@lumoai/cli 1.5.0 → 1.6.0

package/dist/cli/src/commands/task-pr-show.js

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskPrShow = taskPrShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo task pr show <LUM-N> <number>`
+ *
+ * Tier-2 retrieval for the cheap inline PR card. Reads the synced PR record
+ * (title, state, ciStatus, branches, author, url) from
+ * `/api/tasks/:id/pull-requests/:number`. Live diff + review comments need a
+ * GitHub token, so the route degrades to the stored record + a `note`; we print
+ * the note when present.
+ */
+async function taskPrShow(identifier, prNumber) {
+    if (!identifier || !prNumber) {
+        console.error('Error: usage: lumo task pr show <LUM-42> <number>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/pull-requests/${encodeURIComponent(prNumber)}`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 400) {
+        console.error(`Error: invalid PR number "${prNumber}"`);
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} or PR #${prNumber} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: pr show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { pullRequest: pr, note } = (await res.json());
+    console.log(`#${pr.number}${pr.repo ? ` (${(0, sanitize_1.sanitizeField)(pr.repo)})` : ''}  ${(0, sanitize_1.sanitizeField)(pr.title ?? '')}`);
+    console.log(`state:    ${pr.state ?? 'unknown'}${pr.isDraft ? ' · draft' : ''}`);
+    if (pr.ciStatus)
+        console.log(`ci:       ${pr.ciStatus}`);
+    if (pr.authorLogin)
+        console.log(`author:   ${(0, sanitize_1.sanitizeField)(pr.authorLogin)}`);
+    if (pr.headBranch || pr.baseBranch)
+        console.log(`branch:   ${pr.headBranch ?? '?'} → ${pr.baseBranch ?? '?'}`);
+    if (pr.url)
+        console.log(`url:      ${pr.url}`);
+    if (note)
+        console.log(`\nnote: ${(0, sanitize_1.sanitizeField)(note)}`);
+}

package/dist/cli/src/commands/task-show.js

@@ -4,20 +4,22 @@ exports.formatTaskShow = formatTaskShow;
 exports.taskShow = taskShow;
 const config_1 = require("../lib/config");
 const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
 /**
  * Render task detail as a key:value block. Multi-line description is
  * indented under a `Description:` label so the structure stays scannable.
  */
 function formatTaskShow(task) {
     const lines = [];
-    lines.push(`${task.identifier}  ${task.title}`);
+    lines.push(`${task.identifier}  ${(0, sanitize_1.sanitizeField)(task.title)}`);
     lines.push(`Status:    ${task.status}`);
     lines.push(`Priority:  ${task.priority}`);
-    lines.push(`Project:   ${task.project.name}`);
+    lines.push(`Project:   ${(0, sanitize_1.sanitizeField)(task.project.name)}`);
     if (task.assignee) {
+        const label = (0, sanitize_1.sanitizeField)(task.assignee.label);
         const detail = task.assignee.email && task.assignee.type === 'member'
-            ? `${task.assignee.label} <${task.assignee.email}>`
-            : task.assignee.label;
+            ? `${label} <${(0, sanitize_1.sanitizeField)(task.assignee.email)}>`
+            : label;
         lines.push(`Assignee:  ${detail}`);
     }
     else {
@@ -28,7 +30,7 @@ function formatTaskShow(task) {
     if (body && body.trim().length > 0) {
         lines.push('');
         lines.push('Description:');
-        for (const line of body.split('\n')) {
+        for (const line of (0, sanitize_1.sanitizeField)(body).split('\n')) {
             lines.push(`  ${line}`);
         }
     }
@@ -44,8 +46,7 @@ async function taskShow(identifier) {
         console.error('Error: not logged in. Run `lumo auth login` first.');
         return 1;
     }
-    const envUrl = process.env.LUMO_API_URL?.trim();
-    const apiUrl = envUrl && envUrl.length > 0 ? envUrl : creds.apiUrl;
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
     const url = `${(0, api_1.trimTrailingSlash)(apiUrl)}/api/tasks/by-identifier/${encodeURIComponent(identifier)}`;
     let res;
     try {

package/dist/cli/src/commands/task-slack-show.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskSlackShow = taskSlackShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo task slack show <LUM-N> <context-id>`
+ *
+ * Tier-2 retrieval for the cheap inline Slack card. Fetches the stored thread
+ * snapshot (no live Slack call) from
+ * `/api/tasks/:id/slack-contexts/:contextId/snapshot` and prints one line per
+ * message as `author: text`, falling back to `@<userId>` when the display name
+ * is missing.
+ */
+async function taskSlackShow(identifier, contextId) {
+    if (!identifier || !contextId) {
+        console.error('Error: usage: lumo task slack show <LUM-42> <context-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/slack-contexts/${encodeURIComponent(contextId)}/snapshot`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} or slack context ${contextId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        console.error(`Error: slack show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { snapshot } = (await res.json());
+    const messages = snapshot?.messages ?? [];
+    if (messages.length === 0) {
+        console.log('(no messages in stored snapshot)');
+        return;
+    }
+    for (const m of messages) {
+        const author = (0, sanitize_1.sanitizeField)(m.userName ?? '@' + m.userId);
+        console.log(`${author}: ${(0, sanitize_1.sanitizeField)(m.text)}`);
+    }
+}

package/dist/cli/src/commands/task-update.js

@@ -10,6 +10,7 @@ const api_1 = require("../lib/api");
 const task_create_1 = require("./task-create");
 const tag_resolver_1 = require("../lib/tag-resolver");
 const resolve_1 = require("../lib/resolve");
+const sanitize_1 = require("../lib/sanitize");
 const ALLOWED_STATUSES = ['TODO', 'IN_PROGRESS', 'IN_REVIEW', 'DONE'];
 /**
  * Pure function: given the task's current sprint binding and the resolved
@@ -87,10 +88,10 @@ function buildUpdatePayload(opts) {
  * Appends a Tags line when tags are present.
  */
 function formatUpdatedTaskLine(task) {
-    const escapedTitle = task.title.replace(/"/g, '\\"');
+    const escapedTitle = (0, sanitize_1.sanitizeField)(task.title).replace(/"/g, '\\"');
     const head = `Updated ${task.identifier} "${escapedTitle}"  ${task.url}`;
     if (task.tags && task.tags.length > 0) {
-        return `${head}\nTags: ${task.tags.join(', ')}`;
+        return `${head}\nTags: ${task.tags.map(sanitize_1.sanitizeField).join(', ')}`;
     }
     return head;
 }
@@ -146,8 +147,7 @@ async function taskUpdate(identifier, opts) {
         console.error('Error: not logged in. Run `lumo auth login` first.');
         return 1;
     }
-    const envUrl = process.env.LUMO_API_URL?.trim();
-    const apiUrl = envUrl && envUrl.length > 0 ? envUrl : creds.apiUrl;
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
     // Resolve tag refs into ids
     let tagIds;
     let addTagIds;
@@ -235,7 +235,7 @@ async function taskUpdate(identifier, opts) {
                 // Body wasn't JSON; fall through to status-only message
             }
             if (serverMsg) {
-                console.error(`Error: ${serverMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`);
             }
             else {
                 console.error(`Error: task update failed (HTTP ${res.status})`);
@@ -365,7 +365,7 @@ async function taskUpdate(identifier, opts) {
                         errMsg = b.error;
                 }
                 catch { /* ignore */ }
-                console.error(`Error: ${errMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(errMsg)}`);
                 return 1;
             }
             const oldLabel = oldNumber !== null ? `#${oldNumber}` : action.oldSprintId;
@@ -397,7 +397,7 @@ async function taskUpdate(identifier, opts) {
                         errMsg = b.error;
                 }
                 catch { /* ignore */ }
-                console.error(`Error: ${errMsg}`);
+                console.error(`Error: ${(0, sanitize_1.sanitizeField)(errMsg)}`);
                 return 1;
             }
             // resolvedSprintNumber is set from the resolveSprintId call above

package/dist/cli/src/commands/task-web-show.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.taskWebShow = taskWebShow;
+const config_1 = require("../lib/config");
+const api_1 = require("../lib/api");
+const sanitize_1 = require("../lib/sanitize");
+/**
+ * `lumo task web show <LUM-N> <link-id>`
+ *
+ * Tier-2 retrieval for the cheap inline WebLink card. Fetches the page body
+ * (cached, or fetched behind the SSRF guard on first read) from
+ * `/api/tasks/:id/web-links/:linkId/body` and prints it as plain text.
+ */
+async function taskWebShow(identifier, linkId) {
+    if (!identifier || !linkId) {
+        console.error('Error: usage: lumo task web show <LUM-42> <link-id>');
+        return 1;
+    }
+    const creds = (0, config_1.readCredentials)();
+    if (!creds) {
+        console.error('Error: not logged in. Run `lumo auth login` first.');
+        return 1;
+    }
+    const apiUrl = (0, api_1.resolveAuthedApiUrl)(creds.apiUrl);
+    const base = (0, api_1.trimTrailingSlash)(apiUrl);
+    let res;
+    try {
+        res = await fetch(`${base}/api/tasks/${encodeURIComponent(identifier)}/web-links/${encodeURIComponent(linkId)}/body`, { headers: { Authorization: `Bearer ${creds.token}` } });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`Error: could not reach Lumo API at ${apiUrl} (${msg})`);
+        return 1;
+    }
+    if (res.status === 401) {
+        console.error('Error: API key invalid or revoked. Run `lumo auth login`.');
+        return 1;
+    }
+    if (res.status === 404) {
+        console.error(`Error: task ${identifier} or web link ${linkId} not found in workspace ${creds.workspaceSlug}`);
+        return 1;
+    }
+    if (!res.ok) {
+        let serverMsg = null;
+        try {
+            const errBody = (await res.json());
+            if (typeof errBody.error === 'string')
+                serverMsg = errBody.error;
+        }
+        catch {
+            /* not JSON */
+        }
+        console.error(serverMsg
+            ? `Error: ${(0, sanitize_1.sanitizeField)(serverMsg)}`
+            : `Error: web show failed (HTTP ${res.status})`);
+        return 1;
+    }
+    const { body } = (await res.json());
+    if (!body || body.trim().length === 0) {
+        console.log('(empty body)');
+        return;
+    }
+    console.log((0, sanitize_1.sanitizeField)(body));
+}

package/dist/cli/src/commands/whoami.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.whoami = whoami;
 const config_1 = require("../lib/config");
+const sanitize_1 = require("../lib/sanitize");
 async function whoami() {
     const creds = (0, config_1.readCredentials)();
     if (!creds) {
@@ -9,8 +10,8 @@ async function whoami() {
         console.log('Run `lumo auth login` to log in');
         return 1;
     }
-    console.log(`Logged in as ${creds.email}`);
-    console.log(`  Workspace: ${creds.workspaceName} (${creds.workspaceSlug})`);
-    console.log(`  Key: ${creds.apiKeyName} (${creds.apiKeyPrefix})`);
+    console.log(`Logged in as ${(0, sanitize_1.sanitizeField)(creds.email)}`);
+    console.log(`  Workspace: ${(0, sanitize_1.sanitizeField)(creds.workspaceName)} (${creds.workspaceSlug})`);
+    console.log(`  Key: ${(0, sanitize_1.sanitizeField)(creds.apiKeyName)} (${creds.apiKeyPrefix})`);
     console.log(`  API: ${creds.apiUrl}`);
 }

package/dist/cli/src/commands/wrap/progress-comment-section.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProgressCommentSection = void 0;
+exports.formatProgressBody = formatProgressBody;
+const sanitize_1 = require("../../lib/sanitize");
+const line_prompt_1 = require("../../lib/line-prompt");
+const editor_1 = require("../../lib/editor");
+const progress_comment_api_1 = require("../../lib/progress-comment-api");
+const HEADER = '本次会话进度';
+/** Join turn summaries into a bulleted progress comment body under a header. */
+function formatProgressBody(summaries) {
+    return [HEADER, ...summaries.map(s => `- ${s}`)].join('\n');
+}
+/**
+ * Wrap-panel section that drafts a progress comment from the session's
+ * unposted turnSummaries and posts it after y/e/s confirmation. Holds its own
+ * draft + body state between prepare() and run().
+ */
+class ProgressCommentSection {
+    deps;
+    title = '进度评论';
+    draft = null;
+    body = '';
+    constructor(deps) {
+        this.deps = deps;
+    }
+    async prepare() {
+        this.draft = await (0, progress_comment_api_1.fetchProgressDraft)(this.deps.creds, this.deps.sessionId);
+        if (!this.draft.taskIdentifier || this.draft.summaries.length === 0) {
+            return false;
+        }
+        this.body = formatProgressBody(this.draft.summaries.map(s => s.turnSummary));
+        return true;
+    }
+    async run(opts) {
+        const draft = this.draft;
+        if (!draft || !draft.watermark)
+            return;
+        // Preview: sanitize the server free-text before it hits the terminal.
+        process.stdout.write(`将发到 ${draft.taskIdentifier} "${(0, sanitize_1.sanitizeField)(draft.taskTitle ?? '')}":\n`);
+        process.stdout.write(`${(0, sanitize_1.sanitizeField)(this.body)}\n`);
+        if (opts.dryRun) {
+            process.stdout.write('(dry-run，未发送)\n');
+            return;
+        }
+        if (opts.yes) {
+            await this.post(draft.watermark, this.body);
+            return;
+        }
+        const choice = (await (0, line_prompt_1.promptLine)('[y] 发送  [e] 编辑  [s] 跳过 > ')).toLowerCase();
+        if (choice === 's' || choice === '') {
+            process.stdout.write('已跳过。\n');
+            return;
+        }
+        if (choice === 'e') {
+            const edited = (await (0, editor_1.editInEditor)(this.body)).trim();
+            if (edited.length === 0) {
+                process.stdout.write('正文为空，已跳过。\n');
+                return;
+            }
+            process.stdout.write(`${(0, sanitize_1.sanitizeField)(edited)}\n`);
+            const confirm = (await (0, line_prompt_1.promptLine)('[y] 发送  [s] 跳过 > ')).toLowerCase();
+            if (confirm !== 'y') {
+                process.stdout.write('已跳过。\n');
+                return;
+            }
+            await this.post(draft.watermark, edited);
+            return;
+        }
+        if (choice === 'y') {
+            await this.post(draft.watermark, this.body);
+            return;
+        }
+        process.stdout.write('无法识别的选择，已跳过。\n');
+    }
+    async post(watermark, body) {
+        const { commentId } = await (0, progress_comment_api_1.postProgressComment)(this.deps.creds, this.deps.sessionId, { body, watermark });
+        process.stdout.write(`已发送进度评论 (comment ${commentId})\n`);
+    }
+}
+exports.ProgressCommentSection = ProgressCommentSection;