@dreamor/atlas-cli 0.7.22 → 0.7.24

package/package.json

@@ -1,19 +1,16 @@
 {
   "name": "@dreamor/atlas-cli",
-  "version": "0.7.22",
-  "description": "Atlas CLI - 斑马云图人力基线管理工具",
+  "version": "0.7.24",
+  "description": "Atlas CLI",
   "type": "module",
   "bin": {
-    "atlas": "./atlas.js"
+    "atlas": "./atlas.cjs"
   },
   "engines": {
     "node": ">=20"
   },
   "files": [
-    "atlas.js",
-    "dist/adapters/**/*.js",
-    "!dist/adapters/atlas/tests/**",
-    "!dist/adapters/**/tests/**",
+    "atlas.cjs",
     "README.md"
   ],
   "publishConfig": {
@@ -25,12 +22,13 @@
     "url": "git+https://github.com/dreamor/atlas-cli.git"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && rm -rf dist/adapters/atlas/bin && echo '#!/usr/bin/env node\\nimport { buildProgram } from \"./dist/adapters/atlas/cli.js\";\\nconst program = buildProgram();\\nprogram.parse(process.argv);\\n' > atlas.js && chmod +x atlas.js",
+    "build": "node scripts/build.mjs",
+    "build:dev": "node scripts/build.mjs --dev",
     "lint": "tsc --noEmit --pretty false",
     "lint:watch": "tsc --noEmit --pretty false --watch",
     "test": "vitest run",
     "test:watch": "vitest",
-    "verify": "node ./dist/adapters/atlas/cli.js --help",
+    "verify": "node atlas.cjs --help",
     "auth:login": "node --import tsx ./adapters/atlas/cli.ts auth login",
     "generate-skill-docs": "node scripts/generate-skill-docs.mjs"
   },

package/atlas.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { buildProgram } from "./dist/adapters/atlas/cli.js";
-const program = buildProgram();
-program.parse(process.argv);
-

package/dist/adapters/atlas/auth/browser.js

@@ -1,37 +0,0 @@
-/**
- * Playwright 加载与 Firefox 二进制安装 —— login 和 refresh 命令共用。
- *
- * 保持动态 import + try/catch 降级：顶层静态 import 会让单文件 bundle
- * 在未安装 playwright 的环境下无法启动（连 --version 都 require 失败）。
- * 只在真正调用 auth login / auth refresh 时才尝试加载 playwright。
- */
-import { execSync } from 'child_process';
-import { createRequire } from 'module';
-import { log } from '../util/output.js';
-const _require = createRequire(import.meta.url);
-export async function loadFirefox() {
-    try {
-        const pw = await import('playwright');
-        return pw.firefox;
-    }
-    catch {
-        throw new Error("未安装 playwright。请执行: npm i -g playwright && npx playwright install");
-    }
-}
-/**
- * 检测 launch 错误是否为"浏览器二进制未安装"，自动用内置 playwright 下载。
- */
-export async function ensureFirefoxInstalled() {
-    const pwPath = _require.resolve('playwright/package.json');
-    const cliJs = pwPath.replace(/package\.json$/, 'cli.js');
-    log('首次运行，正在自动安装 Firefox 浏览器...');
-    try {
-        execSync(`node "${cliJs}" install firefox`, {
-            stdio: 'inherit',
-            timeout: 300_000,
-        });
-    }
-    catch {
-        throw new Error('Firefox 浏览器自动安装失败。请手动执行: npx playwright install firefox');
-    }
-}

package/dist/adapters/atlas/auth/index.js

@@ -1,3 +0,0 @@
-export { loginCmd, statusCmd } from './login.js';
-export { refreshCmd, refreshSession } from './refresh.js';
-export { getSessionToken, getBanmaIdentity, readBanmaIdentity } from './session.js';

package/dist/adapters/atlas/auth/login.js

@@ -1,147 +0,0 @@
-import { writeCookies, readCookies, fetchCookiesFromDaemon } from './session.js';
-import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
-import { isJsonMode, jsonOk, log } from '../util/output.js';
-import { AtlasError } from '../util/errors.js';
-const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
-export async function login(_port) {
-    log('正在打开浏览器进行 Banma SSO 登录...');
-    const firefox = await loadFirefox();
-    let browser;
-    try {
-        browser = await firefox.launch({
-            headless: false,
-        });
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.includes('Executable doesn\'t exist')) {
-            await ensureFirefoxInstalled();
-            browser = await firefox.launch({ headless: false });
-        }
-        else {
-            throw e;
-        }
-    }
-    const page = await browser.newPage();
-    log('请在浏览器中完成 SSO 登录...');
-    log('登录成功后页面会自动跳转，CLI 会自动捕获 cookies');
-    await page.goto(`https://${BANMA_HOST}/`, { waitUntil: 'domcontentloaded', timeout: 60000 });
-    // 等待 access_token cookie 出现（最多 120s）。
-    // 注意 access_token 是 HttpOnly cookie，不能用 document.cookie 检测，
-    // 必须走 page.context().cookies() 才能读到。
-    const MAX_WAIT = 120_000;
-    const POLL_INTERVAL = 500;
-    let foundToken = false;
-    for (let elapsed = 0; elapsed < MAX_WAIT; elapsed += POLL_INTERVAL) {
-        const allCookies = await page.context().cookies();
-        if (allCookies.some((c) => c.name === 'access_token' && c.value)) {
-            foundToken = true;
-            break;
-        }
-        await page.waitForTimeout(POLL_INTERVAL);
-    }
-    if (!foundToken) {
-        log('SSO 登录检测超时。如果您已完成登录，请按 Ctrl+C 重试或确认账号权限。');
-    }
-    // 额外等待确保残留 cookie 写入完毕
-    await page.waitForTimeout(500);
-    // Extract cookies — 保存 banma-yuntu 域下所有 cookies（API 网关需要完整会话链）
-    const cookies = await page.context().cookies();
-    const atlasCookies = cookies
-        .filter((c) => c.domain?.includes('banma-yuntu') || c.domain?.includes('alibaba-inc'))
-        .map((c) => ({
-        name: c.name,
-        value: c.value,
-        domain: c.domain,
-    }));
-    await writeCookies(atlasCookies);
-    await browser.close();
-    log('SSO 登录成功！');
-    log(`已保存 ${atlasCookies.length} 个 cookies`);
-}
-export async function loginStatus() {
-    // Try daemon first
-    try {
-        const daemonCookies = await fetchCookiesFromDaemon();
-        if (daemonCookies && daemonCookies.length > 0) {
-            const userinfoCookie = daemonCookies.find((c) => c.name === 'buc_userinfo');
-            let displayName = 'via-daemon';
-            if (userinfoCookie) {
-                try {
-                    const decoded = JSON.parse(Buffer.from(userinfoCookie.value, 'base64').toString('utf-8'));
-                    displayName = decoded.name || decoded.account || `工号 ${decoded.emp_id}`;
-                }
-                catch {
-                    // fallback
-                }
-            }
-            return {
-                loggedIn: true,
-                account: displayName,
-                mode: 'daemon',
-            };
-        }
-    }
-    catch {
-        // Daemon not running
-    }
-    // Check local cookies
-    const cookies = await readCookies();
-    if (cookies && cookies.length > 0) {
-        const userinfoCookie = cookies.find((c) => c.name === 'buc_userinfo');
-        let displayName = '已登录';
-        if (userinfoCookie) {
-            try {
-                const decoded = JSON.parse(Buffer.from(userinfoCookie.value, 'base64').toString('utf-8'));
-                displayName = decoded.name || decoded.account || `工号 ${decoded.emp_id}`;
-            }
-            catch {
-                // fallback below
-            }
-        }
-        if (displayName === '已登录') {
-            const bucUser = cookies.find((c) => c.name === 'buc_username');
-            if (bucUser)
-                displayName = bucUser.value;
-        }
-        return {
-            loggedIn: true,
-            account: displayName,
-            mode: 'local',
-        };
-    }
-    return { loggedIn: false };
-}
-export async function loginCmd(opts) {
-    // Try daemon first if cookies available
-    const daemonCookies = await fetchCookiesFromDaemon();
-    if (daemonCookies && daemonCookies.length > 0) {
-        await writeCookies(daemonCookies);
-        log('已从 daemon 获取 cookies');
-        if (opts.json || isJsonMode()) {
-            jsonOk({ status: 'logged_in', via: 'daemon' });
-        }
-        return;
-    }
-    if (!process.stdout.isTTY) {
-        throw new AtlasError('atlas auth login 需要在终端中交互完成 SSO，当前为非终端环境。请手动在终端执行 `atlas auth login` 后重试', 'INTERACTIVE_REQUIRED');
-    }
-    await login();
-    if (opts.json || isJsonMode()) {
-        jsonOk({ status: 'logged_in' });
-    }
-}
-export async function statusCmd(opts) {
-    const status = await loginStatus();
-    if (opts.json || isJsonMode()) {
-        jsonOk(status);
-        return;
-    }
-    if (status.loggedIn) {
-        log(`已登录 (${status.mode === 'daemon' ? 'daemon' : 'local cookies'})`);
-        if (status.account)
-            log(`账号: ${status.account}`);
-    }
-    else {
-        log('未登录，请执行 atlas auth login');
-    }
-}

package/dist/adapters/atlas/auth/refresh.js

@@ -1,138 +0,0 @@
-/**
- * atlas auth refresh —— headless 静默换发 access_token。
- *
- * 原理：斑马 banma-yuntu 首页在 access_token 缺失/过期时会被 SSO
- * 拦截并走 302 重定向链换发新 token。已通过 spike 验证 headless 模式下
- * SSO_REFRESH_TOKEN 足以完成整个链路，无需人工交互。
- *
- * 失败降级：抛 SessionExpiredError 引导用户 atlas auth login。
- */
-import { readCookies, writeCookies } from './session.js';
-import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
-import { isJsonMode, jsonOk, log } from '../util/output.js';
-import { AtlasError, SessionExpiredError } from '../util/errors.js';
-const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
-const REFRESH_TIMEOUT_MS = 15_000;
-const POLL_INTERVAL_MS = 500;
-/**
- * 执行一次静默 SSO 刷新。
- *
- * 前置条件：本地存在 cookies.json 且含有 SSO_REFRESH_TOKEN 等长期凭证。
- * 成功：新 access_token 落库；返回 { refreshed: true, account }。
- * 失败：抛 SessionExpiredError 引导 atlas auth login。
- */
-export async function refreshSession(opts = {}) {
-    const timeoutMs = opts.timeoutMs ?? REFRESH_TIMEOUT_MS;
-    const pollIntervalMs = opts.pollIntervalMs ?? POLL_INTERVAL_MS;
-    const existing = await readCookies();
-    if (!existing || existing.length === 0) {
-        throw new AtlasError('未检测到本地登录态，请先执行：atlas auth login', 'INTERACTIVE_REQUIRED');
-    }
-    const originalAccessToken = existing.find((c) => c.name === 'access_token')?.value ?? '';
-    const firefox = await loadFirefox();
-    let browser;
-    try {
-        browser = await firefox.launch({ headless: true });
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.includes("Executable doesn't exist")) {
-            await ensureFirefoxInstalled();
-            browser = await firefox.launch({ headless: true });
-        }
-        else {
-            throw e;
-        }
-    }
-    try {
-        const ctx = await browser.newContext();
-        // 灌入已有 cookie，但剥离失效的 access_token 及相关签名 cookies
-        // （access_token.sig / refresh_token / refresh_token.sig）—— 强制
-        // SSO 用 SSO_REFRESH_TOKEN 换发全套新 token，防止 still_valid 假阳性。
-        // 注：实际工时 API 会校验 token + signature 匹配，只换 access_token
-        // 不换 sig 同样会被拒绝。
-        // playwright 严格校验 cookie 字段，需要补齐 path/secure 等。
-        const tokenNames = new Set(['access_token', 'access_token.sig', 'refresh_token', 'refresh_token.sig']);
-        const cookiesForContext = existing
-            .filter((c) => !tokenNames.has(c.name))
-            .map((c) => ({
-            name: c.name,
-            value: c.value,
-            domain: c.domain ?? '.alibaba-inc.com',
-            path: '/',
-            httpOnly: false,
-            secure: true,
-            sameSite: 'Lax',
-        }));
-        await ctx.addCookies(cookiesForContext);
-        const page = await ctx.newPage();
-        await page.goto(`https://${BANMA_HOST}/`, {
-            waitUntil: 'domcontentloaded',
-            timeout: timeoutMs,
-        });
-        // 轮询 access_token：goto 完成后如果 SSO 302 链跑通，浏览器 context 里
-        // 就会有 access_token（可能是原值——本来就没过期；也可能是新值——SSO 补发）。
-        // 两种情况都视为"session 依然可用"，回写 cookies 即可；只有拿不到才算失败。
-        let finalToken = null;
-        let tokenChanged = false;
-        const startedAt = Date.now();
-        while (Date.now() - startedAt < timeoutMs) {
-            const all = await ctx.cookies();
-            const cur = all.find((c) => c.name === 'access_token');
-            if (cur && cur.value) {
-                finalToken = cur.value;
-                tokenChanged = cur.value !== originalAccessToken;
-                // 如果 token 变了（真的刷新过），马上确认，避免过早退出
-                if (tokenChanged || !originalAccessToken)
-                    break;
-                // 如果 token 未变，多轮询几次给 SSO 一点补发机会，但 goto 完成后
-                // 通常几百 ms 内就有结论；等一轮就够了。
-                await page.waitForTimeout(pollIntervalMs);
-                const again = (await ctx.cookies()).find((c) => c.name === 'access_token');
-                if (again && again.value !== originalAccessToken) {
-                    finalToken = again.value;
-                    tokenChanged = true;
-                }
-                break;
-            }
-            await page.waitForTimeout(pollIntervalMs);
-        }
-        if (!finalToken) {
-            throw new SessionExpiredError('自动刷新失败（未获取到 access_token），请重新登录：atlas auth login');
-        }
-        // 抓 banma-yuntu / alibaba-inc 域下所有 cookies，回写持久化
-        const all = await ctx.cookies();
-        const filtered = all
-            .filter((c) => c.domain?.includes('banma-yuntu') || c.domain?.includes('alibaba-inc'))
-            .map((c) => ({ name: c.name, value: c.value, domain: c.domain }));
-        await writeCookies(filtered);
-        const account = deriveAccountName(filtered);
-        return { refreshed: tokenChanged, account };
-    }
-    finally {
-        await browser.close();
-    }
-}
-function deriveAccountName(cookies) {
-    const userinfo = cookies.find((c) => c.name === 'buc_userinfo');
-    if (userinfo) {
-        try {
-            const decoded = JSON.parse(Buffer.from(userinfo.value, 'base64').toString('utf-8'));
-            return decoded.name || decoded.account || (decoded.emp_id ? `工号 ${decoded.emp_id}` : undefined);
-        }
-        catch {
-            // 解码失败降级到 buc_username
-        }
-    }
-    return cookies.find((c) => c.name === 'buc_username')?.value;
-}
-export async function refreshCmd(opts) {
-    const result = await refreshSession();
-    const status = result.refreshed ? 'refreshed' : 'still_valid';
-    if (opts.json || isJsonMode()) {
-        jsonOk({ status, account: result.account });
-        return;
-    }
-    log(result.refreshed ? '会话已刷新' : '会话仍然有效，无需刷新');
-    if (result.account)
-        log(`账号: ${result.account}`);
-}

package/dist/adapters/atlas/auth/session.js

@@ -1,115 +0,0 @@
-import { readFile, unlink } from 'fs/promises';
-import { existsSync } from 'fs';
-import { secureMkdir, secureWriteFile } from '../util/secure-fs.js';
-import { getAtlasHome, getCookieFile } from '../util/paths.js';
-const SESSION_DIR = getAtlasHome();
-const COOKIE_FILE = getCookieFile();
-let cachedCookies = null;
-/**
- * 读取持久化的 cookies（从本地文件）
- * Playwright SSO 登录后将 cookies 写入此文件
- */
-export async function readCookies() {
-    if (cachedCookies)
-        return cachedCookies;
-    try {
-        if (!existsSync(COOKIE_FILE))
-            return null;
-        const data = await readFile(COOKIE_FILE, 'utf-8');
-        const cookies = JSON.parse(data);
-        cachedCookies = cookies;
-        return cookies;
-    }
-    catch {
-        return null;
-    }
-}
-export async function writeCookies(cookies) {
-    cachedCookies = cookies;
-    await secureMkdir(SESSION_DIR, { recursive: true });
-    await secureWriteFile(COOKIE_FILE, JSON.stringify(cookies, null, 2));
-}
-export async function clearCookies() {
-    cachedCookies = null;
-    try {
-        await unlink(COOKIE_FILE);
-    }
-    catch {
-        // ignore
-    }
-}
-/**
- * 从 daemon 获取 cookies（附带 daemon.token 鉴权）
- */
-export async function fetchCookiesFromDaemon(port = 8765) {
-    try {
-        // 读取 daemon token 用于 Authorization header
-        const { getDaemonTokenFile } = await import('../util/paths.js');
-        const tokenFile = getDaemonTokenFile();
-        let token = '';
-        if (existsSync(tokenFile)) {
-            token = (await readFile(tokenFile, 'utf-8')).trim();
-        }
-        const { request } = await import('undici');
-        const headers = {};
-        if (token)
-            headers['Authorization'] = `Bearer ${token}`;
-        const resp = await request(`http://localhost:${port}/api/cookies`, {
-            headers,
-            headersTimeout: 5000,
-            bodyTimeout: 5000,
-        });
-        const text = await resp.body.text();
-        const json = JSON.parse(text);
-        if (json?.cookies && Array.isArray(json.cookies)) {
-            return json.cookies;
-        }
-        return null;
-    }
-    catch {
-        return null;
-    }
-}
-/** 兼容旧接口：从 cookies 中提取第一个可用的 token 类值 */
-export async function getSessionToken() {
-    const cookies = await readCookies();
-    if (!cookies || cookies.length === 0)
-        return null;
-    // Try to find an auth token cookie
-    const tokenCookie = cookies.find((c) => c.name.includes('token') ||
-        c.name.includes('sid') ||
-        c.name.includes('session') ||
-        c.name.includes('SESSION'));
-    // 没找到 token cookie 时返回 null，避免返回无效 cookie 导致上层误判为"已登录"
-    return tokenCookie?.value ?? null;
-}
-const findCookie = (cookies, name) => cookies.find((c) => c.name === name);
-/**
- * 从已有 cookies 派生 Banma 身份。纯函数，无副作用，便于测试。
- * 任一来源缺失对应字段返回空字符串；cookies 为空数组返回 null。
- */
-export function getBanmaIdentity(cookies) {
-    if (!cookies || cookies.length === 0)
-        return null;
-    const token = findCookie(cookies, 'access_token')?.value ?? '';
-    const user = findCookie(cookies, 'buc_username')?.value ?? '';
-    // buc_userinfo 是 base64 编码的 JSON，含 emp_id / account / name 等
-    let staffId = '';
-    const userinfoValue = findCookie(cookies, 'buc_userinfo')?.value;
-    if (userinfoValue) {
-        try {
-            const decoded = JSON.parse(Buffer.from(userinfoValue, 'base64').toString('utf-8'));
-            if (decoded && decoded.emp_id != null)
-                staffId = String(decoded.emp_id);
-        }
-        catch {
-            // 解码或解析失败：保持空字符串，不阻断请求
-        }
-    }
-    return { token, user, staffId };
-}
-/** 读取持久化 cookies 并派生 Banma 身份，供 HttpClient 使用 */
-export async function readBanmaIdentity() {
-    const cookies = await readCookies();
-    return getBanmaIdentity(cookies);
-}