@dreamor/atlas-cli 0.7.0

package/README.md

@@ -0,0 +1,84 @@
+# Atlas CLI
+
+> 斑马云图（Banma）人力基线管理工具
+
+## 安装
+
+```bash
+npm i -g @dreamor/atlas-cli
+```
+
+> Node 20+ 是引擎基线（package.json 已声明 `engines.node: >=20`）。
+
+## 升级
+
+```bash
+npm update -g @dreamor/atlas-cli
+```
+
+## 首次使用
+
+```bash
+atlas --help
+atlas auth login       # 打开浏览器完成 SSO 登录
+atlas auth status     # 检查登录态
+```
+
+`auth login` 需要 Playwright 启动无头浏览器（仅首次）：
+
+```bash
+npm i -g playwright
+npx playwright install chromium
+```
+
+未安装时 CLI 会给清晰提示，不会阻塞主命令的安装与运行。
+
+## 会话存储
+
+- macOS：默认使用 Keychain（依赖 `keytar`，通常随 Atlas 安装自动就绪）
+- 其他平台或 `keytar` 安装失败：自动降级到文件存储（`~/.atlas/cookies.json`）
+
+## 命令速览
+
+| 命令 | 说明 |
+|------|------|
+| `atlas --help` | 帮助 |
+| `atlas auth {login,status}` | SSO 登录/状态 |
+| `atlas find <kind> <query>` | 搜索 project / department / mp-type / line-plan-type / area-code |
+| `atlas projects` | 列出你有权限的项目 |
+| `atlas link [project]` / `unlink` | 绑定/解绑默认项目 |
+| `atlas baseline month/summary/export` | 基线（计划）人力 |
+| `atlas actual show/month/summary/export` | 实际工时 |
+| `atlas compare` | 基线 vs 实际对比 |
+| `atlas schema {export,commands}` | CLI 自省（字典/参数 schema） |
+| `atlas daemon` | 本地守护进程 |
+| `atlas exec --plan-file <path>` | 批量执行（agent 用） |
+| `atlas update` | 由 npm registry 管理，CLI 只提示更新命令 |
+| `atlas suggest <query>` | 自然语言→命令翻译 |
+
+## 全局选项
+
+- `--json` / `ATLAS_OUTPUT=json`：JSON 信封输出
+- `--quiet` / `ATLAS_QUIET=1`：静默
+- `--describe`：输出参数 schema（agent 自省）
+
+## 退出码
+
+| 码 | 含义 |
+|----|------|
+| 0 | 成功 |
+| 1 | 通用错误 |
+| 2 | 会话过期 |
+| 3 | API 错误 |
+| 4 | 项目匹配歧义 |
+| 5 | 项目未找到 |
+| 6 | API 限流 |
+| 7 | 网络错误 |
+| 8 | 版本更新异常 |
+| 64 | 配置错误/未实现 |
+
+## 文档
+
+- [INSTALL.md](./INSTALL.md) — 安装/环境变量/故障排查
+- [CHANGELOG.md](./CHANGELOG.md) — 变更日志
+- [CLAUDE.md](./CLAUDE.md) — 开发者指南（架构、命令、设计决策）

package/bin/atlas.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { buildProgram } from "../dist/adapters/atlas/cli.js";
+const program = buildProgram();
+program.parse(process.argv);
+

package/dist/adapters/atlas/auth/index.js

@@ -0,0 +1,2 @@
+export { loginCmd, statusCmd } from './login.js';
+export { getSessionToken, readSession, writeSession, clearSession, getBanmaIdentity, readBanmaIdentity } from './session.js';

package/dist/adapters/atlas/auth/login.js

@@ -0,0 +1,107 @@
+import { writeCookies, readCookies, fetchCookiesFromDaemon } from './session.js';
+import { isJsonMode, jsonOk, log } from '../util/output.js';
+const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
+// 白名单：只保存 getBanmaIdentity 真正需要的 cookies，避免整域 cookies 落盘
+const WANT_COOKIES = new Set(['access_token', 'buc_username', 'buc_userinfo']);
+const EMP_ID_NAMES = new Set(['emp_id', 'empId', 'employeeId']);
+/**
+ * 动态加载 playwright。顶层静态 import 会让单文件 bundle 在未安装 playwright 的
+ * 环境下无法启动（连 --version 都 require 失败），故改为运行时动态 import + try/catch
+ * 降级：只在真正执行 `auth login` 时才需要 playwright，未安装则给出清晰提示。
+ */
+async function loadChromium() {
+    try {
+        const pw = await import('playwright');
+        return pw.chromium;
+    }
+    catch {
+        throw new Error("未安装 playwright。运行时需要：设 ATLAS_AUTO_BOOTSTRAP=1 自动安装，或执行 `npm install playwright && npx playwright install chromium`");
+    }
+}
+export async function login(_port) {
+    log('正在打开浏览器进行 Banma SSO 登录...');
+    const chromium = await loadChromium();
+    const browser = await chromium.launch({
+        headless: false,
+    });
+    const page = await browser.newPage();
+    log('请在浏览器中完成 SSO 登录...');
+    log('登录成功后页面会自动跳转，CLI 会自动捕获 cookies');
+    await page.goto(`https://${BANMA_HOST}/`, { waitUntil: 'domcontentloaded', timeout: 60000 });
+    // 等待 access_token cookie 出现（最多 120s），比脆弱的 url 判断 + 固定 timeout 更可靠
+    await page.waitForFunction(() => document.cookie.includes('access_token'), { timeout: 120_000 });
+    // 额外等待确保残留 cookie 写入完毕
+    await page.waitForTimeout(1000);
+    // Extract cookies — 精确白名单，避免整域 cookies 落盘
+    const cookies = await page.context().cookies();
+    const atlasCookies = cookies
+        .filter((c) => WANT_COOKIES.has(c.name))
+        .map((c) => ({
+        name: c.name,
+        value: c.value,
+        domain: c.domain,
+    }));
+    await writeCookies(atlasCookies);
+    await browser.close();
+    log('SSO 登录成功！');
+    log(`已保存 ${atlasCookies.length} 个 cookies`);
+}
+export async function loginStatus() {
+    // Try daemon first
+    try {
+        const daemonCookies = await fetchCookiesFromDaemon();
+        if (daemonCookies && daemonCookies.length > 0) {
+            const empIdCookie = daemonCookies.find((c) => EMP_ID_NAMES.has(c.name));
+            return {
+                loggedIn: true,
+                account: empIdCookie?.value ?? 'via-daemon',
+                mode: 'daemon',
+            };
+        }
+    }
+    catch {
+        // Daemon not running
+    }
+    // Check local cookies
+    const cookies = await readCookies();
+    if (cookies && cookies.length > 0) {
+        const empIdCookie = cookies.find((c) => EMP_ID_NAMES.has(c.name));
+        return {
+            loggedIn: true,
+            account: empIdCookie?.value ?? 'cookies-present',
+            mode: 'local',
+        };
+    }
+    return { loggedIn: false };
+}
+export async function loginCmd(opts) {
+    // Try daemon first if cookies available
+    const daemonCookies = await fetchCookiesFromDaemon();
+    if (daemonCookies && daemonCookies.length > 0) {
+        await writeCookies(daemonCookies);
+        log('已从 daemon 获取 cookies');
+        if (opts.json || isJsonMode()) {
+            jsonOk({ status: 'logged_in', via: 'daemon' });
+        }
+        return;
+    }
+    await login();
+    if (opts.json || isJsonMode()) {
+        jsonOk({ status: 'logged_in' });
+    }
+}
+export async function statusCmd(opts) {
+    const status = await loginStatus();
+    if (opts.json || isJsonMode()) {
+        jsonOk(status);
+        return;
+    }
+    if (status.loggedIn) {
+        log(`已登录 (${status.mode === 'daemon' ? 'daemon' : 'local cookies'})`);
+        if (status.account)
+            log(`账号: ${status.account}`);
+    }
+    else {
+        log('未登录，请执行 atlas auth login');
+    }
+}

package/dist/adapters/atlas/auth/session.js

@@ -0,0 +1,154 @@
+import { readFile, unlink } from 'fs/promises';
+import { existsSync } from 'fs';
+import { secureMkdir, secureWriteFile } from '../util/secure-fs.js';
+import { getAtlasHome, getCookieFile } from '../util/paths.js';
+const SESSION_DIR = getAtlasHome();
+const COOKIE_FILE = getCookieFile();
+let cachedCookies = null;
+/**
+ * 读取持久化的 cookies（从本地文件）
+ * Playwright SSO 登录后将 cookies 写入此文件
+ */
+export async function readCookies() {
+    if (cachedCookies)
+        return cachedCookies;
+    try {
+        if (!existsSync(COOKIE_FILE))
+            return null;
+        const data = await readFile(COOKIE_FILE, 'utf-8');
+        const cookies = JSON.parse(data);
+        cachedCookies = cookies;
+        return cookies;
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeCookies(cookies) {
+    cachedCookies = cookies;
+    await secureMkdir(SESSION_DIR, { recursive: true });
+    await secureWriteFile(COOKIE_FILE, JSON.stringify(cookies, null, 2));
+}
+export async function clearCookies() {
+    cachedCookies = null;
+    try {
+        await unlink(COOKIE_FILE);
+    }
+    catch {
+        // ignore
+    }
+}
+/**
+ * 从 daemon 获取 cookies（附带 daemon.token 鉴权）
+ */
+export async function fetchCookiesFromDaemon(port = 8765) {
+    try {
+        // 读取 daemon token 用于 Authorization header
+        const { getDaemonTokenFile } = await import('../util/paths.js');
+        const tokenFile = getDaemonTokenFile();
+        let token = '';
+        if (existsSync(tokenFile)) {
+            token = (await readFile(tokenFile, 'utf-8')).trim();
+        }
+        const { request } = await import('undici');
+        const headers = {};
+        if (token)
+            headers['Authorization'] = `Bearer ${token}`;
+        const resp = await request(`http://localhost:${port}/api/cookies`, {
+            headers,
+            headersTimeout: 5000,
+            bodyTimeout: 5000,
+        });
+        const text = await resp.body.text();
+        const json = JSON.parse(text);
+        if (json?.cookies && Array.isArray(json.cookies)) {
+            return json.cookies;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+/** 兼容旧接口：从 cookies 中提取第一个可用的 token 类值 */
+export async function getSessionToken() {
+    const cookies = await readCookies();
+    if (!cookies || cookies.length === 0)
+        return null;
+    // Try to find an auth token cookie
+    const tokenCookie = cookies.find((c) => c.name.includes('token') ||
+        c.name.includes('sid') ||
+        c.name.includes('session') ||
+        c.name.includes('SESSION'));
+    // 没找到 token cookie 时返回 null，避免返回无效 cookie 导致上层误判为"已登录"
+    return tokenCookie?.value ?? null;
+}
+const findCookie = (cookies, name) => cookies.find((c) => c.name === name);
+/**
+ * 从已有 cookies 派生 Banma 身份。纯函数，无副作用，便于测试。
+ * 任一来源缺失对应字段返回空字符串；cookies 为空数组返回 null。
+ */
+export function getBanmaIdentity(cookies) {
+    if (!cookies || cookies.length === 0)
+        return null;
+    const token = findCookie(cookies, 'access_token')?.value ?? '';
+    const user = findCookie(cookies, 'buc_username')?.value ?? '';
+    // buc_userinfo 是 base64 编码的 JSON，含 emp_id / account / name 等
+    let staffId = '';
+    const userinfoValue = findCookie(cookies, 'buc_userinfo')?.value;
+    if (userinfoValue) {
+        try {
+            const decoded = JSON.parse(Buffer.from(userinfoValue, 'base64').toString('utf-8'));
+            if (decoded && decoded.emp_id != null)
+                staffId = String(decoded.emp_id);
+        }
+        catch {
+            // 解码或解析失败：保持空字符串，不阻断请求
+        }
+    }
+    return { token, user, staffId };
+}
+/** 读取持久化 cookies 并派生 Banma 身份，供 HttpClient 使用 */
+export async function readBanmaIdentity() {
+    const cookies = await readCookies();
+    return getBanmaIdentity(cookies);
+}
+/** Keytar session — legacy, keep for backward compat */
+export async function readSession() {
+    try {
+        const keytar = await import('keytar');
+        const stored = await keytar.default.getPassword('atlas-cli', 'session');
+        if (stored)
+            return JSON.parse(stored);
+    }
+    catch {
+        // keytar not available
+    }
+    return null;
+}
+export async function writeSession(session) {
+    try {
+        const keytar = await import('keytar');
+        await keytar.default.setPassword('atlas-cli', 'session', JSON.stringify(session));
+        return;
+    }
+    catch {
+        // keytar not available
+    }
+}
+export async function clearSession() {
+    cachedCookies = null;
+    try {
+        const keytar = await import('keytar');
+        await keytar.default.deletePassword('atlas-cli', 'session');
+    }
+    catch {
+        // ignore
+    }
+    try {
+        await unlink(COOKIE_FILE);
+    }
+    catch {
+        // ignore
+    }
+}