@dreamor/atlas-cli 0.7.21 → 0.7.23

package/dist/adapters/atlas/commands/actual/index.js

@@ -3,30 +3,30 @@ import { isJsonMode, jsonOk, log } from '../../util/output.js';
 import { enforceOutputLimit } from '../../util/output-limit.js';
 import { expandMonths, expandMonthsDefault } from '../../util/months.js';
 import { resolveSecureExportPath, secureWriteFile } from '../../util/secure-fs.js';
-import { annotateWithMonth, aggregateByAxis, filterByStaff, flattenTree, } from './_logic.js';
+import { annotateWithMonth, aggregateByAxis, filterByStaff, flattenTree, normalizeStatusFilter, } from './_logic.js';
 import { resolveProjectId } from '../../util/env.js';
 import { readBanmaIdentity } from '../../auth/session.js';
 function getProjectId(opts) {
     return resolveProjectId(opts.projectId);
 }
-async function fetchActual(pid, month) {
+async function fetchActual(pid, month, statusFilter) {
     const client = createClient();
     const identity = await readBanmaIdentity();
     const loginStaffId = identity?.staffId ?? '';
-    // B4: summaryByTeam 请求体需用 projectIds 数组 + 额外字段
-    // 使用 projectIds 时 detail 只返回该项目的数据
-    const raw = await client.post('/yuntu-service/manpower/weekly/summaryByTeam.json', { month, staffIds: [], projectIds: [pid], isConfirm: false, loginStaffId });
+    // 项目视图：使用 summaryByProject 获取全项目维度的实际工时。
+    // API 返回全部状态的数据，statusFilter 在客户端按 status 字段过滤（与网站一致）。
+    const raw = await client.post('/yuntu-service/manpower/weekly/summaryByProject.json', { month, staffIds: [], projectIds: [pid], isConfirm: false, loginStaffId });
     const tree = (Array.isArray(raw) ? raw : []);
     // 根节点为当前用户，children 为团队成员
     if (tree.length > 0 && tree[0].children) {
-        return flattenTree(tree[0].children, pid);
+        return flattenTree(tree[0].children, pid, statusFilter);
     }
     return [];
 }
 export async function showCmd(staffId, opts) {
     const pid = getProjectId(opts);
     const m = opts.month ?? expandMonthsDefault()[0];
-    const data = await fetchActual(pid, m);
+    const data = await fetchActual(pid, m, normalizeStatusFilter(opts.status));
     const filtered = filterByStaff(data, staffId);
     if (opts.json || isJsonMode()) {
         jsonOk({ staffId, month: m, personnel: filtered });
@@ -44,11 +44,12 @@ export async function monthCmd(opts) {
     const pid = getProjectId(opts);
     // 不传月份时默认最近 12 个月，与 baseline month 行为一致
     const months = opts.month ? [opts.month] : (opts.from || opts.to ? expandMonths(opts.from, opts.to) : expandMonthsDefault());
+    const statusFilter = normalizeStatusFilter(opts.status);
     const all = [];
     const failedMonths = [];
     for (const m of months) {
         try {
-            const data = await fetchActual(pid, m);
+            const data = await fetchActual(pid, m, statusFilter);
             all.push(...annotateWithMonth(data, m));
         }
         catch (e) {
@@ -76,11 +77,12 @@ export async function monthCmd(opts) {
 export async function summaryCmd(opts) {
     const pid = getProjectId(opts);
     const months = opts.month ? [opts.month] : (opts.from || opts.to ? expandMonths(opts.from, opts.to) : expandMonthsDefault());
+    const statusFilter = normalizeStatusFilter(opts.status);
     const all = [];
     const failedMonths = [];
     for (const m of months) {
         try {
-            all.push(...annotateWithMonth(await fetchActual(pid, m), m));
+            all.push(...annotateWithMonth(await fetchActual(pid, m, statusFilter), m));
         }
         catch (e) {
             // 实际工时 API 对无数据月份也返回 501（"当前token已失效"），
@@ -105,11 +107,12 @@ export async function summaryCmd(opts) {
 export async function exportCmd(opts) {
     const pid = getProjectId(opts);
     const months = expandMonths(opts.from, opts.to);
+    const statusFilter = normalizeStatusFilter(opts.status);
     const rows = [];
     const failedMonths = [];
     for (const m of months) {
         try {
-            const data = await fetchActual(pid, m);
+            const data = await fetchActual(pid, m, statusFilter);
             rows.push(...annotateWithMonth(data, m));
         }
         catch (e) {

package/dist/adapters/atlas/commands/auth.js

@@ -1 +1 @@
-export { loginCmd as authLoginCmd, statusCmd as authStatusCmd, refreshCmd as authRefreshCmd, } from '../auth/index.js';
+export { loginCmd as authLoginCmd, statusCmd as authStatusCmd, refreshCmd as authRefreshCmd, exportCmd as authExportCmd, importCmd as authImportCmd, doctorCmd as authDoctorCmd, } from '../auth/index.js';

package/dist/adapters/atlas/commands/baseline/index.js

@@ -36,25 +36,24 @@ function filterBaseline(details, opts) {
 }
 export async function monthCmd(opts) {
     const pid = getProjectId(opts);
+    // 基线 API 一次返回项目全部月份数据，不在月份循环内调用（B1）
     const months = opts.month ? [opts.month] : expandMonths(opts.from, opts.to);
+    const data = await fetchBaselineMonth(pid, months[0]);
     const allDetails = [];
-    for (const m of months) {
-        const data = await fetchBaselineMonth(pid, m);
-        for (const item of (data ?? [])) {
-            const details = (item.linePlanMonthDetailList ?? []);
-            const mpType = String(item.mpType ?? '');
-            const areaCode = item.areaCode;
-            for (const d of details) {
-                if (isMonthKey(d)) {
-                    allDetails.push({
-                        month: d.month ? monthTsToKey(d.month) : m,
-                        manpower: d.manpower ?? 0,
-                        role: item.role,
-                        departmentName: item.departmentName,
-                        mpType,
-                        areaCode,
-                    });
-                }
+    for (const item of (data ?? [])) {
+        const details = (item.linePlanMonthDetailList ?? []);
+        const mpType = String(item.mpType ?? '');
+        const areaCode = item.areaCode;
+        for (const d of details) {
+            if (isMonthKey(d)) {
+                allDetails.push({
+                    month: monthTsToKey(d.month),
+                    manpower: d.manpower ?? 0,
+                    role: item.role,
+                    departmentName: item.departmentName,
+                    mpType,
+                    areaCode,
+                });
             }
         }
     }
@@ -79,17 +78,16 @@ export async function monthCmd(opts) {
 }
 export async function summaryCmd(opts) {
     const pid = getProjectId(opts);
+    // 基线 API 一次返回项目全部月份数据，不在月份循环内调用（B1）
     const months = opts.month ? [opts.month] : expandMonths(opts.from, opts.to);
+    const data = await fetchBaselineMonth(pid, months[0]);
     const allDetails = [];
-    for (const m of months) {
-        const data = await fetchBaselineMonth(pid, m);
-        for (const item of (data ?? [])) {
-            const mpType = String(item.mpType ?? '');
-            const areaCode = item.areaCode;
-            for (const d of (item.linePlanMonthDetailList ?? [])) {
-                if (isMonthKey(d)) {
-                    allDetails.push({ month: monthTsToKey(d.month), manpower: d.manpower ?? 0, role: item.role, departmentName: item.departmentName, mpType, areaCode });
-                }
+    for (const item of (data ?? [])) {
+        const mpType = String(item.mpType ?? '');
+        const areaCode = item.areaCode;
+        for (const d of (item.linePlanMonthDetailList ?? [])) {
+            if (isMonthKey(d)) {
+                allDetails.push({ month: monthTsToKey(d.month), manpower: d.manpower ?? 0, role: item.role, departmentName: item.departmentName, mpType, areaCode });
             }
         }
     }
@@ -113,15 +111,14 @@ export async function summaryCmd(opts) {
 }
 export async function exportCmd(opts) {
     const pid = getProjectId(opts);
+    // 基线 API 一次返回项目全部月份数据，不在月份循环内调用（B1）
     const months = expandMonths(opts.from, opts.to);
+    const data = await fetchBaselineMonth(pid, months[0]);
     const rows = [];
-    for (const m of months) {
-        const data = await fetchBaselineMonth(pid, m);
-        for (const item of (data ?? [])) {
-            for (const d of (item.linePlanMonthDetailList ?? [])) {
-                if (isMonthKey(d)) {
-                    rows.push({ projectId: pid, month: monthTsToKey(d.month), role: item.role ?? '', manpower: d.manpower ?? 0 });
-                }
+    for (const item of (data ?? [])) {
+        for (const d of (item.linePlanMonthDetailList ?? [])) {
+            if (isMonthKey(d)) {
+                rows.push({ projectId: pid, month: monthTsToKey(d.month), role: item.role ?? '', manpower: d.manpower ?? 0 });
             }
         }
     }

package/dist/adapters/atlas/commands/compare/index.js

@@ -6,49 +6,51 @@ import { monthTsToKey } from '../../util/time.js';
 import { groupByAxis, mergeBaselineActual, } from './_logic.js';
 import { resolveProjectId, resolveProjectInfo } from '../../util/env.js';
 import { readBanmaIdentity } from '../../auth/session.js';
-import { flattenTree as flattenActualTree } from '../actual/_logic.js';
+import { flattenTree as flattenActualTree, normalizeStatusFilter } from '../actual/_logic.js';
 function getProjectId(opts) {
     return resolveProjectId(opts.projectId);
 }
 export async function compareCmd(opts) {
     const pid = getProjectId(opts);
     const months = opts.month ? [opts.month] : (opts.from || opts.to ? expandMonths(opts.from, opts.to) : expandMonthsDefault());
+    const statusFilter = normalizeStatusFilter(opts.status);
     const allBl = [];
     const allAc = [];
     const client = createClient();
     const failedMonths = [];
-    for (const m of months) {
-        try {
-            const blData = await client.post('/yuntu-service/line/plan/month/select.json', { projectId: pid, month: m });
-            for (const item of (blData ?? [])) {
-                const details = (item.linePlanMonthDetailList ?? []);
-                for (const d of details) {
-                    if (d && typeof d === 'object') {
-                        const monthVal = d.month;
-                        const monthKey = typeof monthVal === 'number'
-                            ? monthTsToKey(monthVal)
-                            : m;
-                        allBl.push({ month: monthKey, manpower: Number(d.manpower ?? 0), role: item.role, departmentName: item.departmentName });
-                    }
+    // 基线 API 一次返回项目全部月份数据，在循环外只调用一次（B1）
+    try {
+        const blData = await client.post('/yuntu-service/line/plan/month/select.json', { projectId: pid, month: months[0] ?? '' });
+        for (const item of (blData ?? [])) {
+            const details = (item.linePlanMonthDetailList ?? []);
+            for (const d of details) {
+                if (d && typeof d === 'object') {
+                    const monthVal = d.month;
+                    const monthKey = typeof monthVal === 'number'
+                        ? monthTsToKey(monthVal)
+                        : months[0];
+                    allBl.push({ month: monthKey, manpower: Number(d.manpower ?? 0), role: item.role, departmentName: item.departmentName });
                 }
             }
         }
-        catch (e) {
-            if (e instanceof SessionExpiredError)
-                throw e;
-            failedMonths.push({ month: m, error: `基线拉取失败: ${e instanceof Error ? e.message : String(e)}` });
-        }
+    }
+    catch (e) {
+        if (e instanceof SessionExpiredError)
+            throw e;
+        log(`基线数据拉取失败: ${e instanceof Error ? e.message : String(e)}`);
+    }
+    for (const m of months) {
         // 指数退避：避免连续触发限流（B2）
         try {
             const identity = await readBanmaIdentity();
             const loginStaffId = identity?.staffId ?? '';
-            const raw = await client.post('/yuntu-service/manpower/weekly/summaryByTeam.json', {
+            const raw = await client.post('/yuntu-service/manpower/weekly/summaryByProject.json', {
                 month: m, staffIds: [], projectIds: [pid], isConfirm: false, loginStaffId,
             });
             const tree = (Array.isArray(raw) ? raw : []);
             const results = [];
             if (tree.length > 0 && tree[0].children) {
-                const entries = flattenActualTree(tree[0].children, pid);
+                const entries = flattenActualTree(tree[0].children, pid, statusFilter);
                 for (const p of entries) {
                     results.push({ month: m, manpower: p.manpower ?? 0, role: p.role, departmentName: p.departmentName });
                 }

package/dist/adapters/atlas/daemon/index.js

@@ -1,10 +1,13 @@
-import { createServer } from 'http';
+import { createServer as httpCreateServer } from 'http';
+import { createServer as httpsCreateServer } from 'https';
 import { randomBytes, timingSafeEqual } from 'crypto';
+import { readFileSync } from 'fs';
 import { dirname } from 'path';
 import { log } from '../util/output.js';
 import { getDaemonTokenFile } from '../util/paths.js';
 import { secureMkdir, secureWriteFile } from '../util/secure-fs.js';
 import { AtlasError } from '../util/errors.js';
+import { parseCidrList, isIpAllowed, isLoopback, } from '../util/cidr.js';
 /** 生成 32 字节 hex token */
 function generateToken() {
     return randomBytes(32).toString('hex');
@@ -22,6 +25,50 @@ function isAuthorized(req, token) {
     }
     return timingSafeEqual(a, b);
 }
+/**
+ * 构造 daemon request handler。抽出为纯函数便于测试：
+ * 测试可直接用返回的 handler 起临时 http/https server。
+ *
+ * 路由：
+ * - GET /api/health → 公开，{ok, pid}
+ * - GET /api/cookies → 需 Bearer + IP 白名单，{ok, cookies}
+ * - 其他 → 404
+ */
+export function createDaemonHandler(deps) {
+    return (req, res) => {
+        const sendJson = (status, body) => {
+            res.writeHead(status, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify(body));
+        };
+        const url = req.url ?? '/';
+        const isHealth = url === '/api/health' || url === '/';
+        // health 端点不鉴权、不限 IP（用于探测）
+        if (isHealth) {
+            sendJson(200, { ok: true, pid: process.pid });
+            return;
+        }
+        // IP 白名单（非 health 端点都校验）
+        if (!isIpAllowed(req.socket.remoteAddress, deps.allowList)) {
+            sendJson(403, { ok: false, error: 'forbidden: ip not allowed' });
+            return;
+        }
+        // Bearer 鉴权
+        if (!isAuthorized(req, deps.token)) {
+            sendJson(401, { ok: false, error: 'unauthorized' });
+            return;
+        }
+        if (url === '/api/cookies') {
+            void deps
+                .readCookies()
+                .then((cookies) => sendJson(200, { ok: true, cookies: cookies ?? [] }))
+                .catch(() => sendJson(500, { ok: false, error: 'read cookies failed' }));
+            return;
+        }
+        sendJson(404, { ok: false, error: 'not found' });
+    };
+}
+/** 默认端口号 */
+const DEFAULT_PORT = 8765;
 export async function daemonCmd(opts) {
     const envPort = Number(process.env.ATLAS_DAEMON_PORT);
     const optsPort = opts.port !== undefined ? Number(opts.port) : NaN;
@@ -29,24 +76,57 @@ export async function daemonCmd(opts) {
         ? optsPort
         : Number.isFinite(envPort) && envPort > 0
             ? envPort
-            : 8765;
+            : DEFAULT_PORT;
+    const host = opts.host ?? '127.0.0.1';
+    const hostLoopback = isLoopback(host);
+    const hasTls = Boolean(opts.tlsCert) && Boolean(opts.tlsKey);
+    // 护栏 1：TLS cert/key 必须同时指定
+    if ((opts.tlsCert && !opts.tlsKey) || (opts.tlsKey && !opts.tlsCert)) {
+        throw new AtlasError('--tls-cert 与 --tls-key 必须同时指定', 'CONFIG_ERROR');
+    }
+    // 护栏 2：非 loopback 监听必须有 IP 白名单或显式 --insecure
+    if (!hostLoopback && !opts.insecure && (!opts.allowIp || opts.allowIp.length === 0)) {
+        throw new AtlasError('非 loopback 监听必须指定 --allow-ip 或显式 --insecure（明文传输 token 仅建议本机开发）', 'CONFIG_ERROR');
+    }
+    // 护栏 3：非 loopback + 无 TLS + 明文 → stderr 大红警告
+    if (!hostLoopback && !hasTls && opts.insecure) {
+        log('⚠⚠⚠ 明文监听非 loopback 接口，Bearer token 将以明文传输，仅建议本机开发使用 ⚠⚠⚠');
+    }
+    // 解析 IP 白名单（非法 CIDR 在此抛 ConfigError，启动期失败而非运行期）
+    const allowList = parseCidrList(opts.allowIp);
     // 生成一次性 token，写入 ~/.atlas/daemon.token（0600）
     const token = generateToken();
     const tokenFile = getDaemonTokenFile();
     await secureMkdir(dirname(tokenFile), { recursive: true });
     await secureWriteFile(tokenFile, token);
     log(`Daemon token 已写入 ${tokenFile}`);
-    const server = createServer((req, res) => {
-        // 除 /api/health 外所有端点均需鉴权
-        const isHealth = req.url === '/api/health';
-        if (!isHealth && !isAuthorized(req, token)) {
-            res.writeHead(401, { 'Content-Type': 'application/json' });
-            res.end(JSON.stringify({ ok: false, error: 'unauthorized' }));
-            return;
+    // 动态 import readCookies 避免与 session 模块的循环依赖
+    const handlerDeps = {
+        token,
+        allowList,
+        readCookies: async () => {
+            const { readCookies } = await import('../auth/session.js');
+            return readCookies();
+        },
+    };
+    const handler = createDaemonHandler(handlerDeps);
+    // 创建 server（http 或 https）
+    let server;
+    if (hasTls) {
+        let cert;
+        let key;
+        try {
+            cert = readFileSync(opts.tlsCert);
+            key = readFileSync(opts.tlsKey);
         }
-        res.writeHead(200, { 'Content-Type': 'application/json' });
-        res.end(JSON.stringify({ ok: true, pid: process.pid }));
-    });
+        catch (e) {
+            throw new AtlasError(`TLS 证书读取失败：${e.message}`, 'CONFIG_ERROR');
+        }
+        server = httpsCreateServer({ cert, key }, handler);
+    }
+    else {
+        server = httpCreateServer(handler);
+    }
     await new Promise((resolve, reject) => {
         server.on('error', (e) => {
             if (e.code === 'EADDRINUSE') {
@@ -56,9 +136,10 @@ export async function daemonCmd(opts) {
                 reject(e);
             }
         });
-        server.listen(port, '127.0.0.1', resolve);
+        server.listen(port, host, resolve);
     });
-    log(`守护进程已启动，监听 127.0.0.1:${port}`);
+    const scheme = hasTls ? 'https' : 'http';
+    log(`守护进程已启动，监听 ${scheme}://${host}:${port}${!hostLoopback && !hasTls && opts.insecure ? '（明文）' : ''}`);
     // Keep running
     await new Promise(() => { });
 }

package/dist/adapters/atlas/util/cidr.js

@@ -0,0 +1,114 @@
+import { ConfigError } from './errors.js';
+const IPV4_OCTET = '(25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)';
+const IPV4_RE = new RegExp(`^${IPV4_OCTET}(\\.${IPV4_OCTET}){3}$`);
+const IPV6_FULL_RE = /^[0-9a-fA-F:]+$/;
+/** 是否为 loopback 监听地址（127.0.0.1 / ::1 / localhost） */
+export function isLoopback(host) {
+    if (!host)
+        return false;
+    const h = host.toLowerCase().trim();
+    if (h === 'localhost' || h === '::1')
+        return true;
+    if (IPV4_RE.test(h) && h.startsWith('127.'))
+        return true;
+    return false;
+}
+/** 规范化对端地址：去 IPv4-mapped IPv6 前缀 ::ffff: */
+export function normalizeRemoteAddr(addr) {
+    if (!addr)
+        return '';
+    const trimmed = addr.trim();
+    // ::ffff:1.2.3.4 或 ::ffff:a.b.c.d
+    const mapped = trimmed.match(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i);
+    if (mapped)
+        return mapped[1];
+    // 也可能出现 ::ffff:xxx.xxx.xxx.xxx 之外的形式，如 2002:... 退回原值
+    return trimmed;
+}
+/** IPv4 点分十进制 → 32 位无符号整数；非法返回 null */
+function ipv4ToInt(ip) {
+    if (!IPV4_RE.test(ip))
+        return null;
+    const parts = ip.split('.').map(Number);
+    // 防止前导零或多段异常（正则已挡，此处二次保险）
+    return (((parts[0] << 24) >>> 0) + (parts[1] << 16) + (parts[2] << 8) + parts[3]) >>> 0;
+}
+function intToIpv4(n) {
+    return [(n >>> 24) & 0xff, (n >>> 16) & 0xff, (n >>> 8) & 0xff, n & 0xff].join('.');
+}
+/**
+ * 解析 CIDR/单 IP 列表为结构化条目。
+ * - IPv4 单 IP 视作 /32，IPv6 单 IP 视作 /128
+ * - IPv6 CIDR 暂不支持（抛 ConfigError），仅允许 IPv6 单 IP
+ * - 非法格式抛 ConfigError，message 含原始输入
+ */
+export function parseCidrList(input) {
+    if (!input || input.length === 0)
+        return [];
+    const entries = [];
+    for (const raw of input) {
+        const item = raw.trim();
+        if (!item)
+            continue;
+        if (item.includes(':')) {
+            // IPv6：仅支持单 IP 全等比较
+            if (item.includes('/')) {
+                throw new ConfigError(`暂不支持 IPv6 CIDR（仅单 IP）：${raw}`);
+            }
+            if (!IPV6_FULL_RE.test(item)) {
+                throw new ConfigError(`非法 IPv6 地址：${raw}`);
+            }
+            entries.push({ raw, family: 'ipv6', network: item.toLowerCase(), prefix: 128 });
+            continue;
+        }
+        // IPv4：CIDR 或单 IP
+        if (item.includes('/')) {
+            const [ip, prefixStr] = item.split('/');
+            const ipInt = ipv4ToInt(ip);
+            const prefix = Number(prefixStr);
+            if (ipInt === null)
+                throw new ConfigError(`非法 IPv4 网络地址：${raw}`);
+            if (!Number.isInteger(prefix) || prefix < 0 || prefix > 32) {
+                throw new ConfigError(`非法 IPv4 前缀长度：${raw}`);
+            }
+            const mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+            const netInt = (ipInt & mask) >>> 0;
+            entries.push({ raw, family: 'ipv4', network: intToIpv4(netInt), prefix });
+        }
+        else {
+            const ipInt = ipv4ToInt(item);
+            if (ipInt === null)
+                throw new ConfigError(`非法 IPv4 地址：${raw}`);
+            entries.push({ raw, family: 'ipv4', network: intToIpv4(ipInt), prefix: 32 });
+        }
+    }
+    return entries;
+}
+/**
+ * 判断对端地址是否命中白名单。
+ * - allowList 为空 → 放行（向后兼容 loopback 默认）
+ * - 未提供地址 → 拒绝（无法判定时安全优先）
+ */
+export function isIpAllowed(remoteAddr, allowList) {
+    if (allowList.length === 0)
+        return true;
+    const addr = normalizeRemoteAddr(remoteAddr);
+    if (!addr)
+        return false;
+    for (const entry of allowList) {
+        if (entry.family === 'ipv6') {
+            // IPv6 单 IP 全等比较
+            if (addr.toLowerCase() === entry.network)
+                return true;
+            continue;
+        }
+        // IPv4 CIDR 匹配
+        const ipInt = ipv4ToInt(addr);
+        if (ipInt === null)
+            continue;
+        const mask = entry.prefix === 0 ? 0 : (0xffffffff << (32 - entry.prefix)) >>> 0;
+        if (((ipInt & mask) >>> 0) === (ipv4ToInt(entry.network) >>> 0))
+            return true;
+    }
+    return false;
+}

package/dist/adapters/atlas/util/environment.js

@@ -0,0 +1,152 @@
+/**
+ * 沙盒环境识别（对齐 dws agent_code_detect）。
+ *
+ * 四级信号优先级（高 → 低），命中即返回，绝不猜：
+ *   T0  ATLAS_AGENT_CODE 环境变量（显式声明，最高优先级）
+ *   T1  CLI 内嵌签名（claudecode/openclaw/codex/hermes/wukong）
+ *   T2  VSCODE_BRAND（覆盖 Cursor/Qoder/Trae 等 VS Code fork）
+ *   T3  macOS __CFBundleIdentifier（qoder/cursor/vscode/wukong）
+ *   T4  未识别 → 空字符串
+ *
+ * 同时探测沙盒能力（TTY / DISPLAY / 容器 / 浏览器可拉起 / cookies 就绪 / daemon
+ * 可达）。daemon 探测涉及网络 IO，由 detectEnvironmentAsync 单独暴露。
+ */
+import { existsSync } from 'fs';
+import { hostname, platform } from 'os';
+import { getCookieFile, getDaemonTokenFile } from './paths.js';
+/** 已验证的 T1 CLI 签名（envKeys 任一存在即命中） */
+const KNOWN_SIGNATURES = [
+    { code: 'claudecode', envKeys: ['CLAUDECODE', 'CLAUDE_CODE_ENTRYPOINT'] },
+    { code: 'openclaw', envKeys: ['OPENCLAW_BUNDLE_ROOT', 'OPENCLAW_RUNTIME_ROLE'] },
+    { code: 'codex', envKeys: ['CODEX_SANDBOX'] },
+    { code: 'hermes', envKeys: ['HERMES_HOME'] },
+    { code: 'wukong', envKeys: ['WUKONG_SANDBOX', 'WUKONG_RUNTIME'] },
+];
+/** T3: macOS bundle id → agent_code 映射（仅取已验证条目） */
+const BUNDLE_ID_MAP = [
+    { code: 'cursor', bundlePrefix: 'com.todesktop.' }, // cursor 包名为 com.todesktop.230313mzl4w4u92
+    { code: 'qoder', bundlePrefix: 'com.qoder.' },
+    { code: 'vscode', bundlePrefix: 'com.microsoft.VSCode' },
+    { code: 'wukong', bundlePrefix: 'com.antgroup.wukong' },
+];
+/** 同步检测 agent_code（不触碰网络/磁盘可变状态，便于单测）。 */
+export function detectAgentCode(env = process.env) {
+    // T0: 显式声明最高优先级
+    const explicit = env.ATLAS_AGENT_CODE;
+    if (typeof explicit === 'string' && explicit.trim()) {
+        return { agentCode: explicit.trim(), agentSignal: 'env:ATLAS_AGENT_CODE' };
+    }
+    // T1: CLI 内嵌签名
+    for (const sig of KNOWN_SIGNATURES) {
+        for (const k of sig.envKeys) {
+            const v = env[k];
+            if (typeof v === 'string' && v.length > 0) {
+                return { agentCode: sig.code, agentSignal: `env:${k}` };
+            }
+        }
+    }
+    // T2: VSCODE_BRAND（覆盖所有 VS Code fork：Cursor/Qoder/Trae 等）
+    const brand = env.VSCODE_BRAND;
+    if (typeof brand === 'string' && brand.trim()) {
+        return { agentCode: brand.trim().toLowerCase(), agentSignal: 'env:VSCODE_BRAND' };
+    }
+    // T3: macOS __CFBundleIdentifier
+    const bundle = env.__CFBundleIdentifier;
+    if (typeof bundle === 'string' && bundle.length > 0) {
+        for (const m of BUNDLE_ID_MAP) {
+            if (bundle.startsWith(m.bundlePrefix) || bundle === m.bundlePrefix) {
+                return { agentCode: m.code, agentSignal: `bundle:${bundle}` };
+            }
+        }
+    }
+    // T4: 未识别 → 空
+    return { agentCode: '', agentSignal: '' };
+}
+/** 判断是否处于 Linux 容器内（/.dockerenv 或 $container 变量） */
+export function detectContainer(env = process.env) {
+    if (existsSync('/.dockerenv'))
+        return true;
+    const c = env.container;
+    if (typeof c === 'string' && c.trim() && c !== 'off')
+        return true;
+    // Kubernetes 常见信号
+    if (env.KUBERNETES_SERVICE_HOST)
+        return true;
+    return false;
+}
+/** 是否存在 DISPLAY（Linux X11/Wayland）/ macOS 原生 GUI */
+export function detectHasDisplay(env = process.env) {
+    if (typeof env.DISPLAY === 'string' && env.DISPLAY.length > 0)
+        return true;
+    if (typeof env.WAYLAND_DISPLAY === 'string' && env.WAYLAND_DISPLAY.length > 0)
+        return true;
+    // macOS 即使无 DISPLAY 变量也有原生 GUI
+    if (platform() === 'darwin')
+        return true;
+    return false;
+}
+/** ATLAS_SANDBOX=1 可显式强制沙盒行为（测试/调试用） */
+function isForcedSandbox(env) {
+    return env.ATLAS_SANDBOX === '1' || env.ATLAS_SANDBOX === 'true';
+}
+/**
+ * 同步环境能力快照（不探测 daemon，避免阻塞）。
+ * daemon 可达性见 detectEnvironmentAsync()。
+ */
+export function detectEnvironment(env = process.env) {
+    const { agentCode, agentSignal } = detectAgentCode(env);
+    const hasTTY = Boolean(process.stdout.isTTY);
+    const hasDisplay = detectHasDisplay(env);
+    const isContainer = detectContainer(env);
+    const forcedSandbox = isForcedSandbox(env);
+    // 受信任的 GUI 拉起：需要 TTY + DISPLAY 且非容器；ATLAS_SANDBOX=1 强制视为不可拉起
+    const canLaunchBrowser = !forcedSandbox && hasDisplay && !isContainer && hasTTY;
+    const cookiesReady = existsSync(getCookieFile());
+    return {
+        agentCode,
+        agentSignal,
+        hasTTY,
+        hasDisplay,
+        isContainer: isContainer || forcedSandbox,
+        canLaunchBrowser,
+        cookiesReady,
+        daemonReachable: null,
+    };
+}
+/** 异步探测 daemon 是否可达（带超时）。失败返回 false，绝不抛。 */
+export async function probeDaemonReachable(url, token, timeoutMs = 1500) {
+    if (!url)
+        return false;
+    try {
+        const { request } = await import('undici');
+        const headers = {};
+        if (token)
+            headers['Authorization'] = `Bearer ${token}`;
+        const resp = await request(`${url.replace(/\/$/, '')}/api/health`, {
+            headers,
+            headersTimeout: timeoutMs,
+            bodyTimeout: timeoutMs,
+        });
+        return resp.statusCode === 200;
+    }
+    catch {
+        return false;
+    }
+}
+/** 从环境变量 + 默认 token 文件解析 daemon 连接配置（不发起请求） */
+export function resolveDaemonConfig(env = process.env) {
+    const envUrl = env.ATLAS_DAEMON_URL;
+    const envToken = env.ATLAS_DAEMON_TOKEN;
+    if (envUrl) {
+        return { url: envUrl, token: envToken ?? null, via: 'env' };
+    }
+    // 回退默认 localhost + 本机 token 文件
+    const tokenFileExists = existsSync(getDaemonTokenFile());
+    if (tokenFileExists) {
+        const envPort = Number(env.ATLAS_DAEMON_PORT);
+        const port = Number.isFinite(envPort) && envPort > 0 ? envPort : 8765;
+        return { url: `http://localhost:${port}`, token: null, via: 'default' };
+    }
+    return { url: null, token: null, via: 'none' };
+}
+export const __DEV__ = { hostname, getCookieFile, getDaemonTokenFile };