@dreamor/atlas-cli 0.7.17 → 0.7.19

package/dist/adapters/atlas/auth/browser.js

@@ -0,0 +1,37 @@
+/**
+ * Playwright 加载与 Firefox 二进制安装 —— login 和 refresh 命令共用。
+ *
+ * 保持动态 import + try/catch 降级：顶层静态 import 会让单文件 bundle
+ * 在未安装 playwright 的环境下无法启动（连 --version 都 require 失败）。
+ * 只在真正调用 auth login / auth refresh 时才尝试加载 playwright。
+ */
+import { execSync } from 'child_process';
+import { createRequire } from 'module';
+import { log } from '../util/output.js';
+const _require = createRequire(import.meta.url);
+export async function loadFirefox() {
+    try {
+        const pw = await import('playwright');
+        return pw.firefox;
+    }
+    catch {
+        throw new Error("未安装 playwright。请执行: npm i -g playwright && npx playwright install");
+    }
+}
+/**
+ * 检测 launch 错误是否为"浏览器二进制未安装"，自动用内置 playwright 下载。
+ */
+export async function ensureFirefoxInstalled() {
+    const pwPath = _require.resolve('playwright/package.json');
+    const cliJs = pwPath.replace(/package\.json$/, 'cli.js');
+    log('首次运行，正在自动安装 Firefox 浏览器...');
+    try {
+        execSync(`node "${cliJs}" install firefox`, {
+            stdio: 'inherit',
+            timeout: 300_000,
+        });
+    }
+    catch {
+        throw new Error('Firefox 浏览器自动安装失败。请手动执行: npx playwright install firefox');
+    }
+}

package/dist/adapters/atlas/auth/index.js

@@ -1,2 +1,3 @@
 export { loginCmd, statusCmd } from './login.js';
+export { refreshCmd, refreshSession } from './refresh.js';
 export { getSessionToken, getBanmaIdentity, readBanmaIdentity } from './session.js';

package/dist/adapters/atlas/auth/login.js

@@ -1,41 +1,8 @@
-import { execSync } from 'child_process';
-import { createRequire } from 'module';
 import { writeCookies, readCookies, fetchCookiesFromDaemon } from './session.js';
+import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
 import { isJsonMode, jsonOk, log } from '../util/output.js';
 import { AtlasError } from '../util/errors.js';
-const _require = createRequire(import.meta.url);
 const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
-/**
- * 动态加载 playwright。顶层静态 import 会让单文件 bundle 在未安装 playwright 的
- * 环境下无法启动（连 --version 都 require 失败），故改为运行时动态 import + try/catch
- * 降级：只在真正执行 `auth login` 时才需要 playwright，未安装则给出清晰提示。
- */
-async function loadFirefox() {
-    try {
-        const pw = await import('playwright');
-        return pw.firefox;
-    }
-    catch {
-        throw new Error("未安装 playwright。请执行: npm i -g playwright && npx playwright install");
-    }
-}
-/**
- * 检测 launch 错误是否为"浏览器二进制未安装"，自动用内置 playwright 下载。
- */
-async function ensureBrowserInstalled() {
-    const pwPath = _require.resolve('playwright/package.json');
-    const cliJs = pwPath.replace(/package\.json$/, 'cli.js');
-    log('首次运行，正在自动安装 Firefox 浏览器...');
-    try {
-        execSync(`node "${cliJs}" install firefox`, {
-            stdio: 'inherit',
-            timeout: 300_000,
-        });
-    }
-    catch {
-        throw new Error('Firefox 浏览器自动安装失败。请手动执行: npx playwright install firefox');
-    }
-}
 export async function login(_port) {
     log('正在打开浏览器进行 Banma SSO 登录...');
     const firefox = await loadFirefox();
@@ -47,7 +14,7 @@ export async function login(_port) {
     }
     catch (e) {
         if (e instanceof Error && e.message.includes('Executable doesn\'t exist')) {
-            await ensureBrowserInstalled();
+            await ensureFirefoxInstalled();
             browser = await firefox.launch({ headless: false });
         }
         else {

package/dist/adapters/atlas/auth/refresh.js

@@ -0,0 +1,134 @@
+/**
+ * atlas auth refresh —— headless 静默换发 access_token。
+ *
+ * 原理：斑马 banma-yuntu 首页在 access_token 缺失/过期时会被 SSO
+ * 拦截并走 302 重定向链换发新 token。已通过 spike 验证 headless 模式下
+ * SSO_REFRESH_TOKEN 足以完成整个链路，无需人工交互。
+ *
+ * 失败降级：抛 SessionExpiredError 引导用户 atlas auth login。
+ */
+import { readCookies, writeCookies } from './session.js';
+import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
+import { isJsonMode, jsonOk, log } from '../util/output.js';
+import { AtlasError, SessionExpiredError } from '../util/errors.js';
+const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
+const REFRESH_TIMEOUT_MS = 15_000;
+const POLL_INTERVAL_MS = 500;
+/**
+ * 执行一次静默 SSO 刷新。
+ *
+ * 前置条件：本地存在 cookies.json 且含有 SSO_REFRESH_TOKEN 等长期凭证。
+ * 成功：新 access_token 落库；返回 { refreshed: true, account }。
+ * 失败：抛 SessionExpiredError 引导 atlas auth login。
+ */
+export async function refreshSession(opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? REFRESH_TIMEOUT_MS;
+    const pollIntervalMs = opts.pollIntervalMs ?? POLL_INTERVAL_MS;
+    const existing = await readCookies();
+    if (!existing || existing.length === 0) {
+        throw new AtlasError('未检测到本地登录态，请先执行：atlas auth login', 'INTERACTIVE_REQUIRED');
+    }
+    const originalAccessToken = existing.find((c) => c.name === 'access_token')?.value ?? '';
+    const firefox = await loadFirefox();
+    let browser;
+    try {
+        browser = await firefox.launch({ headless: true });
+    }
+    catch (e) {
+        if (e instanceof Error && e.message.includes("Executable doesn't exist")) {
+            await ensureFirefoxInstalled();
+            browser = await firefox.launch({ headless: true });
+        }
+        else {
+            throw e;
+        }
+    }
+    try {
+        const ctx = await browser.newContext();
+        // 灌入已有 cookie，但剥离失效的 access_token —— 强制 SSO 用
+        // SSO_REFRESH_TOKEN 换发全新 token，防止 still_valid 假阳性。
+        // playwright 严格校验 cookie 字段，需要补齐 path/secure 等。
+        const cookiesForContext = existing
+            .filter((c) => c.name !== 'access_token')
+            .map((c) => ({
+            name: c.name,
+            value: c.value,
+            domain: c.domain ?? '.alibaba-inc.com',
+            path: '/',
+            httpOnly: false,
+            secure: true,
+            sameSite: 'Lax',
+        }));
+        await ctx.addCookies(cookiesForContext);
+        const page = await ctx.newPage();
+        await page.goto(`https://${BANMA_HOST}/`, {
+            waitUntil: 'domcontentloaded',
+            timeout: timeoutMs,
+        });
+        // 轮询 access_token：goto 完成后如果 SSO 302 链跑通，浏览器 context 里
+        // 就会有 access_token（可能是原值——本来就没过期；也可能是新值——SSO 补发）。
+        // 两种情况都视为"session 依然可用"，回写 cookies 即可；只有拿不到才算失败。
+        let finalToken = null;
+        let tokenChanged = false;
+        const startedAt = Date.now();
+        while (Date.now() - startedAt < timeoutMs) {
+            const all = await ctx.cookies();
+            const cur = all.find((c) => c.name === 'access_token');
+            if (cur && cur.value) {
+                finalToken = cur.value;
+                tokenChanged = cur.value !== originalAccessToken;
+                // 如果 token 变了（真的刷新过），马上确认，避免过早退出
+                if (tokenChanged || !originalAccessToken)
+                    break;
+                // 如果 token 未变，多轮询几次给 SSO 一点补发机会，但 goto 完成后
+                // 通常几百 ms 内就有结论；等一轮就够了。
+                await page.waitForTimeout(pollIntervalMs);
+                const again = (await ctx.cookies()).find((c) => c.name === 'access_token');
+                if (again && again.value !== originalAccessToken) {
+                    finalToken = again.value;
+                    tokenChanged = true;
+                }
+                break;
+            }
+            await page.waitForTimeout(pollIntervalMs);
+        }
+        if (!finalToken) {
+            throw new SessionExpiredError('自动刷新失败（未获取到 access_token），请重新登录：atlas auth login');
+        }
+        // 抓 banma-yuntu / alibaba-inc 域下所有 cookies，回写持久化
+        const all = await ctx.cookies();
+        const filtered = all
+            .filter((c) => c.domain?.includes('banma-yuntu') || c.domain?.includes('alibaba-inc'))
+            .map((c) => ({ name: c.name, value: c.value, domain: c.domain }));
+        await writeCookies(filtered);
+        const account = deriveAccountName(filtered);
+        return { refreshed: tokenChanged, account };
+    }
+    finally {
+        await browser.close();
+    }
+}
+function deriveAccountName(cookies) {
+    const userinfo = cookies.find((c) => c.name === 'buc_userinfo');
+    if (userinfo) {
+        try {
+            const decoded = JSON.parse(Buffer.from(userinfo.value, 'base64').toString('utf-8'));
+            return decoded.name || decoded.account || (decoded.emp_id ? `工号 ${decoded.emp_id}` : undefined);
+        }
+        catch {
+            // 解码失败降级到 buc_username
+        }
+    }
+    return cookies.find((c) => c.name === 'buc_username')?.value;
+}
+export async function refreshCmd(opts) {
+    const result = await refreshSession();
+    const status = result.refreshed ? 'refreshed' : 'still_valid';
+    if (opts.json || isJsonMode()) {
+        jsonOk({ status, account: result.account });
+        return;
+    }
+    log(result.refreshed ? '会话已刷新' : '会话仍然有效，无需刷新');
+    if (result.account)
+        log(`账号: ${result.account}`);
+}

package/dist/adapters/atlas/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
 // Auth
-import { authLoginCmd, authStatusCmd } from './commands/auth.js';
+import { authLoginCmd, authStatusCmd, authRefreshCmd } from './commands/auth.js';
 // Project commands (find, projects, link, unlink)
 import { findCmd, projectsCmd, linkCmd, linkStatusCmd, unlinkCmd, } from './commands/project/index.js';
 // Baseline commands (month, summary, export)
@@ -131,6 +131,18 @@ function registerAuthCommands(program) {
             handleError(e);
         }
     });
+    auth
+        .command('refresh')
+        .description('无头模式静默刷新 access_token（依赖 SSO_REFRESH_TOKEN，失败降级到 atlas auth login）')
+        .option('--json', '输出 JSON 信封')
+        .action(async (opts) => {
+        try {
+            await authRefreshCmd(opts);
+        }
+        catch (e) {
+            handleError(e);
+        }
+    });
 }
 function registerProjectCommands(program) {
     // atlas find

package/dist/adapters/atlas/commands/_output_schema.js

@@ -29,6 +29,21 @@ const schemas = {
             },
         },
     },
+    'atlas auth refresh': {
+        jsonSchema: {
+            type: 'object',
+            properties: {
+                ok: { type: 'boolean', const: true },
+                data: {
+                    type: 'object',
+                    properties: {
+                        status: { type: 'string', enum: ['refreshed', 'still_valid'] },
+                        account: { type: 'string' },
+                    },
+                },
+            },
+        },
+    },
     'atlas projects': {
         jsonSchema: {
             type: 'object',

package/dist/adapters/atlas/commands/auth.js

@@ -1 +1 @@
-export { loginCmd as authLoginCmd, statusCmd as authStatusCmd } from '../auth/index.js';
+export { loginCmd as authLoginCmd, statusCmd as authStatusCmd, refreshCmd as authRefreshCmd, } from '../auth/index.js';

package/dist/adapters/atlas/http/client.js

@@ -13,10 +13,26 @@ import { BanmaApiError, SessionExpiredError, AtlasError } from '../util/errors.j
 import { readCookies, readBanmaIdentity } from '../auth/session.js';
 /** D10：已知业务错误码 → 异常映射（工厂函数避免单例 stack trace 失准） */
 const KNOWN_BUSINESS_ERRORS = {
-    'TOKEN_INVALID': () => new SessionExpiredError('会话 token 已失效，请重新登录'),
-    'TOKEN_EXPIRED': () => new SessionExpiredError('会话 token 已过期，请重新登录'),
-    'SESSION_EXPIRED': () => new SessionExpiredError('会话已过期，请重新登录'),
+    'TOKEN_INVALID': () => new SessionExpiredError('会话 token 已失效，请先执行：atlas auth refresh；失败再执行：atlas auth login'),
+    'TOKEN_EXPIRED': () => new SessionExpiredError('会话 token 已过期，请先执行：atlas auth refresh；失败再执行：atlas auth login'),
+    'SESSION_EXPIRED': () => new SessionExpiredError('会话已过期，请先执行：atlas auth refresh；失败再执行：atlas auth login'),
+    // 斑马 API 会用 errCode=501 + errorMsg="当前token已失效" 表达 token 过期；
+    // 这是文档中反复踩过的坑，务必显式映射。
+    '501': () => new SessionExpiredError('会话 token 已失效，请先执行：atlas auth refresh；失败再执行：atlas auth login'),
 };
+/**
+ * 关键词兜底：识别 errorMsg 是否描述 token 失效/过期。
+ * 用途：防止后续 API 又换一个 errCode 编号（例如 502/503）继续绕过我们的显式映射。
+ * 规则：errorMsg 同时包含 "token"（大小写不敏感）且包含 "失效" 或 "过期" 之一。
+ */
+function looksLikeTokenExpired(errorMsg) {
+    if (!errorMsg)
+        return false;
+    const lower = errorMsg.toLowerCase();
+    const hasToken = lower.includes('token');
+    const hasExpiry = errorMsg.includes('失效') || errorMsg.includes('过期');
+    return hasToken && hasExpiry;
+}
 const BANMA_BASE = 'https://banma-yuntu.alibaba-inc.com';
 /**
  * Banma API HTTP 客户端
@@ -162,6 +178,10 @@ export class HttpClient {
             const knownError = KNOWN_BUSINESS_ERRORS[json.errCode];
             if (knownError)
                 throw knownError();
+            // 兜底：显式映射漏掉时，用 errorMsg 关键词识别 token 失效
+            if (looksLikeTokenExpired(json.errorMsg)) {
+                throw new SessionExpiredError('会话 token 已失效，请先执行：atlas auth refresh；失败再执行：atlas auth login');
+            }
         }
         // Banma API 的 success/status 字段不可靠（空结果也返回 success: false）
         // 只要 HTTP 2xx 就返回 data，由调用方处理 null

package/dist/adapters/atlas/util/version.js

@@ -1 +1 @@
-export const ATLAS_VERSION = '0.7.17';
+export const ATLAS_VERSION = '0.7.19';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dreamor/atlas-cli",
-  "version": "0.7.17",
+  "version": "0.7.19",
   "description": "Atlas CLI - 斑马云图人力基线管理工具",
   "type": "module",
   "bin": {
@@ -49,6 +49,6 @@
     "esbuild": "^0.28.1",
     "tsx": "^4.19.0",
     "typescript": "^5.6.0",
-    "vitest": "^2.1.0"
+    "vitest": "^4.1.9"
   }
 }