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    renderQr?: (url: string) => Promise<string>;
+    writeStderr?: (text: string) => void;
+    signal?: AbortSignal;
+    pollIntervalMs?: number;
+    maxWaitMs?: number;
+}): Promise<DevicePairLoginResult>;
+export {};

package/dist/auth/devicePair.js

@@ -0,0 +1,377 @@
+import { toString as qrCodeToString } from 'qrcode';
+import { DinoxError } from '../utils/errors.js';
+import { toAuthorizationHeaderValue } from '../utils/authToken.js';
+export const CLI_DEVICE_TYPE = 'cli';
+export const DEVICE_PAIR_POLL_INTERVAL_MS = 2_000;
+export const DEVICE_PAIR_MAX_WAIT_MS = 10 * 60 * 1000;
+const DEVICE_PAIR_REQUEST_TIMEOUT_MS = 15_000;
+const AUTH_CODE_OK = '000000';
+const AUTH_CODE_INVALID = '000001';
+const AUTH_CODE_EXPIRED = '000002';
+const AUTH_CODE_PENDING = '000003';
+const AUTH_CODE_BOUND_ELSEWHERE = '000004';
+const TOKEN_LOGIN_HINT = 'printf \'%s\' "$TOKEN" | dino auth login --token-stdin';
+export class DevicePairCancelled extends Error {
+    constructor() {
+        super('Device pairing cancelled');
+        this.name = 'DevicePairCancelled';
+    }
+}
+export function deviceNameFromHostname(hostname) {
+    const stripped = hostname.replace(/\.local$/i, '').trim();
+    return stripped || 'Dinox CLI';
+}
+export function buildDevicePairQrUrl(ticket, deviceName) {
+    return `dinoxapp://device-pair?t=${encodeURIComponent(ticket)}&dt=${CLI_DEVICE_TYPE}&dn=${encodeURIComponent(deviceName)}`;
+}
+/** Origin of the configured PowerSync token endpoint. Pairing routes live on that same host. */
+export function authApiBaseFromTokenEndpoint(tokenEndpoint) {
+    try {
+        return new URL(tokenEndpoint).origin;
+    }
+    catch (error) {
+        throw new DinoxError(`Invalid token endpoint: ${tokenEndpoint}`, {
+            code: 'COMMAND_FAILED',
+            cause: error,
+        });
+    }
+}
+export function renderTerminalQr(url) {
+    return new Promise((resolve, reject) => {
+        qrCodeToString(url, { type: 'terminal', small: true }, (error, qr) => {
+            if (error)
+                reject(error);
+            else
+                resolve(qr);
+        });
+    });
+}
+export function delay(ms, signal) {
+    if (signal?.aborted)
+        return Promise.reject(new DevicePairCancelled());
+    if (ms <= 0)
+        return Promise.resolve();
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(finish, ms);
+        const onAbort = () => {
+            clearTimeout(timer);
+            reject(new DevicePairCancelled());
+        };
+        function finish() {
+            signal?.removeEventListener('abort', onAbort);
+            resolve();
+        }
+        signal?.addEventListener('abort', onAbort, { once: true });
+    });
+}
+export async function ensureCliDeviceId(store, randomUUID) {
+    const current = await store.load();
+    const existing = current.auth?.deviceId?.trim();
+    if (existing?.startsWith(`${CLI_DEVICE_TYPE}-`))
+        return existing;
+    const deviceId = `${CLI_DEVICE_TYPE}-${randomUUID()}`;
+    await store.update((config) => ({
+        ...config,
+        auth: {
+            ...(config.auth ?? {}),
+            deviceId,
+        },
+    }));
+    return deviceId;
+}
+export async function revokeDeviceBinding(input) {
+    const endpoint = `${input.apiBase}/auth/device/revoke`;
+    try {
+        const result = await postDeviceApi({
+            fetchImpl: input.fetchImpl ?? fetch,
+            url: endpoint,
+            body: { id: input.deviceBindingId },
+            authorization: input.authorization,
+        });
+        if (!result.ok) {
+            return { revoked: false, warning: revokeWarning(input.deviceBindingId, errorText(result.error)) };
+        }
+        if (result.code !== AUTH_CODE_OK) {
+            return {
+                revoked: false,
+                warning: revokeWarning(input.deviceBindingId, `${result.code} ${result.msg}`.trim()),
+            };
+        }
+        return { revoked: true };
+    }
+    catch (error) {
+        if (error instanceof DevicePairCancelled)
+            throw error;
+        return { revoked: false, warning: revokeWarning(input.deviceBindingId, errorText(error)) };
+    }
+}
+function revokeWarning(deviceBindingId, detail) {
+    return `warning: could not revoke paired device ${deviceBindingId} (${detail}). Continuing.`;
+}
+export async function prepareCliDevice(input) {
+    let revokeWarning;
+    let bindingReleased = true;
+    const bindingId = input.deviceBindingId?.trim();
+    if (bindingId) {
+        bindingReleased = false;
+        if (!input.authorization) {
+            revokeWarning = `warning: could not revoke paired device ${bindingId} (no saved token). Continuing.`;
+        }
+        else {
+            const revoked = await revokeDeviceBinding({
+                apiBase: input.apiBase,
+                deviceBindingId: bindingId,
+                authorization: input.authorization,
+                fetchImpl: input.fetchImpl,
+            });
+            if (revoked.revoked) {
+                bindingReleased = true;
+                await input.store.update((config) => ({
+                    ...config,
+                    auth: {
+                        ...(config.auth ?? {}),
+                        deviceBindingId: undefined,
+                    },
+                }));
+            }
+            else {
+                revokeWarning = revoked.warning;
+            }
+        }
+    }
+    // The server refuses a device id still actively bound to another account
+    // (000004, shown on the phone, never to the polling CLI). A released binding
+    // lets any account reuse the id; one that could not be released gets a fresh
+    // id before pairing, so switching accounts cannot hit that refusal.
+    if (!bindingReleased) {
+        const deviceId = `${CLI_DEVICE_TYPE}-${input.randomUUID()}`;
+        await input.store.update((config) => ({
+            ...config,
+            auth: { ...(config.auth ?? {}), deviceId, deviceBindingId: undefined },
+        }));
+        return { deviceId, revokeWarning };
+    }
+    const deviceId = await ensureCliDeviceId(input.store, input.randomUUID);
+    return { deviceId, revokeWarning };
+}
+export async function saveDevicePairResult(input) {
+    await input.store.update((config) => ({
+        ...config,
+        auth: { ...(config.auth ?? {}), deviceBindingId: input.deviceBindingId },
+    }));
+}
+export async function pollDevicePairLogin(input) {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const sleep = input.sleep ?? ((ms) => delay(ms, input.signal));
+    const now = input.now ?? (() => Date.now());
+    const renderQr = input.renderQr ?? renderTerminalQr;
+    const writeStderr = input.writeStderr ?? ((text) => { process.stderr.write(text); });
+    const pollIntervalMs = input.pollIntervalMs ?? DEVICE_PAIR_POLL_INTERVAL_MS;
+    const deadline = now() + (input.maxWaitMs ?? DEVICE_PAIR_MAX_WAIT_MS);
+    // Expiry is the server's call (000002): its `expireAt` has no time zone, so a
+    // local comparison would misjudge it on any machine in another zone.
+    let ticket = null;
+    let shownTicket = null;
+    const waitForNextPoll = async () => {
+        throwIfCancelled(input.signal);
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            return;
+        await sleep(Math.min(pollIntervalMs, remaining));
+        throwIfCancelled(input.signal);
+    };
+    const issueTicket = async () => {
+        const generated = await postDeviceApi({
+            fetchImpl,
+            url: `${input.apiBase}/auth/device/pair/qr/generate`,
+            body: { deviceId: input.deviceId },
+            signal: input.signal,
+        });
+        if (!generated.ok)
+            return false;
+        if (generated.code !== AUTH_CODE_OK) {
+            throw pairingBusinessError(generated.code, generated.msg);
+        }
+        const data = asRecord(generated.data);
+        const nextTicket = readString(data?.ticket);
+        if (!nextTicket) {
+            throw new DinoxError('Device pairing ticket response did not include a ticket.', {
+                code: 'AUTH_PAIRING_FAILED',
+                details: { backendCode: generated.code, backendMessage: generated.msg },
+            });
+        }
+        ticket = nextTicket;
+        // The server hands back the same ticket while it is still valid; reprint only a new one.
+        if (nextTicket !== shownTicket) {
+            shownTicket = nextTicket;
+            await showPairingQr({ ticket: nextTicket, deviceName: input.deviceName, renderQr, writeStderr });
+        }
+        return true;
+    };
+    while (now() < deadline) {
+        throwIfCancelled(input.signal);
+        if (!ticket) {
+            try {
+                const issued = await issueTicket();
+                if (!issued) {
+                    await waitForNextPoll();
+                    continue;
+                }
+            }
+            catch (error) {
+                if (error instanceof DinoxError || error instanceof DevicePairCancelled)
+                    throw error;
+                await waitForNextPoll();
+                continue;
+            }
+        }
+        if (!ticket)
+            continue;
+        let polled;
+        try {
+            polled = await postDeviceApi({
+                fetchImpl,
+                url: `${input.apiBase}/auth/device/pair/qr/token`,
+                body: {
+                    deviceId: input.deviceId,
+                    ticket,
+                    deviceType: CLI_DEVICE_TYPE,
+                    deviceName: input.deviceName,
+                },
+                signal: input.signal,
+            });
+        }
+        catch (error) {
+            if (error instanceof DevicePairCancelled)
+                throw error;
+            await waitForNextPoll();
+            continue;
+        }
+        if (!polled.ok) {
+            await waitForNextPoll();
+            continue;
+        }
+        if (polled.code === AUTH_CODE_OK) {
+            return readPairToken(polled.data, polled.code, polled.msg);
+        }
+        if (polled.code === AUTH_CODE_PENDING) {
+            await waitForNextPoll();
+            continue;
+        }
+        if (polled.code === AUTH_CODE_EXPIRED) {
+            ticket = null;
+            await waitForNextPoll();
+            continue;
+        }
+        throw pairingBusinessError(polled.code, polled.msg);
+    }
+    throw new DinoxError('Timed out waiting for the Dinox app to approve this device.', {
+        code: 'AUTH_PAIRING_TIMEOUT',
+        suggestion: 'Run `dino auth login` again and approve the QR code within 10 minutes.',
+    });
+}
+async function showPairingQr(input) {
+    const url = buildDevicePairQrUrl(input.ticket, input.deviceName);
+    const rendered = await input.renderQr(url);
+    input.writeStderr(rendered.endsWith('\n') ? rendered : `${rendered}\n`);
+    input.writeStderr('用 Dinox App 扫码：设置 → 设备配对 → 扫一扫\n');
+    input.writeStderr(`${url}\n`);
+    input.writeStderr(`App 提示二维码无效？请先升级 Dinox App，或改用 token 登录：\`${TOKEN_LOGIN_HINT}\`\n`);
+}
+function pairingBusinessError(code, msg) {
+    if (code === AUTH_CODE_INVALID && isUnsupportedDeviceType(msg)) {
+        return new DinoxError('This server does not support CLI device pairing yet (deviceType is not allowed).', {
+            code: 'AUTH_PAIRING_UNSUPPORTED',
+            details: { backendCode: code, backendMessage: msg },
+            suggestion: 'The Dinox server does not accept CLI QR login yet. Log in with a token via `dino auth login --token-stdin` for now.',
+            suggestedAction: {
+                command: 'dino auth login --token-stdin',
+                reason: 'The server rejected deviceType cli. Use token login until CLI pairing is enabled.',
+            },
+        });
+    }
+    const boundElsewhere = code === AUTH_CODE_BOUND_ELSEWHERE;
+    return new DinoxError(`Device pairing failed (${code}): ${msg || 'unknown error'}`, {
+        code: 'AUTH_PAIRING_FAILED',
+        details: { backendCode: code, backendMessage: msg },
+        suggestion: boundElsewhere
+            ? 'Remove this computer from the original account in the Dinox app under 我的设备, then run `dino auth login` again.'
+            : 'Retry `dino auth login`, or log in with a token via `dino auth login --token-stdin`.',
+    });
+}
+function isUnsupportedDeviceType(msg) {
+    return /deviceType/i.test(msg) && /不合法|invalid|illegal|unsupported/i.test(msg);
+}
+function readPairToken(data, code, msg) {
+    const record = asRecord(data);
+    const token = readString(record?.token);
+    if (!token) {
+        throw new DinoxError('Device pairing succeeded but did not return a token.', {
+            code: 'AUTH_PAIRING_FAILED',
+            details: { backendCode: code, backendMessage: msg },
+        });
+    }
+    return {
+        token,
+        deviceBindingId: readString(record?.deviceBindingId),
+        userNo: readString(record?.userNo),
+    };
+}
+async function postDeviceApi(input) {
+    throwIfCancelled(input.signal);
+    const timeout = AbortSignal.timeout(DEVICE_PAIR_REQUEST_TIMEOUT_MS);
+    const signal = input.signal ? AbortSignal.any([input.signal, timeout]) : timeout;
+    try {
+        const headers = { 'Content-Type': 'application/json' };
+        if (input.authorization)
+            headers.Authorization = toAuthorizationHeaderValue(input.authorization);
+        const response = await input.fetchImpl(input.url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify(input.body),
+            signal,
+        });
+        throwIfCancelled(input.signal);
+        const text = await response.text();
+        let payload;
+        try {
+            payload = text ? JSON.parse(text) : null;
+        }
+        catch (error) {
+            return { ok: false, error };
+        }
+        const record = asRecord(payload);
+        if (!record || record.code === undefined || record.code === null) {
+            return { ok: false, error: new Error(response.ok ? 'missing response code' : `HTTP ${response.status}`) };
+        }
+        return {
+            ok: true,
+            code: String(record.code),
+            msg: typeof record.msg === 'string' ? record.msg : '',
+            data: record.data,
+        };
+    }
+    catch (error) {
+        if (input.signal?.aborted || error instanceof DevicePairCancelled)
+            throw new DevicePairCancelled();
+        return { ok: false, error };
+    }
+}
+function throwIfCancelled(signal) {
+    if (signal?.aborted)
+        throw new DevicePairCancelled();
+}
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    return value;
+}
+function readString(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed || undefined;
+}
+function errorText(error) {
+    return error instanceof Error ? error.message : String(error);
+}