@luckypiggy/zhihu-ai-cli 0.1.0-test.1

package/dist/cli.js

@@ -0,0 +1,1092 @@
+import { existsSync, lstatSync } from "node:fs";
+import { isIP } from "node:net";
+import { isAbsolute, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { CLI_VERSION, MIN_NODE_MAJOR, } from "./contracts.js";
+import { ConfigError, DEFAULT_PROFILE, DEFAULT_PROFILE_NAME, checkProfile, configRoot, guardProfileConnectionChange, initializeProfile, ProfileConnectionGuardError, readConfigSnapshot, readProfileRaw, validateProfile, } from "./config.js";
+import { withProfileLock } from "./profile-lock.js";
+import { emitError, emitSuccess } from "./output.js";
+import { redactString, redactValue } from "./redaction.js";
+import { AuthService } from "./auth-service.js";
+import { SecureCredentialStore } from "./credentials.js";
+import { IntegrationHttpClient, HttpError, validateIntegrationInfo, } from "./http.js";
+import { CliAuthError, TokenManager, mapFailure } from "./token-manager.js";
+import { CodexSkillError, inspectCodexSkill, installCodexSkill, uninstallCodexSkill, } from "./codex-skill.js";
+import { InstallError, installWizard } from "./install.js";
+class CliFailure extends Error {
+    shape;
+    constructor(shape) {
+        super(shape.message);
+        this.name = "CliFailure";
+        this.shape = shape;
+    }
+}
+function parseArguments(argv) {
+    const command = [];
+    const flags = new Map();
+    const duplicates = new Set();
+    const seen = new Set();
+    let json = false;
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === "--help" || argument === "--version") {
+            if (seen.has(argument))
+                duplicates.add(argument);
+            seen.add(argument);
+            command.push(argument);
+            continue;
+        }
+        if (argument === "--json") {
+            if (seen.has("json"))
+                duplicates.add("json");
+            seen.add("json");
+            json = true;
+            continue;
+        }
+        if (argument.startsWith("--")) {
+            const separator = argument.indexOf("=");
+            if (separator > 2) {
+                flags.set(argument.slice(2, separator), argument.slice(separator + 1));
+            }
+            else {
+                const key = argument.slice(2);
+                const next = argv[index + 1];
+                if (next && !next.startsWith("--")) {
+                    flags.set(key, next);
+                    index += 1;
+                }
+                else {
+                    flags.set(key, true);
+                }
+            }
+            const key = argument.slice(2).split("=", 1)[0];
+            if (seen.has(key))
+                duplicates.add(key);
+            seen.add(key);
+            continue;
+        }
+        command.push(argument);
+    }
+    return { command, json, flags, duplicates };
+}
+function context(parsed) {
+    return { command: parsed.command.join(" ") || "help", json: parsed.json };
+}
+function invalid(message) {
+    throw new CliFailure({
+        code: "INVALID_ARGUMENT",
+        message,
+        retryable: false,
+        exit_code: 2,
+    });
+}
+function profilePartial(flags) {
+    const partial = {};
+    const baseUrl = flags.get("base-url");
+    if (baseUrl !== undefined) {
+        if (typeof baseUrl !== "string")
+            invalid("--base-url requires a URL");
+        partial.base_url = baseUrl;
+    }
+    const timeout = flags.get("timeout");
+    if (timeout !== undefined) {
+        if (typeof timeout !== "string" || !/^\d+$/.test(timeout))
+            invalid("--timeout requires seconds");
+        partial.timeout_seconds = Number(timeout);
+    }
+    const language = flags.get("language");
+    if (language !== undefined) {
+        if (language !== "zh" && language !== "en")
+            invalid("--language must be zh or en");
+        partial.language = language;
+    }
+    const caBundle = flags.get("ca-bundle");
+    if (caBundle !== undefined) {
+        if (typeof caBundle !== "string")
+            invalid("--ca-bundle requires a path");
+        partial.ca_bundle = caBundle;
+    }
+    const skillDir = flags.get("codex-skill-dir");
+    if (skillDir !== undefined) {
+        if (typeof skillDir !== "string")
+            invalid("--codex-skill-dir requires a path");
+        partial.codex_skill_dir = skillDir;
+    }
+    return partial;
+}
+function versionData() {
+    const major = Number(process.versions.node.split(".")[0]);
+    return {
+        cli_version: CLI_VERSION,
+        node_version: process.versions.node,
+        node_supported: major >= MIN_NODE_MAJOR,
+        package: "@luckypiggy/zhihu-ai-cli",
+        stage: "p1-readonly",
+    };
+}
+function doctorDetail(error, fallback) {
+    if (error instanceof HttpError || error instanceof CliAuthError || error instanceof ConfigError) {
+        return redactString(error.message);
+    }
+    return fallback;
+}
+function caStatus(path) {
+    if (!path)
+        return { configured: false, state: "not_configured" };
+    try {
+        const stat = lstatSync(path);
+        const valid = isAbsolute(path) && !stat.isSymbolicLink() && stat.isFile()
+            && stat.size >= 1 && stat.size <= 4 * 1024 * 1024;
+        return { configured: true, state: valid ? "valid" : "invalid" };
+    }
+    catch {
+        return { configured: true, state: "unavailable" };
+    }
+}
+export async function doctorData(environment = process.env, options = {}) {
+    const runtimeMajor = Number(process.versions.node.split(".")[0]);
+    let configCheck;
+    let configError;
+    let selectedProfileName = options.profile;
+    let profile = options.profileConfig;
+    let configPresent = false;
+    if (profile) {
+        try {
+            selectedProfileName = selectedProfileName ? selectedProfileName : DEFAULT_PROFILE_NAME;
+            profile = validateProfile(profile);
+            configPresent = true;
+        }
+        catch (error) {
+            configError = error instanceof ConfigError ? error.message : "Profile configuration is invalid";
+            profile = undefined;
+        }
+    }
+    else {
+        try {
+            configCheck = checkProfile(environment, options.profile);
+            selectedProfileName = configCheck.snapshot.selected_profile;
+            configPresent = existsSync(configCheck.snapshot.profile_path);
+            profile = configCheck.profile;
+        }
+        catch (error) {
+            configError = error instanceof ConfigError ? error.message : "Unable to read configuration";
+        }
+    }
+    const profileError = configCheck?.error;
+    const invalidDetail = configError || profileError;
+    const profileReady = configPresent && Boolean(profile) && !invalidDetail;
+    let keychain = { ok: false, state: "not_checked", detail: "No configured profile" };
+    let authentication = { ok: false, state: "not_checked", detail: "No configured profile" };
+    let capabilityCheck = { ok: false, state: "not_checked" };
+    let service = { ok: false, state: "not_checked", detail: "Configure a profile before checking the Pilot service" };
+    let network = { ok: false, state: "not_checked", detail: "Configure a profile before checking the Pilot service" };
+    let tlsCa = { protocol: "invalid", https: false, ca: { configured: false, state: "not_configured" } };
+    let credentials;
+    let storedCredential = null;
+    let client;
+    let serviceValidatedReady = false;
+    if (profileReady && profile && selectedProfileName) {
+        let parsedUrl;
+        try {
+            parsedUrl = new URL(profile.base_url);
+        }
+        catch { /* config validation reports this below */ }
+        tlsCa = { protocol: parsedUrl?.protocol ?? "invalid", https: parsedUrl?.protocol === "https:", ca: caStatus(profile.ca_bundle) };
+        try {
+            credentials = options.credentialStoreFactory
+                ? options.credentialStoreFactory(selectedProfileName)
+                : new SecureCredentialStore(selectedProfileName);
+            await credentials.available();
+            keychain = { ok: true, state: "available" };
+            storedCredential = await credentials.get();
+            authentication = { ok: Boolean(storedCredential), state: storedCredential ? "configured" : "not_configured" };
+        }
+        catch (error) {
+            keychain = { ok: false, state: "unavailable", detail: doctorDetail(error, "System credential store is unavailable") };
+            authentication = { ok: false, state: "unavailable", detail: "System credential store is unavailable" };
+        }
+        try {
+            client = options.clientFactory ? options.clientFactory(profile) : new IntegrationHttpClient(profile);
+            const info = validateIntegrationInfo(await client.info(), false);
+            const ready = info.status === "ready" && info.auth?.configured === true;
+            serviceValidatedReady = ready;
+            service = {
+                ok: ready,
+                state: ready ? "ready" : "configuration_required",
+                service: info.service,
+                protocol_version: info.protocol_version,
+                minimum_cli_version: info.minimum_cli_version,
+                compatible: true,
+                status: info.status,
+                capabilities: info.capabilities,
+            };
+            network = { ok: true, state: "reachable" };
+        }
+        catch (error) {
+            const incompatible = error instanceof HttpError && error.code === "VERSION_INCOMPATIBLE";
+            service = { ok: false, state: incompatible ? "incompatible" : "invalid", detail: doctorDetail(error, "Pilot service response is invalid") };
+            const transportFailure = error instanceof HttpError
+                && (error.code === "NETWORK_ERROR" || error.code === "TIMEOUT");
+            network = transportFailure
+                ? { ok: false, state: "unreachable", detail: doctorDetail(error, "Unable to reach the configured Pilot service") }
+                : { ok: true, state: "reachable", detail: doctorDetail(error, "Pilot service returned an invalid response") };
+        }
+        if (!serviceValidatedReady) {
+            // Never send a stored credential to an origin whose strict /info
+            // identity, version, readiness, or capability contract failed.
+            capabilityCheck = { ok: false, state: "service_invalid", detail: "Capabilities were not checked because the Pilot service is not ready" };
+        }
+        else if (!credentials || !client) {
+            capabilityCheck = { ok: false, state: "unavailable", detail: "Authentication or service checks are unavailable" };
+        }
+        else if (!storedCredential) {
+            capabilityCheck = { ok: false, state: "not_logged_in" };
+        }
+        else {
+            try {
+                const manager = new TokenManager(client, credentials, selectedProfileName);
+                const capabilities = await manager.callReadOnly((accessToken) => client?.capabilities(accessToken));
+                const data = capabilities;
+                capabilityCheck = { ok: true, state: "available", scopes: data.scopes, capabilities: data.capabilities };
+            }
+            catch (error) {
+                capabilityCheck = {
+                    ok: false,
+                    state: error instanceof CliAuthError ? "unauthorized" : "unavailable",
+                    detail: doctorDetail(error, "Capabilities are unavailable"),
+                };
+            }
+        }
+    }
+    const codex = inspectCodexSkill({
+        environment,
+        ...(selectedProfileName ? { profile: selectedProfileName } : {}),
+    });
+    const configCheckResult = {
+        ok: !invalidDetail && (profileReady || !configPresent),
+        state: invalidDetail ? "invalid" : profileReady ? "configured" : "not_configured",
+        path: configRoot(environment),
+        ...(invalidDetail ? { detail: redactString(invalidDetail) } : {}),
+        ...(selectedProfileName ? { profile: selectedProfileName } : {}),
+    };
+    const runtime = { ok: runtimeMajor >= MIN_NODE_MAJOR, node_version: process.versions.node, minimum_node_major: MIN_NODE_MAJOR };
+    const codexCheck = { ok: codex.state === "managed", state: codex.state, ...(codex.target ? { target: codex.target } : {}) };
+    return {
+        cli_version: CLI_VERSION,
+        stage: "p1-readonly",
+        checks: {
+            runtime,
+            config: configCheckResult,
+            tls_ca: tlsCa,
+            service,
+            authentication,
+            capabilities: capabilityCheck,
+            codex: codexCheck,
+            // Compatibility aliases retained for existing automation; the stable
+            // Stage5B contract is the seven checks above.
+            base_url: { ok: profileReady, state: profileReady ? "configured" : "not_configured" },
+            tls: tlsCa,
+            keychain,
+            network,
+            info: service,
+            codex_skill: codexCheck,
+        },
+    };
+}
+function selectedProfile(flags) {
+    const requested = flags.get("profile");
+    if (requested !== undefined && typeof requested !== "string")
+        invalid("--profile requires a name");
+    const result = checkProfile(process.env, requested);
+    if (!result.profile) {
+        throw new CliFailure({
+            code: "CONFIG_INVALID",
+            message: result.error || "Profile is not configured",
+            retryable: false,
+            exit_code: 2,
+        });
+    }
+    if (!result.profile.base_url) {
+        throw new CliFailure({
+            code: "CONFIG_INVALID",
+            message: "Profile base_url is required for authentication",
+            retryable: false,
+            exit_code: 2,
+        });
+    }
+    return { name: result.snapshot.selected_profile, profile: result.profile };
+}
+function authService(flags) {
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    return new AuthService(client, credentials, selected.name, {
+        onBrowserFailure: (authorizationUrl) => {
+            process.stderr.write(`Browser launch failed. Open this URL manually: ${authorizationUrl}\n`);
+        },
+    });
+}
+async function authCommand(action, flags) {
+    if (action !== "login" && action !== "status" && action !== "logout")
+        invalid("Use auth login, auth status, or auth logout");
+    const service = authService(flags);
+    if (action === "login")
+        return service.login();
+    if (action === "status")
+        return service.status();
+    return service.logout();
+}
+async function capabilitiesCommand(action, flags) {
+    if (action !== "list")
+        invalid("Use capabilities list");
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.capabilities(accessToken));
+}
+async function employeesCommand(action, flags) {
+    if (action !== "list")
+        invalid("Use employees list");
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.employees(accessToken));
+}
+function assetFilter(value, field, maxLength) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f]/.test(value)) {
+        invalid(`--${field} must be text up to ${maxLength} characters`);
+    }
+    return value;
+}
+function assetPage(value, field, max, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (typeof value !== "string" || !/^\d+$/.test(value))
+        invalid(`--${field} must be an integer`);
+    const number = Number(value);
+    if (!Number.isSafeInteger(number) || number < 1 || number > max)
+        invalid(`--${field} is out of range`);
+    return number;
+}
+async function assetsCommand(action, flags) {
+    if (action !== "list")
+        invalid("Use assets list");
+    for (const key of flags.keys()) {
+        if (!["profile", "keyword", "model", "page", "page-size"].includes(key)) {
+            invalid(`Unknown assets option: --${key}`);
+        }
+    }
+    const keyword = assetFilter(flags.get("keyword"), "keyword", 256);
+    const model = assetFilter(flags.get("model"), "model", 128);
+    const page = assetPage(flags.get("page"), "page", 10000, 1);
+    const pageSize = assetPage(flags.get("page-size"), "page-size", 100, 20);
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.assetsSearch({ ...(keyword !== undefined ? { keyword } : {}), ...(model !== undefined ? { model } : {}), page, page_size: pageSize }, accessToken));
+}
+function assetRequestId(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) {
+        invalid("--id must use letters, numbers, hyphens, or underscores");
+    }
+    if (/^\d+$/.test(value)) {
+        const normalized = value.replace(/^0+/, "") || "0";
+        let numeric;
+        try {
+            numeric = BigInt(normalized);
+        }
+        catch {
+            invalid("--id is out of range");
+        }
+        if (numeric < 1n || numeric > 9223372036854775807n) {
+            invalid("--id is out of range");
+        }
+        return numeric.toString();
+    }
+    return value;
+}
+async function assetGetCommand(flags) {
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "id")
+            invalid(`Unknown assets get option: --${key}`);
+    }
+    const id = assetRequestId(flags.get("id"));
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.assetGet(id, accessToken));
+}
+function alarmStatus(value) {
+    if (value === undefined)
+        return "all";
+    if (typeof value !== "string" || !["all", "firing", "resolved"].includes(value)) {
+        invalid("--status must be all, firing, or resolved");
+    }
+    return value;
+}
+function alarmRequestId(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) {
+        invalid("--id must use letters, numbers, hyphens, or underscores");
+    }
+    if (/^\d+$/.test(value)) {
+        const normalized = value.replace(/^0+/, "") || "0";
+        let numeric;
+        try {
+            numeric = BigInt(normalized);
+        }
+        catch {
+            invalid("--id is out of range");
+        }
+        if (numeric < 1n || numeric > 9223372036854775807n) {
+            invalid("--id is out of range");
+        }
+        return numeric.toString();
+    }
+    return value;
+}
+async function alarmsListCommand(flags) {
+    for (const key of flags.keys()) {
+        if (!["profile", "status", "page", "page-size"].includes(key)) {
+            invalid(`Unknown alarms option: --${key}`);
+        }
+    }
+    const status = alarmStatus(flags.get("status"));
+    const page = assetPage(flags.get("page"), "page", 10000, 1);
+    const pageSize = assetPage(flags.get("page-size"), "page-size", 100, 20);
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.alarmsSearch({ status, page, page_size: pageSize }, accessToken));
+}
+async function alarmsGetCommand(flags) {
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "id")
+            invalid(`Unknown alarms get option: --${key}`);
+    }
+    const id = alarmRequestId(flags.get("id"));
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.alarmGet(id, accessToken));
+}
+async function alarmsCommand(action, flags) {
+    if (action === "list")
+        return alarmsListCommand(flags);
+    if (action === "get")
+        return alarmsGetCommand(flags);
+    invalid("Use alarms list or alarms get --id <id>");
+}
+function incidentAlarmId(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(value)) {
+        invalid("--alarm-id must use letters, numbers, hyphens, or underscores");
+    }
+    if (/^\d+$/.test(value)) {
+        const normalized = value.replace(/^0+/, "") || "0";
+        let numeric;
+        try {
+            numeric = BigInt(normalized);
+        }
+        catch {
+            invalid("--alarm-id is out of range");
+        }
+        if (numeric < 1n || numeric > 9223372036854775807n) {
+            invalid("--alarm-id is out of range");
+        }
+        return numeric.toString();
+    }
+    return value;
+}
+async function incidentsDiagnoseCommand(flags) {
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "alarm-id")
+            invalid(`Unknown incidents diagnose option: --${key}`);
+    }
+    const alarmId = incidentAlarmId(flags.get("alarm-id"));
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.incidentsDiagnose(alarmId, accessToken));
+}
+function incidentHumanSummary(data) {
+    const target = data.target.association === "unavailable"
+        ? "target unavailable"
+        : data.target.ip
+            ? `target ${data.target.ip}`
+            : "target identified";
+    return `Alarm ${data.alarm.id}: ${data.conclusion.replaceAll("_", " ")} (${data.confidence} confidence); category ${data.category}; ${target}.`;
+}
+function inspectionModel(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string" || value.length < 1 || value.length > 128 || value.trim() !== value || /[\u0000-\u001f]/.test(value)) {
+        invalid("--model must be an exact model name, code, or id");
+    }
+    return value;
+}
+function inspectionHumanSummary(data) {
+    const summary = data.summary;
+    const coverage = `${summary.monitoring_covered}/${summary.assets_examined}`;
+    const attention = data.items.length;
+    const truncated = data.truncated ? "; results truncated" : "";
+    return `Inspection ${data.grade}: checked ${summary.assets_examined}/${summary.assets_total} assets; coverage ${coverage}; active alarms ${summary.active_alarms}; needs attention ${attention}${truncated}.`;
+}
+async function inspectionsRunCommand(flags) {
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "model" && key !== "window") {
+            invalid(`Unknown inspections option: --${key}`);
+        }
+    }
+    const model = inspectionModel(flags.get("model"));
+    const window = metricWindow(flags.get("window") ?? "60m");
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.inspectionsRun({
+        ...(model !== undefined ? { model } : {}),
+        window_minutes: window,
+    }, accessToken));
+}
+function metricWindow(value) {
+    if (typeof value !== "string" || !/^[0-9]+[mh]$/.test(value)) {
+        invalid("--window must use a duration such as 15m or 2h");
+    }
+    const amount = Number(value.slice(0, -1));
+    const minutes = value.endsWith("h") ? amount * 60 : amount;
+    if (!Number.isSafeInteger(minutes) || minutes < 5 || minutes > 1440) {
+        invalid("--window must be between 5m and 24h");
+    }
+    return minutes;
+}
+function metricPoints(value) {
+    if (typeof value !== "string" || !/^\d+$/.test(value))
+        invalid("--max-points must be an integer");
+    const points = Number(value);
+    if (!Number.isSafeInteger(points) || points < 1 || points > 120)
+        invalid("--max-points must be between 1 and 120");
+    return points;
+}
+function metricAsset(value) {
+    if (typeof value !== "string" || value.length < 1 || value.length > 128 || /[\u0000-\u001f]/.test(value)) {
+        invalid("--asset is required and must be an IP address or asset id");
+    }
+    if (isIP(value) > 0)
+        return value;
+    if (!/^[A-Za-z0-9_-]{1,128}$/.test(value))
+        invalid("--asset must be an IP address or asset id");
+    if (/^\d+$/.test(value)) {
+        try {
+            const numeric = BigInt(value);
+            if (numeric < 1n || numeric > 9223372036854775807n)
+                invalid("--asset id is out of range");
+            return numeric.toString();
+        }
+        catch {
+            invalid("--asset id is out of range");
+        }
+    }
+    return value;
+}
+async function metricsCommand(action, flags) {
+    if (action !== "query")
+        invalid("Use metrics query --asset <id|ip> --metric <name>");
+    for (const key of flags.keys()) {
+        if (!["profile", "asset", "metric", "window", "max-points"].includes(key)) {
+            invalid(`Unknown metrics option: --${key}`);
+        }
+    }
+    const asset = metricAsset(flags.get("asset"));
+    const metric = flags.get("metric");
+    const allowed = new Set(["online", "cpu", "memory", "load", "disk", "io", "snmp"]);
+    if (typeof metric !== "string" || !allowed.has(metric))
+        invalid("--metric is invalid");
+    const window = metricWindow(flags.get("window") ?? "60m");
+    const maxPoints = metricPoints(flags.get("max-points") ?? "60");
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    return tokenManager.callReadOnly((accessToken) => client.metricsQuery({
+        asset,
+        metric: metric,
+        window_minutes: window,
+        max_points: maxPoints,
+    }, accessToken));
+}
+function validateChatEmployeeId(value) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(value))
+        invalid("employee-id must use letters, numbers, hyphens, or underscores");
+}
+function validateChatConversationId(value) {
+    if (!/^[A-Za-z0-9_-]{1,96}$/.test(value))
+        invalid("--conversation must use letters, numbers, hyphens, or underscores");
+}
+async function employeesChatCommand(employeeId, flags, json) {
+    if (!employeeId)
+        invalid("Use employees chat <employee-id> --message <text>");
+    validateChatEmployeeId(employeeId);
+    const message = flags.get("message");
+    if (typeof message !== "string" || message.trim().length === 0 || message.length > 10000 || message.includes("\u0000")) {
+        invalid("--message is required and must be between 1 and 10000 characters");
+    }
+    const conversation = flags.get("conversation");
+    if (conversation !== undefined) {
+        if (typeof conversation !== "string")
+            invalid("--conversation requires an id");
+        validateChatConversationId(conversation);
+    }
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "message" && key !== "conversation")
+            invalid(`Unknown employees chat option: --${key}`);
+    }
+    const selected = selectedProfile(flags);
+    let client;
+    try {
+        client = new IntegrationHttpClient(selected.profile);
+    }
+    catch (error) {
+        throw mapFailure(error);
+    }
+    const credentials = new SecureCredentialStore(selected.name);
+    const tokenManager = new TokenManager(client, credentials, selected.name);
+    const controller = new AbortController();
+    const onSigint = () => controller.abort();
+    let humanOutputStarted = false;
+    process.once("SIGINT", onSigint);
+    try {
+        const data = await tokenManager.callStreaming((accessToken, markEvent) => client.employeeChat(employeeId, message.trim(), conversation, accessToken, {
+            signal: controller.signal,
+            onEvent: (event) => {
+                markEvent();
+                if (!json && event.type === "delta") {
+                    humanOutputStarted = true;
+                    process.stdout.write(event.text);
+                }
+            },
+        }));
+        if (!json) {
+            if (humanOutputStarted)
+                process.stdout.write("\n");
+            process.stderr.write(`conversation_id: ${data.conversation_id}\n`);
+        }
+        return { data, streamed: !json };
+    }
+    catch (error) {
+        if (!json && humanOutputStarted)
+            process.stdout.write("\n");
+        throw error;
+    }
+    finally {
+        process.removeListener("SIGINT", onSigint);
+    }
+}
+function showConfig(flags) {
+    const requested = flags.get("profile");
+    if (requested !== undefined && typeof requested !== "string")
+        invalid("--profile requires a name");
+    const snapshot = readConfigSnapshot(process.env, requested);
+    return {
+        redacted: true,
+        selected_profile: snapshot.selected_profile,
+        config: redactValue(snapshot.root),
+        profile: redactValue(snapshot.profile),
+        paths: {
+            config: snapshot.root_path,
+            profile: snapshot.profile_path,
+        },
+    };
+}
+export async function configInit(flags, options = {}) {
+    const allowed = new Set([
+        "profile",
+        "base-url",
+        "timeout",
+        "language",
+        "ca-bundle",
+        "codex-skill-dir",
+        "force",
+    ]);
+    for (const key of flags.keys()) {
+        if (!allowed.has(key))
+            invalid(`Unknown config init option: --${key}`);
+    }
+    const forceValue = flags.get("force");
+    if (forceValue !== undefined && forceValue !== true)
+        invalid("--force does not accept a value");
+    const requested = flags.get("profile") ?? DEFAULT_PROFILE_NAME;
+    if (typeof requested !== "string")
+        invalid("--profile requires a name");
+    const force = flags.get("force") === true;
+    const environment = options.environment ?? process.env;
+    const credentialProbeFactory = options.credentialStoreFactory
+        ?? ((name) => new SecureCredentialStore(name));
+    let profile;
+    try {
+        // Keep lock ordering identical to install: global root first, then the
+        // target profile.  Existing configuration is strictly validated before a
+        // forced origin/CA change can write either file.
+        profile = await withProfileLock("install-root", async () => withProfileLock(requested, async () => {
+            const previousRaw = readProfileRaw(requested, environment);
+            const next = validateProfile({ ...DEFAULT_PROFILE, ...profilePartial(flags) });
+            if (previousRaw !== undefined && force) {
+                const previous = validateProfile(previousRaw);
+                await guardProfileConnectionChange(requested, previous, next, credentialProbeFactory);
+            }
+            return initializeProfile(requested, profilePartial(flags), environment, force);
+        }, { environment }), { environment });
+    }
+    catch (error) {
+        if (error instanceof ProfileConnectionGuardError) {
+            throw new CliFailure({
+                code: error.code,
+                message: error.message,
+                retryable: false,
+                exit_code: error.exitCode,
+            });
+        }
+        throw error;
+    }
+    return {
+        profile: requested,
+        config_root: configRoot(environment),
+        values: profile,
+        redacted: true,
+    };
+}
+function codexSkillCommand(action, flags) {
+    for (const key of flags.keys()) {
+        if (key !== "profile" && key !== "codex-skill-dir" && key !== "force") {
+            invalid(`Unknown ${action} option: --${key}`);
+        }
+    }
+    const profile = flags.get("profile");
+    if (profile !== undefined && typeof profile !== "string")
+        invalid("--profile requires a name");
+    const codexSkillDir = flags.get("codex-skill-dir");
+    if (codexSkillDir !== undefined && typeof codexSkillDir !== "string")
+        invalid("--codex-skill-dir requires a path");
+    const force = flags.get("force");
+    if (force !== undefined && force !== true)
+        invalid("--force does not accept a value");
+    const options = {
+        ...(profile === undefined ? {} : { profile }),
+        ...(codexSkillDir === undefined ? {} : { codexSkillDir }),
+        ...(force === undefined ? {} : { force: true }),
+        environment: process.env,
+    };
+    try {
+        const result = action === "install" ? installCodexSkill(options) : uninstallCodexSkill(options);
+        return { ...result };
+    }
+    catch (error) {
+        if (error instanceof CodexSkillError) {
+            throw new CliFailure({
+                code: error.code,
+                message: error.message,
+                retryable: false,
+                exit_code: error.exitCode,
+            });
+        }
+        throw error;
+    }
+}
+async function installCommand(flags, json) {
+    const allowed = new Set([
+        "profile", "base-url", "auth-mode", "timeout", "language", "ca-file", "codex-skill-dir",
+        "skip-login", "skip-codex", "force",
+    ]);
+    for (const key of flags.keys()) {
+        if (!allowed.has(key))
+            invalid(`Unknown install option: --${key}`);
+    }
+    for (const key of ["skip-login", "skip-codex", "force"]) {
+        const value = flags.get(key);
+        if (value !== undefined && value !== true)
+            invalid(`--${key} does not accept a value`);
+    }
+    const stringOption = (key) => {
+        const value = flags.get(key);
+        if (value === undefined)
+            return undefined;
+        if (typeof value !== "string")
+            invalid(`--${key} requires a value`);
+        return value;
+    };
+    try {
+        const result = await installWizard({
+            profile: stringOption("profile"),
+            baseUrl: stringOption("base-url"),
+            authMode: stringOption("auth-mode"),
+            timeout: stringOption("timeout"),
+            language: stringOption("language"),
+            caFile: stringOption("ca-file"),
+            codexSkillDir: stringOption("codex-skill-dir"),
+            skipLogin: flags.get("skip-login") === true,
+            skipCodex: flags.get("skip-codex") === true,
+            force: flags.get("force") === true,
+            json,
+            doctor: (environment, profileName, profile) => doctorData(environment, {
+                ...(profileName ? { profile: profileName } : {}),
+                ...(profile ? { profileConfig: profile } : {}),
+            }),
+        });
+        return { ...result };
+    }
+    catch (error) {
+        if (error instanceof InstallError) {
+            throw new CliFailure({
+                code: error.code,
+                message: error.message,
+                retryable: error.retryable,
+                exit_code: error.exitCode,
+            });
+        }
+        throw error;
+    }
+}
+function helpData() {
+    return {
+        commands: [
+            "version",
+            "doctor",
+            "config init",
+            "config show --redact",
+            "auth login",
+            "auth status",
+            "auth logout",
+            "capabilities list",
+            "employees list",
+            "employees chat <employee-id> --message <text>",
+            "assets list [--keyword <text>] [--model <name|code|id>] [--page N] [--page-size N]",
+            "assets get --id <id>",
+            "metrics query --asset <id|ip> --metric <online|cpu|memory|load|disk|io|snmp> [--window 5m..24h] [--max-points N]",
+            "alarms list [--status all|firing|resolved] [--page N] [--page-size N]",
+            "alarms get --id <id>",
+            "incidents diagnose --alarm-id <id>",
+            "inspections run [--model <name|code|id>] [--window 5m..24h]",
+            "install [--profile <name>] [--base-url <https-url>] [--auth-mode browser] [--timeout N] [--language zh-CN|en] [--ca-file <absolute-file>] [--codex-skill-dir <absolute-path>] [--skip-login] [--skip-codex] [--force]",
+            "install codex [--profile <name>] [--codex-skill-dir <absolute-path>] [--force]",
+            "uninstall codex [--profile <name>] [--codex-skill-dir <absolute-path>] [--force]",
+        ],
+        json: "Append --json for the stable success/error envelope",
+        note: "Authentication plus read-only employee, asset, metric, alarm, incident diagnosis, inspection queries, local installation, and the Codex Skill installer are available; install also accepts ZHIHU_PROFILE, ZHIHU_BASE_URL, ZHIHU_AUTH_MODE=browser, ZHIHU_CA_BUNDLE, and ZHIHU_TIMEOUT; write operations, MCP, customer URL delivery, and public npm publication remain unavailable",
+    };
+}
+async function run(parsed) {
+    if (parsed.duplicates.size > 0) {
+        invalid("Duplicate options are not allowed");
+    }
+    const [first, second] = parsed.command;
+    if (!first || first === "help" || first === "--help")
+        return { data: helpData(), exit_code: 0 };
+    if (first === "version" || (first === "--version" && !second))
+        return { data: versionData(), exit_code: 0 };
+    if (first === "doctor") {
+        for (const key of parsed.flags.keys()) {
+            if (key !== "profile")
+                invalid("doctor only accepts --profile");
+        }
+        const requested = parsed.flags.get("profile");
+        if (requested !== undefined && typeof requested !== "string")
+            invalid("--profile requires a name");
+        return { data: await doctorData(process.env, requested === undefined ? {} : { profile: requested }), exit_code: 0 };
+    }
+    if (first === "config" && second === "show")
+        return { data: showConfig(parsed.flags), exit_code: 0 };
+    if (first === "config" && second === "init")
+        return { data: await configInit(parsed.flags), exit_code: 0 };
+    if (first === "install") {
+        if (!second && parsed.command.length === 1) {
+            return { data: await installCommand(parsed.flags, parsed.json), exit_code: 0 };
+        }
+        if (second !== "codex" || parsed.command.length !== 2)
+            invalid("Use install or install codex");
+        return { data: codexSkillCommand("install", parsed.flags), exit_code: 0 };
+    }
+    if (first === "uninstall") {
+        if (second !== "codex" || parsed.command.length !== 2)
+            invalid("Use uninstall codex");
+        return { data: codexSkillCommand("uninstall", parsed.flags), exit_code: 0 };
+    }
+    if (first === "auth")
+        return { data: await authCommand(second, parsed.flags), exit_code: 0 };
+    if (first === "capabilities") {
+        if (parsed.command.length !== 2)
+            invalid("Use capabilities list");
+        for (const key of parsed.flags.keys()) {
+            if (key !== "profile")
+                invalid(`Unknown capabilities option: --${key}`);
+        }
+        return { data: await capabilitiesCommand(second, parsed.flags), exit_code: 0 };
+    }
+    if (first === "employees") {
+        if (second === "list") {
+            if (parsed.command.length !== 2)
+                invalid("Use employees list");
+            for (const key of parsed.flags.keys()) {
+                if (key !== "profile")
+                    invalid(`Unknown employees option: --${key}`);
+            }
+            return { data: await employeesCommand(second, parsed.flags), exit_code: 0 };
+        }
+        if (second === "chat") {
+            if (parsed.command.length !== 3)
+                invalid("Use employees chat <employee-id> --message <text>");
+            const result = await employeesChatCommand(parsed.command[2], parsed.flags, parsed.json);
+            return { data: result.data, exit_code: 0, streamed: result.streamed };
+        }
+        invalid("Use employees list or employees chat <employee-id> --message <text>");
+    }
+    if (first === "assets") {
+        if (second === "list") {
+            if (parsed.command.length !== 2)
+                invalid("Use assets list");
+            return { data: await assetsCommand(second, parsed.flags), exit_code: 0 };
+        }
+        if (second === "get") {
+            if (parsed.command.length !== 2)
+                invalid("Use assets get --id <id>");
+            return { data: await assetGetCommand(parsed.flags), exit_code: 0 };
+        }
+        invalid("Use assets list or assets get --id <id>");
+    }
+    if (first === "metrics") {
+        if (parsed.command.length !== 2)
+            invalid("Use metrics query --asset <id|ip> --metric <name>");
+        return { data: await metricsCommand(second, parsed.flags), exit_code: 0 };
+    }
+    if (first === "alarms") {
+        if (parsed.command.length !== 2)
+            invalid("Use alarms list or alarms get --id <id>");
+        return { data: await alarmsCommand(second, parsed.flags), exit_code: 0 };
+    }
+    if (first === "incidents") {
+        if (second !== "diagnose" || parsed.command.length !== 2) {
+            invalid("Use incidents diagnose --alarm-id <id>");
+        }
+        const data = await incidentsDiagnoseCommand(parsed.flags);
+        return { data, exit_code: 0, human: incidentHumanSummary(data) };
+    }
+    if (first === "inspections") {
+        if (second !== "run" || parsed.command.length !== 2) {
+            invalid("Use inspections run [--model <name|code|id>] [--window 5m..24h]");
+        }
+        const data = await inspectionsRunCommand(parsed.flags);
+        return { data, exit_code: 0, human: inspectionHumanSummary(data) };
+    }
+    invalid(`Unknown command: ${parsed.command.join(" ")}`);
+}
+export async function main(argv = process.argv.slice(2)) {
+    const parsed = parseArguments(argv);
+    const outputContext = context(parsed);
+    try {
+        const result = await run(parsed);
+        if (!result.streamed) {
+            if (!parsed.json && result.human)
+                process.stdout.write(`${result.human}\n`);
+            else
+                emitSuccess(outputContext, result.data);
+        }
+        return result.exit_code;
+    }
+    catch (error) {
+        if (error instanceof CliFailure)
+            return emitError(outputContext, error.shape);
+        if (error instanceof ConfigError) {
+            return emitError(outputContext, {
+                code: error.code,
+                message: error.message,
+                retryable: false,
+                exit_code: 2,
+            });
+        }
+        if (error instanceof CliAuthError) {
+            return emitError(outputContext, {
+                code: error.code,
+                message: error.message,
+                retryable: error.retryable,
+                exit_code: error.exitCode,
+            });
+        }
+        return emitError(outputContext, {
+            code: "PROTOCOL_ERROR",
+            message: "Unable to process the command",
+            retryable: false,
+            exit_code: 8,
+        });
+    }
+}
+const currentFile = fileURLToPath(import.meta.url);
+const invokedFile = process.argv[1] ? resolve(process.argv[1]) : "";
+if (currentFile === invokedFile) {
+    process.exitCode = await main();
+}