@luckypiggy/zhihu-ai-cli 0.1.0-test.1

package/dist/redaction.js

@@ -0,0 +1,42 @@
+const SENSITIVE_KEY_PATTERN = /(?:access|refresh|pilot)?[_-]?(?:token|secret|password|cookie)|authorization|api[_-]?key|private[_-]?key|credential|code[_-]?verifier|polling[_-]?secret|oauth[_-]?state|authorization[_-]?url/i;
+const JWT_PATTERN = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g;
+const BEARER_PATTERN = /\bBearer\s+[^\s,;]+/gi;
+const KEY_VALUE_PATTERN = /((?:access|refresh|pilot)?[_-]?(?:token|secret|password|cookie)|authorization|api[_-]?key|private[_-]?key|credential)(\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;}]+)/gi;
+const OAUTH_STATE_URL_PATTERN = /([?&](?:oauth_)?state=)[^&#\s]+/gi;
+export const REDACTED_VALUE = "[REDACTED]";
+/** Redact credentials from a string before it reaches a log or error. */
+export function redactString(value) {
+    return value
+        .replace(BEARER_PATTERN, "Bearer [REDACTED]")
+        .replace(KEY_VALUE_PATTERN, (_match, key, separator, rawValue) => {
+        const preserveBearer = key.toLowerCase() === "authorization" && rawValue.trim().toLowerCase() === "bearer";
+        return `${key}${separator}${preserveBearer ? "Bearer " : ""}${REDACTED_VALUE}`;
+    })
+        .replace(OAUTH_STATE_URL_PATTERN, "$1[REDACTED]")
+        .replace(/\bBearer\s+\[REDACTED\](?:\s+\[REDACTED\])+/gi, "Bearer [REDACTED]")
+        .replace(JWT_PATTERN, REDACTED_VALUE);
+}
+/** Recursively redact known secret fields without mutating the input value. */
+export function redactValue(value, key = "") {
+    if (SENSITIVE_KEY_PATTERN.test(key)) {
+        return REDACTED_VALUE;
+    }
+    if (typeof value === "string") {
+        return redactString(value);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item));
+    }
+    if (value && typeof value === "object") {
+        const output = {};
+        for (const [childKey, childValue] of Object.entries(value)) {
+            output[childKey] = redactValue(childValue, childKey);
+        }
+        return output;
+    }
+    return value;
+}
+export function redactErrorMessage(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return redactString(message);
+}

package/dist/token-manager.js

@@ -0,0 +1,320 @@
+import { CredentialStoreError } from "./credentials.js";
+import { HttpError } from "./http.js";
+import { withProfileLock, ProfileLockError } from "./profile-lock.js";
+const CLOCK_SKEW_SECONDS = 60;
+export class CliAuthError extends Error {
+    code;
+    retryable;
+    exitCode;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = "CliAuthError";
+        this.code = code;
+        this.retryable = options.retryable ?? false;
+        this.exitCode = options.exitCode ?? (code === "AUTH_RELOGIN_REQUIRED" ? 3 : 8);
+    }
+}
+function decodeClaims(token) {
+    try {
+        const pieces = token.split(".");
+        const payload = pieces.length === 3 ? pieces[1] : "";
+        if (!payload)
+            return {};
+        const normalized = payload.replace(/-/g, "+").replace(/_/g, "/").padEnd(Math.ceil(payload.length / 4) * 4, "=");
+        const parsed = JSON.parse(Buffer.from(normalized, "base64").toString("utf8"));
+        return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+function tokenExpiry(token, fallbackSeconds) {
+    const exp = decodeClaims(token).exp;
+    if (typeof exp === "number" && Number.isFinite(exp) && exp > 0)
+        return exp * 1000;
+    return Date.now() + fallbackSeconds * 1000;
+}
+function mapFailure(error) {
+    if (error instanceof CliAuthError)
+        return error;
+    if (error instanceof CredentialStoreError) {
+        return new CliAuthError(error.code, "Unable to access the system credential store", { exitCode: 3 });
+    }
+    if (error instanceof ProfileLockError) {
+        return new CliAuthError("AUTH_LOCK_TIMEOUT", "Another process is refreshing this profile; try again.", { retryable: true, exitCode: 4 });
+    }
+    if (error instanceof HttpError) {
+        const exitCode = error.code === "AUTH_RELOGIN_REQUIRED"
+            ? 3
+            : error.code === "CONFIG_INVALID"
+                ? 2
+                : error.code === "INVALID_ARGUMENT"
+                    ? 2
+                    : error.code === "MODEL_NOT_FOUND"
+                        ? 2
+                        : error.code === "ASSET_NOT_FOUND"
+                            ? 2
+                            : error.code === "ALARM_NOT_FOUND"
+                                ? 2
+                                : error.code === "INCIDENT_ASSET_IDENTITY_UNAVAILABLE"
+                                    ? 2
+                                    : error.code === "METRIC_DATA_NOT_FOUND"
+                                        || error.code === "ASSET_METRIC_IDENTITY_UNAVAILABLE"
+                                        ? 2
+                                        : error.code === "FORBIDDEN"
+                                            || error.code === "CAPABILITY_SCOPE_REQUIRED"
+                                            || error.code === "CAPABILITY_NOT_AVAILABLE"
+                                            || error.code === "EMPLOYEE_NOT_FOUND"
+                                            || error.code === "EMPLOYEE_NOT_CHATABLE"
+                                            || error.code === "CONVERSATION_NOT_FOUND"
+                                            ? 5
+                                            : error.code === "SERVER_ERROR"
+                                                ? 6
+                                                : error.code === "VERSION_INCOMPATIBLE"
+                                                    || error.code === "SERVICE_CONFIGURATION_REQUIRED"
+                                                    ? 7
+                                                    : error.code === "PROTOCOL_ERROR"
+                                                        || error.code === "RESPONSE_TOO_LARGE"
+                                                        || error.code === "UPSTREAM_PROTOCOL_ERROR"
+                                                        || error.code === "UPSTREAM_RESPONSE_TOO_LARGE"
+                                                        ? 8
+                                                        : 4;
+        return new CliAuthError(error.code, error.message, { retryable: error.retryable, exitCode });
+    }
+    return new CliAuthError("NETWORK_ERROR", "Unable to reach the Zhihu service", { retryable: true, exitCode: 4 });
+}
+export class TokenManager {
+    client;
+    credentials;
+    profile;
+    operationTail = Promise.resolve();
+    accessTokenValue;
+    accessInfoValue;
+    constructor(client, credentials, profile) {
+        this.client = client;
+        this.credentials = credentials;
+        this.profile = profile;
+    }
+    get accessInfo() {
+        return this.accessInfoValue;
+    }
+    async getAccessToken(forceRefresh = false) {
+        return this.exclusive(async () => {
+            if (!forceRefresh && this.hasFreshAccessToken())
+                return this.accessTokenValue;
+            return this.refreshWithProfileLock();
+        });
+    }
+    async refreshNow() {
+        return this.exclusive(() => this.refreshWithProfileLock());
+    }
+    async refreshWithProfileLock() {
+        try {
+            return await withProfileLock(this.profile, () => this.refreshWithinLock());
+        }
+        catch (error) {
+            throw mapFailure(error);
+        }
+    }
+    async refreshWithinLock() {
+        const oldCredential = await this.credentials.get();
+        if (!oldCredential) {
+            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "No active login; run zhihu auth login.", { exitCode: 3 });
+        }
+        let refreshed;
+        try {
+            refreshed = await this.client.refresh(oldCredential);
+        }
+        catch (error) {
+            const mapped = mapFailure(error);
+            if (mapped.code === "AUTH_RELOGIN_REQUIRED") {
+                try {
+                    await this.credentials.delete();
+                }
+                catch {
+                    // The stable re-login error is safer than retrying a dead secret.
+                }
+            }
+            throw mapped;
+        }
+        try {
+            // The new credential must be durable before its access token is used.
+            await this.credentials.set(refreshed.refresh_credential);
+        }
+        catch (error) {
+            // Rotation already invalidated oldCredential. Best effort compensation
+            // prevents an orphaned 30-day server session when the keychain fails.
+            try {
+                await this.client.logout(refreshed.refresh_credential);
+            }
+            catch {
+                // The user is still told to re-login; no secret or provider body is emitted.
+            }
+            try {
+                await this.credentials.delete();
+            }
+            catch {
+                // Keep the primary credential-store failure stable.
+            }
+            const mapped = mapFailure(error);
+            throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Credential storage failed; run zhihu auth login again.", { retryable: mapped.retryable, exitCode: 3 });
+        }
+        this.accessTokenValue = refreshed.access_token;
+        this.accessInfoValue = {
+            expiresAt: tokenExpiry(refreshed.access_token, refreshed.expires_in),
+            claims: decodeClaims(refreshed.access_token),
+        };
+        return refreshed.access_token;
+    }
+    hasFreshAccessToken() {
+        return Boolean(this.accessTokenValue
+            && this.accessInfoValue
+            && this.accessInfoValue.expiresAt > Date.now() + CLOCK_SKEW_SECONDS * 1000);
+    }
+    async exclusive(operation) {
+        let release;
+        const previous = this.operationTail;
+        this.operationTail = new Promise((resolve) => {
+            release = resolve;
+        });
+        await previous;
+        try {
+            return await operation();
+        }
+        finally {
+            release();
+        }
+    }
+    /**
+     * Execute one idempotent/read-only request with at most one forced refresh
+     * after an HTTP 401.  Write operations must not use this helper.
+     */
+    async callReadOnly(operation) {
+        try {
+            return await this.exclusive(async () => withProfileLock(this.profile, async () => {
+                let accessToken = this.hasFreshAccessToken()
+                    ? this.accessTokenValue
+                    : await this.refreshWithinLock();
+                try {
+                    return await operation(accessToken);
+                }
+                catch (error) {
+                    if (!isAuthenticationFailure(error))
+                        throw mapFailure(error);
+                }
+                accessToken = await this.refreshWithinLock();
+                try {
+                    return await operation(accessToken);
+                }
+                catch (error) {
+                    if (!isAuthenticationFailure(error))
+                        throw mapFailure(error);
+                    await this.clearDeadCredentialWithinLock();
+                    throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Your Zhihu session has expired. Run `zhihu auth login`.", { exitCode: 3 });
+                }
+            }));
+        }
+        catch (error) {
+            throw mapFailure(error);
+        }
+    }
+    /** Alias used by command adapters that prefer a higher-level name. */
+    async withReadOnly(operation) {
+        return this.callReadOnly(operation);
+    }
+    /**
+     * Execute a streaming read-only request.  A 401 can refresh once only when
+     * no response event has reached the caller; replaying after a delta would
+     * duplicate a conversation and is therefore forbidden.
+     */
+    async callStreaming(operation) {
+        try {
+            let observedEvent = false;
+            const markEvent = () => {
+                observedEvent = true;
+            };
+            // Profile locking is intentionally limited to token acquisition.  The
+            // long-lived SSE operation must not hold another CLI command hostage.
+            let accessToken = await this.getAccessToken();
+            try {
+                return await operation(accessToken, markEvent);
+            }
+            catch (error) {
+                if (!isAuthenticationFailure(error) || observedEvent)
+                    throw mapFailure(error);
+            }
+            accessToken = await this.refreshNow();
+            try {
+                return await operation(accessToken, markEvent);
+            }
+            catch (error) {
+                if (!isAuthenticationFailure(error) || observedEvent)
+                    throw mapFailure(error);
+                await this.clearDeadCredential();
+                throw new CliAuthError("AUTH_RELOGIN_REQUIRED", "Your Zhihu session has expired. Run `zhihu auth login`.", { exitCode: 3 });
+            }
+        }
+        catch (error) {
+            throw mapFailure(error);
+        }
+    }
+    async clearDeadCredential() {
+        await this.exclusive(() => withProfileLock(this.profile, () => this.clearDeadCredentialWithinLock()));
+    }
+    async clearDeadCredentialWithinLock() {
+        let currentCredential = null;
+        try {
+            currentCredential = await this.credentials.get();
+        }
+        catch {
+            // Continue to local cleanup even when the credential store is unreadable.
+        }
+        if (currentCredential) {
+            try {
+                await this.client.logout(currentCredential);
+            }
+            catch {
+                // The local credential is still removed below; no secret/provider body
+                // is allowed to replace the stable re-login result.
+            }
+        }
+        try {
+            await this.credentials.delete();
+        }
+        catch {
+            // The stable re-login error is safer than surfacing a keychain body.
+        }
+        finally {
+            this.accessTokenValue = undefined;
+            this.accessInfoValue = undefined;
+        }
+    }
+    async logout() {
+        try {
+            return await this.exclusive(() => withProfileLock(this.profile, async () => {
+                const credential = await this.credentials.get();
+                if (!credential)
+                    return "already_logged_out";
+                try {
+                    await this.client.logout(credential);
+                }
+                catch (error) {
+                    if (!(error instanceof HttpError) || error.code !== "AUTH_RELOGIN_REQUIRED")
+                        throw mapFailure(error);
+                    // A server-side invalid/revoked session is already logged out.
+                }
+                await this.credentials.delete();
+                this.accessTokenValue = undefined;
+                this.accessInfoValue = undefined;
+                return "revoked";
+            }));
+        }
+        catch (error) {
+            throw mapFailure(error);
+        }
+    }
+}
+function isAuthenticationFailure(error) {
+    return error instanceof HttpError && (error.status === 401 || (error.status === undefined && error.code === "AUTH_RELOGIN_REQUIRED"));
+}
+export { decodeClaims, mapFailure };

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@luckypiggy/zhihu-ai-cli",
+  "version": "0.1.0-test.1",
+  "description": "智护 Pilot CLI：认证、数字员工、资产、指标、告警、指定告警诊断和巡检只读能力（P1 Read-only）",
+  "keywords": [
+    "zhihu-pilot",
+    "aiops",
+    "codex",
+    "cli",
+    "digital-employee"
+  ],
+  "author": {
+    "name": "Zhihu Pilot"
+  },
+  "product": "zhihu-pilot",
+  "productName": "智护 Pilot",
+  "type": "module",
+  "bin": {
+    "zhihu": "bin/zhihu.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "assets/codex-skills",
+    "README.md",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm test",
+    "test": "npm run build && node --test tests/*.mjs",
+    "pack:dry-run": "npm_config_cache=\"${TMPDIR:-/tmp}/zhihu-ai-cli-npm-cache\" npm pack --dry-run --json --loglevel=error",
+    "build:offline": "node scripts/build-offline-release.mjs",
+    "verify:offline": "node scripts/verify-offline-release.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "22.15.0",
+    "typescript": "5.8.3"
+  },
+  "license": "UNLICENSED",
+  "packageManager": "npm@11.4.2",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}