@dreamor/atlas-cli 0.7.23 → 0.7.25

package/package.json

@@ -1,19 +1,16 @@
 {
   "name": "@dreamor/atlas-cli",
-  "version": "0.7.23",
-  "description": "Atlas CLI - 斑马云图人力基线管理工具",
+  "version": "0.7.25",
+  "description": "Atlas CLI",
   "type": "module",
   "bin": {
-    "atlas": "./atlas.js"
+    "atlas": "./atlas.cjs"
   },
   "engines": {
     "node": ">=20"
   },
   "files": [
-    "atlas.js",
-    "dist/adapters/**/*.js",
-    "!dist/adapters/atlas/tests/**",
-    "!dist/adapters/**/tests/**",
+    "atlas.cjs",
     "README.md"
   ],
   "publishConfig": {
@@ -25,12 +22,13 @@
     "url": "git+https://github.com/dreamor/atlas-cli.git"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json && rm -rf dist/adapters/atlas/bin && echo '#!/usr/bin/env node\\nimport { buildProgram } from \"./dist/adapters/atlas/cli.js\";\\nconst program = buildProgram();\\nprogram.parse(process.argv);\\n' > atlas.js && chmod +x atlas.js",
+    "build": "node scripts/build.mjs",
+    "build:dev": "node scripts/build.mjs --dev",
     "lint": "tsc --noEmit --pretty false",
     "lint:watch": "tsc --noEmit --pretty false --watch",
     "test": "vitest run",
     "test:watch": "vitest",
-    "verify": "node ./dist/adapters/atlas/cli.js --help",
+    "verify": "node atlas.cjs --help",
     "auth:login": "node --import tsx ./adapters/atlas/cli.ts auth login",
     "generate-skill-docs": "node scripts/generate-skill-docs.mjs"
   },

package/atlas.js

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { buildProgram } from "./dist/adapters/atlas/cli.js";
-const program = buildProgram();
-program.parse(process.argv);
-

package/dist/adapters/atlas/auth/browser.js

@@ -1,37 +0,0 @@
-/**
- * Playwright 加载与 Firefox 二进制安装 —— login 和 refresh 命令共用。
- *
- * 保持动态 import + try/catch 降级：顶层静态 import 会让单文件 bundle
- * 在未安装 playwright 的环境下无法启动（连 --version 都 require 失败）。
- * 只在真正调用 auth login / auth refresh 时才尝试加载 playwright。
- */
-import { execSync } from 'child_process';
-import { createRequire } from 'module';
-import { log } from '../util/output.js';
-const _require = createRequire(import.meta.url);
-export async function loadFirefox() {
-    try {
-        const pw = await import('playwright');
-        return pw.firefox;
-    }
-    catch {
-        throw new Error("未安装 playwright。请执行: npm i -g playwright && npx playwright install");
-    }
-}
-/**
- * 检测 launch 错误是否为"浏览器二进制未安装"，自动用内置 playwright 下载。
- */
-export async function ensureFirefoxInstalled() {
-    const pwPath = _require.resolve('playwright/package.json');
-    const cliJs = pwPath.replace(/package\.json$/, 'cli.js');
-    log('首次运行，正在自动安装 Firefox 浏览器...');
-    try {
-        execSync(`node "${cliJs}" install firefox`, {
-            stdio: 'inherit',
-            timeout: 300_000,
-        });
-    }
-    catch {
-        throw new Error('Firefox 浏览器自动安装失败。请手动执行: npx playwright install firefox');
-    }
-}

package/dist/adapters/atlas/auth/index.js

@@ -1,4 +0,0 @@
-export { loginCmd, statusCmd, sandboxLoginGuide } from './login.js';
-export { refreshCmd, refreshSession } from './refresh.js';
-export { getSessionToken, getBanmaIdentity, readBanmaIdentity } from './session.js';
-export { exportCmd, importCmd, doctorCmd, recommendPath } from './portable.js';

package/dist/adapters/atlas/auth/login.js

@@ -1,187 +0,0 @@
-import { writeCookies, readCookies, fetchCookiesFromDaemon } from './session.js';
-import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
-import { isJsonMode, jsonOk, log } from '../util/output.js';
-import { AtlasError } from '../util/errors.js';
-const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
-export async function login(_port) {
-    log('正在打开浏览器进行 Banma SSO 登录...');
-    const firefox = await loadFirefox();
-    let browser;
-    try {
-        browser = await firefox.launch({
-            headless: false,
-        });
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.includes('Executable doesn\'t exist')) {
-            await ensureFirefoxInstalled();
-            browser = await firefox.launch({ headless: false });
-        }
-        else {
-            throw e;
-        }
-    }
-    const page = await browser.newPage();
-    log('请在浏览器中完成 SSO 登录...');
-    log('登录成功后页面会自动跳转，CLI 会自动捕获 cookies');
-    await page.goto(`https://${BANMA_HOST}/`, { waitUntil: 'domcontentloaded', timeout: 60000 });
-    // 等待 access_token cookie 出现（最多 120s）。
-    // 注意 access_token 是 HttpOnly cookie，不能用 document.cookie 检测，
-    // 必须走 page.context().cookies() 才能读到。
-    const MAX_WAIT = 120_000;
-    const POLL_INTERVAL = 500;
-    let foundToken = false;
-    for (let elapsed = 0; elapsed < MAX_WAIT; elapsed += POLL_INTERVAL) {
-        const allCookies = await page.context().cookies();
-        if (allCookies.some((c) => c.name === 'access_token' && c.value)) {
-            foundToken = true;
-            break;
-        }
-        await page.waitForTimeout(POLL_INTERVAL);
-    }
-    if (!foundToken) {
-        log('SSO 登录检测超时。如果您已完成登录，请按 Ctrl+C 重试或确认账号权限。');
-    }
-    // 额外等待确保残留 cookie 写入完毕
-    await page.waitForTimeout(500);
-    // Extract cookies — 保存 banma-yuntu 域下所有 cookies（API 网关需要完整会话链）
-    const cookies = await page.context().cookies();
-    const atlasCookies = cookies
-        .filter((c) => c.domain?.includes('banma-yuntu') || c.domain?.includes('alibaba-inc'))
-        .map((c) => ({
-        name: c.name,
-        value: c.value,
-        domain: c.domain,
-    }));
-    await writeCookies(atlasCookies);
-    await browser.close();
-    log('SSO 登录成功！');
-    log(`已保存 ${atlasCookies.length} 个 cookies`);
-}
-export async function loginStatus() {
-    // Try daemon first
-    try {
-        const daemonCookies = await fetchCookiesFromDaemon();
-        if (daemonCookies && daemonCookies.length > 0) {
-            const userinfoCookie = daemonCookies.find((c) => c.name === 'buc_userinfo');
-            let displayName = 'via-daemon';
-            if (userinfoCookie) {
-                try {
-                    const decoded = JSON.parse(Buffer.from(userinfoCookie.value, 'base64').toString('utf-8'));
-                    displayName = decoded.name || decoded.account || `工号 ${decoded.emp_id}`;
-                }
-                catch {
-                    // fallback
-                }
-            }
-            return {
-                loggedIn: true,
-                account: displayName,
-                mode: 'daemon',
-            };
-        }
-    }
-    catch {
-        // Daemon not running
-    }
-    // Check local cookies
-    const cookies = await readCookies();
-    if (cookies && cookies.length > 0) {
-        const userinfoCookie = cookies.find((c) => c.name === 'buc_userinfo');
-        let displayName = '已登录';
-        if (userinfoCookie) {
-            try {
-                const decoded = JSON.parse(Buffer.from(userinfoCookie.value, 'base64').toString('utf-8'));
-                displayName = decoded.name || decoded.account || `工号 ${decoded.emp_id}`;
-            }
-            catch {
-                // fallback below
-            }
-        }
-        if (displayName === '已登录') {
-            const bucUser = cookies.find((c) => c.name === 'buc_username');
-            if (bucUser)
-                displayName = bucUser.value;
-        }
-        return {
-            loggedIn: true,
-            account: displayName,
-            mode: 'local',
-        };
-    }
-    return { loggedIn: false };
-}
-/**
- * 沙盒登录降级文案（对齐 dws 三条路径）。
- * 纯函数，便于测试。
- */
-export function sandboxLoginGuide(agentCode, reason) {
-    const head = reason ?? '无法拉起浏览器完成 SSO';
-    const agent = agentCode ? `（agent=${agentCode}, no DISPLAY/TTY）` : '（无浏览器环境）';
-    return `检测到当前是沙盒环境${agent}，${head}。请任选一种方式完成登录：
-
-  [推荐] 从本地宿主机导出登录态：
-    (本地) atlas auth export --base64
-    (沙盒) export ATLAS_COOKIES_B64=<粘贴上一步输出>
-           atlas auth doctor   # 确认识别成功
-
-  [网络可达宿主机] 复用 daemon：
-    (本地) atlas daemon
-    (沙盒) export ATLAS_DAEMON_URL=http://host.docker.internal:8765
-           export ATLAS_DAEMON_TOKEN=<~/.atlas/daemon.token 内容>
-           atlas auth status   # 走 daemon 透明鉴权
-
-  [文件传输] 直接拷贝 bundle：
-    (本地) atlas auth export -o /tmp/atlas-auth.tar.gz
-    (沙盒) atlas auth import -i /tmp/atlas-auth.tar.gz
-`;
-}
-export async function loginCmd(opts) {
-    const { detectEnvironment } = await import('../util/environment.js');
-    const env = detectEnvironment();
-    // 优先复用 daemon（已存在逻辑）
-    const daemonCookies = await fetchCookiesFromDaemon();
-    if (daemonCookies && daemonCookies.length > 0) {
-        await writeCookies(daemonCookies);
-        log('已从 daemon 获取 cookies');
-        if (opts.json || isJsonMode()) {
-            jsonOk({ status: 'logged_in', via: 'daemon' });
-        }
-        return;
-    }
-    // 沙盒环境：直接走引导路径，不尝试拉起 Firefox
-    if (!env.canLaunchBrowser) {
-        throw new AtlasError(sandboxLoginGuide(env.agentCode, env.isContainer ? '容器环境无法拉起 GUI' : '无 TTY/DISPLAY'), 'INTERACTIVE_REQUIRED');
-    }
-    // 本地环境：尝试拉起浏览器；失败降级为引导提示而非硬崩
-    try {
-        await login();
-    }
-    catch (e) {
-        log(sandboxLoginGuide(env.agentCode, '浏览器拉起失败'));
-        if (opts.json || isJsonMode()) {
-            // 已在 stderr 给出引导，仍抛出错误让上层以 INTERACTIVE_REQUIRED 退出
-        }
-        throw e instanceof Error
-            ? new AtlasError(`浏览器登录失败：${e.message}\n${sandboxLoginGuide(env.agentCode, '浏览器拉起失败')}`, 'INTERACTIVE_REQUIRED')
-            : e;
-    }
-    if (opts.json || isJsonMode()) {
-        jsonOk({ status: 'logged_in' });
-    }
-}
-export async function statusCmd(opts) {
-    const status = await loginStatus();
-    if (opts.json || isJsonMode()) {
-        jsonOk(status);
-        return;
-    }
-    if (status.loggedIn) {
-        log(`已登录 (${status.mode === 'daemon' ? 'daemon' : 'local cookies'})`);
-        if (status.account)
-            log(`账号: ${status.account}`);
-    }
-    else {
-        log('未登录，请执行 atlas auth login');
-    }
-}

package/dist/adapters/atlas/auth/portable.js

@@ -1,193 +0,0 @@
-/**
- * atlas auth export / import / doctor 命令。
- *
- * 完全对齐 dws 参数：
- *   atlas auth export [-o <path>] [--base64] [--refresh-only] [--include-access-token]
- *   atlas auth import [-i <path>] [--base64] [--force] [--persist]
- *   atlas auth doctor
- *
- * 安全护栏详见 docs/sandbox-login-plan.md §4.3/§4.4 与 §8。
- */
-import { readFileSync } from 'fs';
-import { buildBundle, serializeBundleBase64, writeBundleToFile, parseBundleBase64, parseBundleFile, } from '../util/portable-store.js';
-import { detectEnvironment, resolveDaemonConfig, probeDaemonReachable, } from '../util/environment.js';
-import { readCookies, writeCookies } from './session.js';
-import { isJsonMode, jsonOk, log, printError } from '../util/output.js';
-import { ConfigError } from '../util/errors.js';
-import { getCookieFile } from '../util/paths.js';
-const REFRESH_TOKEN_WARNING = '⚠️  即将输出的 refresh token 是长期凭证，请仅在受信任的环境粘贴，且仅用于一次性导入。';
-/** 当前 ISO 时间戳（命令层调用，纯逻辑层不依赖） */
-function nowIso() {
-    return new Date().toISOString();
-}
-export async function exportCmd(opts) {
-    // refresh-only 默认开启；--include-access-token 显式关闭
-    const refreshOnly = opts.includeAccessToken ? false : opts.refreshOnly !== false;
-    const cookies = await readCookies();
-    if (!cookies || cookies.length === 0) {
-        throw new ConfigError('本地无登录态，无法导出。请先执行：atlas auth login');
-    }
-    const bundle = buildBundle(cookies, {
-        refreshOnly,
-        exportedAt: nowIso(),
-    });
-    // 输出到 stdout（base64 模式无 -o，明显是给 agent 管道用的，先打 stderr 警告）
-    if (opts.base64 && !opts.out) {
-        log(REFRESH_TOKEN_WARNING);
-        const b64 = await serializeBundleBase64(bundle);
-        process.stdout.write(b64 + '\n');
-        if (opts.json || isJsonMode()) {
-            // JSON 模式下也输出信封，但 stdout 已被 b64 占用——只在 stderr 给提示
-            log('（JSON 模式下 base64 优先写 stdout；信封省略）');
-        }
-        return;
-    }
-    // base64 模式 + -o：写到文件
-    if (opts.base64 && opts.out) {
-        const resolved = await writeBundleToFile(bundle, opts.out, true);
-        if (refreshOnly)
-            log(REFRESH_TOKEN_WARNING);
-        log(`已导出到 ${resolved}（refresh-only=${refreshOnly}，base64 文本）`);
-        if (opts.json || isJsonMode()) {
-            jsonOk({ exported: true, path: resolved, refreshOnly, base64: true, count: bundle.cookies.length });
-        }
-        return;
-    }
-    // 无 base64 写二进制 gzip 文件（需 -o）
-    if (opts.out) {
-        const resolved = await writeBundleToFile(bundle, opts.out, false);
-        if (refreshOnly)
-            log(REFRESH_TOKEN_WARNING);
-        log(`已导出到 ${resolved}（refresh-only=${refreshOnly}，gzip 二进制）`);
-        if (opts.json || isJsonMode()) {
-            jsonOk({ exported: true, path: resolved, refreshOnly, base64: false, count: bundle.cookies.length });
-        }
-        return;
-    }
-    // 既无 base64 也无 -o：默认走 base64 stdout（对齐 dws `export` 无参行为）
-    log(REFRESH_TOKEN_WARNING);
-    const b64 = await serializeBundleBase64(bundle);
-    process.stdout.write(b64 + '\n');
-}
-export async function importCmd(opts) {
-    const persist = opts.persist !== false; // 默认落盘
-    let bundle;
-    let osMismatch = false;
-    // 从 stdin 读 base64：--base64 且无 -i
-    if (opts.base64 && !opts.input) {
-        const b64 = readFileSync(0, 'utf-8').trim(); // fd 0 = stdin
-        const result = await parseBundleBase64(b64);
-        bundle = result.bundle;
-        osMismatch = result.warning.osMismatch;
-    }
-    else if (opts.input) {
-        const result = await parseBundleFile(opts.input);
-        bundle = result.bundle;
-        osMismatch = result.warning.osMismatch;
-    }
-    else {
-        throw new ConfigError('请指定导入源：-i <文件> 或 --base64 从 stdin 读取（如 ATLAS_COOKIES_B64 环境变量自动导入请使用环境变量方式）');
-    }
-    if (bundle.cookies.length === 0) {
-        throw new ConfigError('导入的 bundle 不含任何 cookies，请确认导出源已登录');
-    }
-    // 跨 OS 警告（不阻断）
-    if (osMismatch) {
-        log(`⚠️  bundle 在 ${bundle.manifest.os} 导出，当前为 ${process.platform}，跨平台 cookies 可能失效`);
-    }
-    // 已有 cookies 且未 --force 时拒绝覆盖
-    const existing = await readCookies();
-    if (existing && existing.length > 0 && !opts.force) {
-        throw new ConfigError('本地已存在登录态，拒绝覆盖。使用 --force 强制覆盖（将丢失旧 cookies）');
-    }
-    if (persist) {
-        await writeCookies(bundle.cookies);
-        log(`已导入 ${bundle.cookies.length} 个 cookies 到 ${getCookieFile()}`);
-        if (opts.json || isJsonMode()) {
-            jsonOk({
-                imported: true,
-                count: bundle.cookies.length,
-                osMismatch,
-                refreshOnly: bundle.manifest.refreshOnly,
-                persisted: true,
-            });
-        }
-    }
-    else {
-        // 仅内存缓存（不落盘），用于一次性会话
-        // readCookies 走 cachedCookies，需手动注入缓存
-        const { __setCachedCookiesForImport } = await import('./session.js');
-        __setCachedCookiesForImport(bundle.cookies);
-        log(`已内存导入 ${bundle.cookies.length} 个 cookies（未落盘）`);
-        if (opts.json || isJsonMode()) {
-            jsonOk({
-                imported: true,
-                count: bundle.cookies.length,
-                osMismatch,
-                refreshOnly: bundle.manifest.refreshOnly,
-                persisted: false,
-            });
-        }
-    }
-}
-/** 推导 recommendedPath（纯函数，便于测试） */
-export function recommendPath(opts) {
-    if (opts.canLaunchBrowser)
-        return 'browser';
-    if (opts.daemonReachable)
-        return 'daemon';
-    if (opts.cookiesReady)
-        return 'manual_export_hint';
-    return 'import';
-}
-export async function doctorCmd(opts) {
-    const env = detectEnvironment();
-    const daemonCfg = resolveDaemonConfig();
-    const daemonReachable = await probeDaemonReachable(daemonCfg.url ?? undefined, daemonCfg.token ?? undefined);
-    const recommendedPath = recommendPath({
-        canLaunchBrowser: env.canLaunchBrowser,
-        cookiesReady: env.cookiesReady,
-        daemonReachable,
-        daemonVia: daemonCfg.via,
-    });
-    const result = {
-        agentCode: env.agentCode,
-        agentSignal: env.agentSignal,
-        sandbox: !env.canLaunchBrowser,
-        canLaunchBrowser: env.canLaunchBrowser,
-        cookies: { path: getCookieFile(), present: env.cookiesReady, expired: null },
-        daemon: {
-            url: daemonCfg.url,
-            reachable: daemonReachable,
-            via: daemonCfg.via,
-        },
-        recommendedPath,
-    };
-    if (opts.json || isJsonMode()) {
-        jsonOk(result);
-        return;
-    }
-    // 人类可读输出
-    log('Atlas auth 诊断');
-    log(`  agent: ${env.agentCode || '(未识别)'} ${env.agentSignal ? `[${env.agentSignal}]` : ''}`);
-    log(`  沙盒环境: ${result.sandbox ? '是' : '否'}`);
-    log(`  可拉起浏览器: ${env.canLaunchBrowser ? '是' : '否'} (TTY=${env.hasTTY}, DISPLAY=${env.hasDisplay}, container=${env.isContainer})`);
-    log(`  本地 cookies: ${env.cookiesReady ? '已就绪' : '缺失'} (${getCookieFile()})`);
-    log(`  Daemon: ${daemonCfg.url ? `${daemonCfg.url} (${daemonCfg.via})` : '未配置'} - ${daemonReachable ? '可达' : '不可达'}`);
-    log(`  推荐路径: ${recommendedPath}`);
-    if (result.sandbox && !env.cookiesReady && !daemonReachable) {
-        log('');
-        log('沙盒登录引导：');
-        log('  [推荐] 从本地导出 → 沙盒导入：');
-        log('    (本地) atlas auth export --base64');
-        log('    (沙盒) export ATLAS_COOKIES_B64=<粘贴上一步输出> && atlas auth doctor');
-        log('  [或] 复用宿主机 daemon：');
-        log('    (本地) atlas daemon');
-        log('    (沙盒) export ATLAS_DAEMON_URL=http://host.docker.internal:8765');
-        log('           export ATLAS_DAEMON_TOKEN=<~/.atlas/daemon.token 内容>');
-    }
-}
-/** 兼容错误打印 helper（cli.ts handleError 用不到，保留给子命令内部用） */
-export function reportError(err, json) {
-    printError(err, { json });
-}

package/dist/adapters/atlas/auth/refresh.js

@@ -1,138 +0,0 @@
-/**
- * atlas auth refresh —— headless 静默换发 access_token。
- *
- * 原理：斑马 banma-yuntu 首页在 access_token 缺失/过期时会被 SSO
- * 拦截并走 302 重定向链换发新 token。已通过 spike 验证 headless 模式下
- * SSO_REFRESH_TOKEN 足以完成整个链路，无需人工交互。
- *
- * 失败降级：抛 SessionExpiredError 引导用户 atlas auth login。
- */
-import { readCookies, writeCookies } from './session.js';
-import { loadFirefox, ensureFirefoxInstalled } from './browser.js';
-import { isJsonMode, jsonOk, log } from '../util/output.js';
-import { AtlasError, SessionExpiredError } from '../util/errors.js';
-const BANMA_HOST = 'banma-yuntu.alibaba-inc.com';
-const REFRESH_TIMEOUT_MS = 15_000;
-const POLL_INTERVAL_MS = 500;
-/**
- * 执行一次静默 SSO 刷新。
- *
- * 前置条件：本地存在 cookies.json 且含有 SSO_REFRESH_TOKEN 等长期凭证。
- * 成功：新 access_token 落库；返回 { refreshed: true, account }。
- * 失败：抛 SessionExpiredError 引导 atlas auth login。
- */
-export async function refreshSession(opts = {}) {
-    const timeoutMs = opts.timeoutMs ?? REFRESH_TIMEOUT_MS;
-    const pollIntervalMs = opts.pollIntervalMs ?? POLL_INTERVAL_MS;
-    const existing = await readCookies();
-    if (!existing || existing.length === 0) {
-        throw new AtlasError('未检测到本地登录态，请先执行：atlas auth login', 'INTERACTIVE_REQUIRED');
-    }
-    const originalAccessToken = existing.find((c) => c.name === 'access_token')?.value ?? '';
-    const firefox = await loadFirefox();
-    let browser;
-    try {
-        browser = await firefox.launch({ headless: true });
-    }
-    catch (e) {
-        if (e instanceof Error && e.message.includes("Executable doesn't exist")) {
-            await ensureFirefoxInstalled();
-            browser = await firefox.launch({ headless: true });
-        }
-        else {
-            throw e;
-        }
-    }
-    try {
-        const ctx = await browser.newContext();
-        // 灌入已有 cookie，但剥离失效的 access_token 及相关签名 cookies
-        // （access_token.sig / refresh_token / refresh_token.sig）—— 强制
-        // SSO 用 SSO_REFRESH_TOKEN 换发全套新 token，防止 still_valid 假阳性。
-        // 注：实际工时 API 会校验 token + signature 匹配，只换 access_token
-        // 不换 sig 同样会被拒绝。
-        // playwright 严格校验 cookie 字段，需要补齐 path/secure 等。
-        const tokenNames = new Set(['access_token', 'access_token.sig', 'refresh_token', 'refresh_token.sig']);
-        const cookiesForContext = existing
-            .filter((c) => !tokenNames.has(c.name))
-            .map((c) => ({
-            name: c.name,
-            value: c.value,
-            domain: c.domain ?? '.alibaba-inc.com',
-            path: '/',
-            httpOnly: false,
-            secure: true,
-            sameSite: 'Lax',
-        }));
-        await ctx.addCookies(cookiesForContext);
-        const page = await ctx.newPage();
-        await page.goto(`https://${BANMA_HOST}/`, {
-            waitUntil: 'domcontentloaded',
-            timeout: timeoutMs,
-        });
-        // 轮询 access_token：goto 完成后如果 SSO 302 链跑通，浏览器 context 里
-        // 就会有 access_token（可能是原值——本来就没过期；也可能是新值——SSO 补发）。
-        // 两种情况都视为"session 依然可用"，回写 cookies 即可；只有拿不到才算失败。
-        let finalToken = null;
-        let tokenChanged = false;
-        const startedAt = Date.now();
-        while (Date.now() - startedAt < timeoutMs) {
-            const all = await ctx.cookies();
-            const cur = all.find((c) => c.name === 'access_token');
-            if (cur && cur.value) {
-                finalToken = cur.value;
-                tokenChanged = cur.value !== originalAccessToken;
-                // 如果 token 变了（真的刷新过），马上确认，避免过早退出
-                if (tokenChanged || !originalAccessToken)
-                    break;
-                // 如果 token 未变，多轮询几次给 SSO 一点补发机会，但 goto 完成后
-                // 通常几百 ms 内就有结论；等一轮就够了。
-                await page.waitForTimeout(pollIntervalMs);
-                const again = (await ctx.cookies()).find((c) => c.name === 'access_token');
-                if (again && again.value !== originalAccessToken) {
-                    finalToken = again.value;
-                    tokenChanged = true;
-                }
-                break;
-            }
-            await page.waitForTimeout(pollIntervalMs);
-        }
-        if (!finalToken) {
-            throw new SessionExpiredError('自动刷新失败（未获取到 access_token），请重新登录：atlas auth login');
-        }
-        // 抓 banma-yuntu / alibaba-inc 域下所有 cookies，回写持久化
-        const all = await ctx.cookies();
-        const filtered = all
-            .filter((c) => c.domain?.includes('banma-yuntu') || c.domain?.includes('alibaba-inc'))
-            .map((c) => ({ name: c.name, value: c.value, domain: c.domain }));
-        await writeCookies(filtered);
-        const account = deriveAccountName(filtered);
-        return { refreshed: tokenChanged, account };
-    }
-    finally {
-        await browser.close();
-    }
-}
-function deriveAccountName(cookies) {
-    const userinfo = cookies.find((c) => c.name === 'buc_userinfo');
-    if (userinfo) {
-        try {
-            const decoded = JSON.parse(Buffer.from(userinfo.value, 'base64').toString('utf-8'));
-            return decoded.name || decoded.account || (decoded.emp_id ? `工号 ${decoded.emp_id}` : undefined);
-        }
-        catch {
-            // 解码失败降级到 buc_username
-        }
-    }
-    return cookies.find((c) => c.name === 'buc_username')?.value;
-}
-export async function refreshCmd(opts) {
-    const result = await refreshSession();
-    const status = result.refreshed ? 'refreshed' : 'still_valid';
-    if (opts.json || isJsonMode()) {
-        jsonOk({ status, account: result.account });
-        return;
-    }
-    log(result.refreshed ? '会话已刷新' : '会话仍然有效，无需刷新');
-    if (result.account)
-        log(`账号: ${result.account}`);
-}