@luckypiggy/zhihu-ai-cli 0.1.0-test.1 → 0.2.1-test.4

package/dist/terminal-prompt.js

@@ -0,0 +1,191 @@
+import { createInterface } from "node:readline/promises";
+import { stdin as defaultInput, stderr as defaultOutput } from "node:process";
+export class TerminalPromptCancelledError extends Error {
+    constructor() {
+        super("Login cancelled");
+        this.name = "TerminalPromptCancelledError";
+    }
+}
+export class TerminalPromptInteractiveRequiredError extends Error {
+    constructor() {
+        super("Interactive terminal input is required");
+        this.name = "TerminalPromptInteractiveRequiredError";
+    }
+}
+function validateValue(value, label, maxLength, required = true) {
+    const normalized = value.trim();
+    if ((!normalized && required) || normalized.length > maxLength || /[\u0000-\u001f\u007f]/.test(normalized)) {
+        throw new Error(`${label} is invalid`);
+    }
+    return normalized;
+}
+function isTty(stream) {
+    return Boolean(stream.isTTY);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw new TerminalPromptCancelledError();
+}
+async function ask(rl, label, defaultValue, output, signal, required = true) {
+    throwIfAborted(signal);
+    const prompt = `${label}${defaultValue === undefined ? "" : ` [${defaultValue}]`}: `;
+    let remove = () => { };
+    const cancellation = new Promise((_resolve, reject) => {
+        const cancel = () => reject(new TerminalPromptCancelledError());
+        signal?.addEventListener("abort", cancel, { once: true });
+        remove = () => signal?.removeEventListener("abort", cancel);
+    });
+    try {
+        const value = await Promise.race([rl.question(prompt), cancellation]);
+        const answer = value.trim() || defaultValue || "";
+        if (!answer && required) {
+            output.write("A value is required. Please try again.\n");
+            return ask(rl, label, defaultValue, output, signal, required);
+        }
+        return answer;
+    }
+    finally {
+        remove();
+    }
+}
+export async function promptHiddenPassword(input, output, label, signal) {
+    const rawInput = input;
+    if (typeof rawInput.setRawMode !== "function" || typeof input.on !== "function") {
+        throw new TerminalPromptInteractiveRequiredError();
+    }
+    throwIfAborted(signal);
+    output.write(label);
+    let answer = "";
+    let settled = false;
+    const previousRaw = rawInput.isRaw === true;
+    const previousPaused = typeof rawInput.isPaused === "function" ? rawInput.isPaused() : false;
+    const finish = (resolve, reject, error) => {
+        if (settled)
+            return;
+        settled = true;
+        input.removeListener?.("data", onData);
+        input.removeListener?.("error", onError);
+        input.removeListener?.("end", onEnd);
+        input.removeListener?.("close", onClose);
+        signal?.removeEventListener("abort", onAbort);
+        try {
+            rawInput.setRawMode?.(previousRaw);
+        }
+        catch { /* best effort */ }
+        if (previousPaused)
+            rawInput.pause?.();
+        else
+            rawInput.resume?.();
+        output.write("\n");
+        if (error)
+            reject(error);
+        else
+            resolve(answer);
+    };
+    let resolveValue;
+    let rejectValue;
+    const promise = new Promise((resolve, reject) => {
+        resolveValue = resolve;
+        rejectValue = reject;
+    });
+    const onAbort = () => finish(resolveValue, rejectValue, new TerminalPromptCancelledError());
+    const onError = () => finish(resolveValue, rejectValue, new TerminalPromptCancelledError());
+    const onEnd = () => finish(resolveValue, rejectValue, new TerminalPromptCancelledError());
+    const onClose = () => finish(resolveValue, rejectValue, new TerminalPromptCancelledError());
+    const onData = (chunk) => {
+        const text = Buffer.isBuffer(chunk) ? chunk.toString("utf8") : chunk;
+        for (const character of text) {
+            if (character === "\u0003" || character === "\u001b") {
+                finish(resolveValue, rejectValue, new TerminalPromptCancelledError());
+                return;
+            }
+            if (character === "\r" || character === "\n") {
+                if (!answer) {
+                    output.write("\nA value is required. Please try again.\n");
+                    output.write(label);
+                    continue;
+                }
+                finish(resolveValue, rejectValue);
+                return;
+            }
+            if (character === "\u007f" || character === "\b") {
+                answer = answer.slice(0, -1);
+                continue;
+            }
+            if (character < " " || character === "\u007f") {
+                finish(resolveValue, rejectValue, new Error("Password is invalid"));
+                return;
+            }
+            if (character >= " " && character !== "\u007f") {
+                if (answer.length >= 4096) {
+                    finish(resolveValue, rejectValue, new Error("Password is invalid"));
+                    return;
+                }
+                answer += character;
+            }
+        }
+    };
+    input.on("data", onData);
+    input.once?.("error", onError);
+    input.once?.("end", onEnd);
+    input.once?.("close", onClose);
+    signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+        rawInput.setRawMode(true);
+        rawInput.resume?.();
+        return await promise;
+    }
+    catch (error) {
+        finish(resolveValue, rejectValue, error instanceof Error ? error : new TerminalPromptCancelledError());
+        throw error;
+    }
+}
+async function secret(input, output, label, signal, injected) {
+    throwIfAborted(signal);
+    const value = injected
+        ? await injected(label)
+        : isTty(input)
+            ? await promptHiddenPassword(input, output, label, signal)
+            : (() => { throw new TerminalPromptInteractiveRequiredError(); })();
+    // Passwords are opaque credentials: preserve leading/trailing spaces and
+    // validate only the same boundaries enforced by the HTTP contract.
+    if (typeof value !== "string" || value.length === 0 || value.length > 4096 || /[\u0000-\u001f\u007f]/.test(value)) {
+        throw new Error("Password is invalid");
+    }
+    return value;
+}
+export async function promptTerminalCredentials(options = {}) {
+    const input = options.input ?? defaultInput;
+    const output = options.output ?? defaultOutput;
+    const rl = createInterface({ input, output });
+    try {
+        const usernameLabel = options.usernameLabel ?? "Zhihu username";
+        const tenantLabel = options.tenantLabel ?? "Tenant id (optional)";
+        const captchaLabel = options.captchaLabel ?? "Captcha verification (optional)";
+        const passwordLabel = options.passwordLabel ?? "Zhihu password: ";
+        const usernameRaw = options.valuePrompt
+            ? await options.valuePrompt(usernameLabel, options.defaultUsername)
+            : await ask(rl, usernameLabel, options.defaultUsername, output, options.signal);
+        const username = validateValue(usernameRaw, "Username", 256);
+        const tenantRaw = options.valuePrompt
+            ? await options.valuePrompt(tenantLabel, options.defaultTenantId)
+            : await ask(rl, tenantLabel, options.defaultTenantId, output, options.signal, false);
+        const tenant_id = tenantRaw.trim() ? validateValue(tenantRaw, "Tenant id", 128) : undefined;
+        const captchaRaw = options.valuePrompt
+            ? await options.valuePrompt(captchaLabel)
+            : await ask(rl, captchaLabel, undefined, output, options.signal, false);
+        const captcha_verification = captchaRaw.trim() ? validateValue(captchaRaw, "Captcha verification", 4096) : undefined;
+        if (isTty(input) && !options.secretPrompt)
+            rl.close();
+        const password = await secret(input, output, passwordLabel, options.signal, options.secretPrompt);
+        return {
+            username,
+            password,
+            ...(tenant_id ? { tenant_id } : {}),
+            ...(captcha_verification ? { captcha_verification } : {}),
+        };
+    }
+    finally {
+        rl.close();
+    }
+}

package/dist/token-manager.js

@@ -1,6 +1,7 @@
 import { CredentialStoreError } from "./credentials.js";
 import { HttpError } from "./http.js";
 import { withProfileLock, ProfileLockError } from "./profile-lock.js";
+import { cliCommand } from "./release.js";
 const CLOCK_SKEW_SECONDS = 60;
 export class CliAuthError extends Error {
     code;
@@ -64,21 +65,39 @@ function mapFailure(error) {
                                         : error.code === "FORBIDDEN"
                                             || error.code === "CAPABILITY_SCOPE_REQUIRED"
                                             || error.code === "CAPABILITY_NOT_AVAILABLE"
+                                            || error.code === "A2A_DISABLED"
+                                            || error.code === "A2A_CAPABILITY_NOT_FOUND"
+                                            || error.code === "A2A_CAPABILITY_DISABLED"
+                                            || error.code === "A2A_TASK_NOT_FOUND"
+                                            || error.code === "A2A_FORBIDDEN"
+                                            || error.code === "A2A_CANCELLED"
+                                            || error.code === "A2A_EMPTY_RESPONSE"
+                                            || error.code === "A2A_EXECUTION_INDETERMINATE"
                                             || error.code === "EMPLOYEE_NOT_FOUND"
                                             || error.code === "EMPLOYEE_NOT_CHATABLE"
                                             || error.code === "CONVERSATION_NOT_FOUND"
                                             ? 5
                                             : error.code === "SERVER_ERROR"
+                                                || error.code === "A2A_RUNTIME_ERROR"
+                                                || error.code === "A2A_TIMEOUT"
+                                                || error.code === "A2A_DUPLICATE"
+                                                || error.code === "A2A_TASK_START_FAILED"
                                                 ? 6
                                                 : error.code === "VERSION_INCOMPATIBLE"
                                                     || error.code === "SERVICE_CONFIGURATION_REQUIRED"
+                                                    || error.code === "TERMINAL_LOGIN_REQUIRED"
                                                     ? 7
-                                                    : error.code === "PROTOCOL_ERROR"
-                                                        || error.code === "RESPONSE_TOO_LARGE"
-                                                        || error.code === "UPSTREAM_PROTOCOL_ERROR"
-                                                        || error.code === "UPSTREAM_RESPONSE_TOO_LARGE"
-                                                        ? 8
-                                                        : 4;
+                                                    : error.code === "AUTH_LOGIN_FAILED"
+                                                        || error.code === "AUTH_ACCOUNT_LOCKED"
+                                                        || error.code === "AUTH_CAPTCHA_REQUIRED"
+                                                        || error.code === "INTERACTIVE_REQUIRED"
+                                                        ? 2
+                                                        : error.code === "PROTOCOL_ERROR"
+                                                            || error.code === "RESPONSE_TOO_LARGE"
+                                                            || error.code === "UPSTREAM_PROTOCOL_ERROR"
+                                                            || error.code === "UPSTREAM_RESPONSE_TOO_LARGE"
+                                                            ? 8
+                                                            : 4;
         return new CliAuthError(error.code, error.message, { retryable: error.retryable, exitCode });
     }
     return new CliAuthError("NETWORK_ERROR", "Unable to reach the Zhihu service", { retryable: true, exitCode: 4 });
@@ -87,13 +106,15 @@ export class TokenManager {
     client;
     credentials;
     profile;
+    environment;
     operationTail = Promise.resolve();
     accessTokenValue;
     accessInfoValue;
-    constructor(client, credentials, profile) {
+    constructor(client, credentials, profile, options = {}) {
         this.client = client;
         this.credentials = credentials;
         this.profile = profile;
+        this.environment = options.environment;
     }
     get accessInfo() {
         return this.accessInfoValue;
@@ -110,7 +131,7 @@ export class TokenManager {
     }
     async refreshWithProfileLock() {
         try {
-            return await withProfileLock(this.profile, () => this.refreshWithinLock());
+            return await withProfileLock(this.profile, () => this.refreshWithinLock(), { environment: this.environment });
         }
         catch (error) {
             throw mapFailure(error);
@@ -119,7 +140,7 @@ export class TokenManager {
     async refreshWithinLock() {
         const oldCredential = await this.credentials.get();
         if (!oldCredential) {
-            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "No active login; run zhihu auth login.", { exitCode: 3 });
+            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", `No active login; run ${cliCommand("auth", "login")}.`, { exitCode: 3 });
         }
         let refreshed;
         try {
@@ -157,7 +178,7 @@ export class TokenManager {
                 // Keep the primary credential-store failure stable.
             }
             const mapped = mapFailure(error);
-            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Credential storage failed; run zhihu auth login again.", { retryable: mapped.retryable, exitCode: 3 });
+            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", `Credential storage failed; run ${cliCommand("auth", "login")} again.`, { retryable: mapped.retryable, exitCode: 3 });
         }
         this.accessTokenValue = refreshed.access_token;
         this.accessInfoValue = {
@@ -210,9 +231,9 @@ export class TokenManager {
                     if (!isAuthenticationFailure(error))
                         throw mapFailure(error);
                     await this.clearDeadCredentialWithinLock();
-                    throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Your Zhihu session has expired. Run `zhihu auth login`.", { exitCode: 3 });
+                    throw new CliAuthError("AUTH_RELOGIN_REQUIRED", `Your Zhihu session has expired. Run \`${cliCommand("auth", "login")}\`.`, { exitCode: 3 });
                 }
-            }));
+            }, { environment: this.environment }));
         }
         catch (error) {
             throw mapFailure(error);
@@ -251,7 +272,7 @@ export class TokenManager {
                 if (!isAuthenticationFailure(error) || observedEvent)
                     throw mapFailure(error);
                 await this.clearDeadCredential();
-                throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Your Zhihu session has expired. Run `zhihu auth login`.", { exitCode: 3 });
+                throw new CliAuthError("AUTH_RELOGIN_REQUIRED", `Your Zhihu session has expired. Run \`${cliCommand("auth", "login")}\`.`, { exitCode: 3 });
             }
         }
         catch (error) {
@@ -259,7 +280,7 @@ export class TokenManager {
         }
     }
     async clearDeadCredential() {
-        await this.exclusive(() => withProfileLock(this.profile, () => this.clearDeadCredentialWithinLock()));
+        await this.exclusive(() => withProfileLock(this.profile, () => this.clearDeadCredentialWithinLock(), { environment: this.environment }));
     }
     async clearDeadCredentialWithinLock() {
         let currentCredential = null;
@@ -307,7 +328,7 @@ export class TokenManager {
                 this.accessTokenValue = undefined;
                 this.accessInfoValue = undefined;
                 return "revoked";
-            }));
+            }, { environment: this.environment }));
         }
         catch (error) {
             throw mapFailure(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@luckypiggy/zhihu-ai-cli",
-  "version": "0.1.0-test.1",
+  "version": "0.2.1-test.4",
   "description": "智护 Pilot CLI：认证、数字员工、资产、指标、告警、指定告警诊断和巡检只读能力（P1 Read-only）",
   "keywords": [
     "zhihu-pilot",
@@ -35,7 +35,9 @@
     "test": "npm run build && node --test tests/*.mjs",
     "pack:dry-run": "npm_config_cache=\"${TMPDIR:-/tmp}/zhihu-ai-cli-npm-cache\" npm pack --dry-run --json --loglevel=error",
     "build:offline": "node scripts/build-offline-release.mjs",
-    "verify:offline": "node scripts/verify-offline-release.mjs"
+    "build:public-test": "node scripts/build-public-test-package.mjs",
+    "verify:offline": "node scripts/verify-offline-release.mjs",
+    "verify:public-test": "node scripts/verify-public-test-release.mjs"
   },
   "devDependencies": {
     "@types/node": "22.15.0",

package/dist/browser.js

@@ -1,49 +0,0 @@
-import { spawn } from "node:child_process";
-export function validAuthorizationUrl(value) {
-    try {
-        const parsed = new URL(value);
-        const loopback = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1" || parsed.hostname === "[::1]" || parsed.hostname === "::1";
-        return /^https?:$/.test(parsed.protocol)
-            && (parsed.protocol === "https:" || loopback)
-            && !parsed.username
-            && !parsed.password
-            && !/[\u0000-\u001f\u007f]/.test(value);
-    }
-    catch {
-        return false;
-    }
-}
-/** Launch a browser without a shell; the URL is never logged by this helper. */
-export const openSystemBrowser = (authorizationUrl) => new Promise((resolve) => {
-    if (!validAuthorizationUrl(authorizationUrl)) {
-        resolve(false);
-        return;
-    }
-    const command = process.platform === "darwin" ? "/usr/bin/open" : process.platform === "linux" ? "/usr/bin/xdg-open" : undefined;
-    if (!command) {
-        resolve(false);
-        return;
-    }
-    let child;
-    try {
-        child = spawn(command, [authorizationUrl], { shell: false, stdio: ["ignore", "ignore", "ignore"] });
-    }
-    catch {
-        resolve(false);
-        return;
-    }
-    let settled = false;
-    const timer = setTimeout(() => {
-        child.kill();
-        finish(false);
-    }, 5000);
-    const finish = (ok) => {
-        if (settled)
-            return;
-        settled = true;
-        clearTimeout(timer);
-        resolve(ok);
-    };
-    child.once("error", () => finish(false));
-    child.once("close", (code) => finish(code === 0));
-});

package/dist/pkce.js

@@ -1,15 +0,0 @@
-import { createHash, randomBytes } from "node:crypto";
-const VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
-function base64Url(value) {
-    return value.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
-}
-/** Generate RFC 7636 S256 material without retaining it outside the caller. */
-export function createPkcePair() {
-    const verifier = base64Url(randomBytes(32));
-    const challenge = base64Url(createHash("sha256").update(verifier, "ascii").digest());
-    return Object.freeze({ verifier, challenge, method: "S256" });
-}
-export function isValidCodeVerifier(value) {
-    return typeof value === "string" && VERIFIER_PATTERN.test(value);
-}
-export const generatePkce = createPkcePair;