@m2canvas/connect 0.5.0 → 0.7.0

package/dist/bridge/authorize.js

@@ -0,0 +1,341 @@
+/**
+ * bridge 代跑授权命令（change acp-terminal-free-auth）：账号登录与 m2 MCP 授权不再要求用户打开终端。
+ *
+ * 安全边界（`connect/local-bridge` 契约 3 / 8，design D2 / 安全分析）：
+ * - 页面只能选「哪个 agent × 哪个动作」。可执行文件、参数、环境、cwd 全部来自下面写死的 AUTH_COMMANDS 与 bridge 自己的检测；
+ *   m2 授权用的配置项名只取 bridge 自己的 m2 预检（调用方 service.ts 负责：优先用最近一次预检的结果，没有记录时拉起前重跑，D19），不接受页面传入。
+ * - 授权必须由用户在浏览器里亲自完成：bridge 只截下 CLI 要打开的授权页链接交给页面，从不替用户点任何东西。
+ *
+ * 链接怎么截（D4，各家行为实测见 evidence/auth-commands-macos.md）：
+ * - 每次授权新建 0700 的临时目录，放 `open` / `xdg-open` 替身并排在 PATH 最前；替身只把参数逐行追加到 `M2_AUTH_LINK_FILE`，
+ *   **从不执行参数、从不打开浏览器**。Claude / Cursor / OpenCode / Qoder 都经 PATH 上的 `open` 打开授权页。
+ * - Codex 的原生程序经 NSWorkspace 直接打开默认浏览器，截不到，但会把链接打印出来：从输出里取（`opens: 'agent'`，页面只作备用）。
+ * - 按每条命令的链接来源只取一种：Claude 打印在输出里的是「粘码」备用链接，回调不在本机，不能转交。
+ * - 只转交 https、≤ 8KB 的链接，同一条只转交一次；事件只发给发起授权的连接（server.ts）。
+ *
+ * 生命周期（D7）：同一个 agent 同一时间一次（跨连接）；拥有者是发起的连接，连接关闭即取消；10 分钟超时；
+ * 取消 / 超时 = 对进程组 SIGTERM，2 秒后仍在则 SIGKILL（OpenCode 收到 SIGTERM 约 20 秒不退出）。
+ * 命令经 exec.ts 的 startCommand 拉起，与一次性命令共用 active 集合，bridge 退出时一起清理；临时目录由 killAllNow 同步删除。
+ *
+ * Claude 的 m2 授权（D6）：`claude mcp login` 遇到非终端直接拒绝，用 macOS 自带的 /usr/bin/expect 提供伪终端。
+ * 脚本文本固定，参数经 Tcl 的 $argv 列表传给 `spawn {*}$argv`，不拼进脚本。expect 退出后伪终端关闭，claude 随之收到 SIGHUP 退出，
+ * 所以对 expect 的进程组发信号足以清理（evidence/pty-cleanup.md）。
+ *
+ * 结果以预检为准（D8）：命令结束后重跑预检随结果返回，outcome 只反映命令本身（退出码不可靠）。
+ */
+import { chmodSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { CODEX_SCRIPT } from './adapters.js';
+import { prependPath } from './env.js';
+import { BridgeFailure } from './errors.js';
+import { combinedOutput, startCommand } from './exec.js';
+import { stripAnsi } from './precheck-parse.js';
+import { BRIDGE_MAX_AUTH_LINK_CHARS } from './protocol.js';
+export const AUTH_TIMEOUT_MS = 10 * 60 * 1000;
+export const AUTH_KILL_GRACE_MS = 2_000;
+export const AUTH_LINK_POLL_MS = 250;
+export const MAX_AUTH_LINK_CHARS = BRIDGE_MAX_AUTH_LINK_CHARS;
+export const AUTH_OUTPUT_LIMIT = 4096;
+/** 每条输出流保留的尾部（只为截链接与最终的 4KB 摘要，不需要更多） */
+const AUTH_STREAM_KEEP = 64 * 1024;
+export const EXPECT_PATH = '/usr/bin/expect';
+/**
+ * 写死的命令清单（design「命令清单」表）。不在这里的组合一律 auth_unavailable：
+ * OpenCode 的登录是交互菜单、预检也不要求登录；Qoder 的 m2 授权没有命令行与 ACP 入口。
+ */
+export const AUTH_COMMANDS = {
+    claude: { login: { opens: 'page', linkSource: 'open', pty: false }, m2: { opens: 'page', linkSource: 'open', pty: true } },
+    codex: { login: { opens: 'agent', linkSource: 'output', pty: false }, m2: { opens: 'agent', linkSource: 'output', pty: false } },
+    cursor: { login: { opens: 'page', linkSource: 'open', pty: false }, m2: { opens: 'page', linkSource: 'open', pty: false } },
+    opencode: { m2: { opens: 'page', linkSource: 'open', pty: false } },
+    qoder: { login: { opens: 'page', linkSource: 'open', pty: false } },
+};
+/**
+ * 预检结果里的 `authorize` 字段（D1、D5）：只在 macOS（实测平台）出现；Claude 要找得到自带的 claude，Claude 的 m2 还要有 expect。
+ * 页面只在这个字段存在时调用 agent/authorize，所以旧 bridge 与其他平台自动退回命令引导。
+ */
+export function authCapability(agent, action, env) {
+    const spec = AUTH_COMMANDS[agent]?.[action];
+    if (env.platform !== 'darwin' || !spec)
+        return null;
+    if (agent === 'claude' && !env.claudeBinary)
+        return null;
+    if (spec.pty && !env.expectAvailable)
+        return null;
+    return { opens: spec.opens };
+}
+const unavailable = (message) => new BridgeFailure('auth_unavailable', message);
+/**
+ * m2 配置项名会作为参数传给 CLI。它来自 bridge 自己的预检，但预检读的配置包括会话目录里的项目文件（Cursor 的
+ * `<cwd>/.cursor/mcp.json`、Claude 的 `.mcp.json`）—— 仓库可以把它命名成 `--xxx`，让页面一键触发时注入 CLI 选项（review r1 S-3）。
+ * 参数走 argv、不经过 shell，所以只挡选项与控制字符：不以 `-` 开头、不含控制字符、1–128 字符；空格、中文、引号照常传
+ * （误拒会让按钮无端消失，review r2 R2-S1）。预检的 `authorize` 能力用同一个函数判断，按钮出现就一定能执行。
+ */
+// eslint-disable-next-line no-control-regex
+const SAFE_ENTRY = /^(?!-)[^\u0000-\u001f\u007f]{1,128}$/u;
+export function isSafeAuthEntry(entry) {
+    return SAFE_ENTRY.test(entry);
+}
+/** 把 agent × 动作翻译成具体命令。调用方已确认平台、安装、适配器就绪与 expect；这里只按清单组装。 */
+export function buildAuthPlan(input) {
+    const { agent, action, entry } = input;
+    const spec = AUTH_COMMANDS[agent]?.[action];
+    if (!spec)
+        throw unavailable(`the bridge cannot run ${action === 'login' ? 'sign-in' : 'M2 authorization'} for ${agent}`);
+    if (action === 'm2' && !entry)
+        throw unavailable(`add M2 to ${agent}'s MCP config first (m2/configure)`);
+    if (action === 'm2' && entry && !isSafeAuthEntry(entry))
+        throw unavailable(`the M2 entry name ${JSON.stringify(entry)} can't be passed to ${agent} safely; use the terminal command instead`);
+    const m2Entry = entry ?? '';
+    const base = { agent, action, cwd: input.cwd, env: input.env, pty: spec.pty, linkSource: spec.linkSource, opens: spec.opens };
+    switch (agent) {
+        case 'claude': {
+            const claude = input.claudeBinary;
+            if (!claude)
+                throw unavailable('the Claude Code program bundled with the adapter was not found');
+            return { ...base, steps: [{ command: claude, args: action === 'login' ? ['auth', 'login'] : ['mcp', 'login', m2Entry] }], pathPrefix: [dirname(claude)] };
+        }
+        case 'codex': {
+            const script = join(input.codexDir, CODEX_SCRIPT);
+            const args = action === 'login' ? [script, 'login'] : [script, 'mcp', 'login', m2Entry];
+            return { ...base, steps: [{ command: input.nodePath, args }], pathPrefix: [join(input.codexDir, 'node_modules', '.bin'), dirname(input.nodePath)] };
+        }
+        default: {
+            const path = input.detected.path;
+            if (!path)
+                throw unavailable(`${agent} is not installed on this machine`);
+            // OpenCode 已授权时重跑 `mcp auth` 会停在交互确认（Re-authenticate?），无终端会卡住；先 logout（无交互）再 auth（D15）
+            const steps = agent === 'opencode'
+                ? [
+                    { command: path, args: ['mcp', 'logout', m2Entry], ignoreFailure: true },
+                    { command: path, args: ['mcp', 'auth', m2Entry] },
+                ]
+                : [{ command: path, args: action === 'login' ? ['login'] : ['mcp', 'login', m2Entry] }];
+            return { ...base, steps, pathPrefix: [] };
+        }
+    }
+}
+// ───────────────────────────── 链接 ─────────────────────────────
+/** 只收能解析的 https 链接、≤ 8KB；其余（http 本机回调、file:、命令行选项）返回 null */
+export function acceptAuthLink(candidate) {
+    const text = candidate.trim();
+    if (text.length === 0 || text.length > MAX_AUTH_LINK_CHARS)
+        return null;
+    try {
+        return new URL(text).protocol === 'https:' ? text : null;
+    }
+    catch {
+        return null;
+    }
+}
+// eslint-disable-next-line no-control-regex
+const OUTPUT_LINK_RE = /https:\/\/[^\s"'<>\u001b]+(?=[\s"'<>])/g;
+/**
+ * 从命令输出里取完整的 https 链接：必须后面跟着空白或引号，避免把还没输出完的半截链接转交出去。
+ * 调用方传入累计输出（去 ANSI 在这里做，转义序列可能跨两段输出）。
+ */
+export function linksInOutput(text) {
+    const found = [];
+    for (const match of stripAnsi(text).matchAll(OUTPUT_LINK_RE)) {
+        const link = acceptAuthLink(match[0]);
+        if (link && !found.includes(link))
+            found.push(link);
+    }
+    return found;
+}
+// ───────────────────────────── 运行 ─────────────────────────────
+/** 替身：只把参数逐行追加到 bridge 指定的文件。不执行参数、不打开浏览器（D4） */
+const OPEN_SHIM = `#!/bin/sh
+# M2 local agent bridge: records the sign-in link for the M2 page to open in your current browser. It never runs its arguments.
+for arg in "$@"; do
+  printf '%s\\n' "$arg" >> "$M2_AUTH_LINK_FILE"
+done
+exit 0
+`;
+/** 伪终端包装（D6）：文本固定，被包命令只经 $argv 传入 */
+const PTY_SCRIPT = `set timeout -1
+log_user 1
+spawn -noecho {*}$argv
+expect eof
+catch wait result
+exit [lindex $result 3]
+`;
+function outputTail(text) {
+    const clean = stripAnsi(text).replace(/\r/g, '');
+    return clean.length > AUTH_OUTPUT_LIMIT ? clean.slice(-AUTH_OUTPUT_LIMIT) : clean;
+}
+export function startAuthRun(plan, options) {
+    const dir = mkdtempSync(join(tmpdir(), 'm2-auth-'));
+    chmodSync(dir, 0o700);
+    let removed = false;
+    const removeDir = () => {
+        if (removed)
+            return;
+        removed = true;
+        rmSync(dir, { recursive: true, force: true });
+    };
+    let current = null;
+    let canceled = false;
+    let timedOut = false;
+    const seen = new Set();
+    const offer = (candidate) => {
+        const link = acceptAuthLink(candidate);
+        if (!link || seen.has(link))
+            return;
+        seen.add(link);
+        options.onLink(link);
+    };
+    let linkFile = '';
+    let script = '';
+    let env = plan.env;
+    try {
+        const bin = join(dir, 'bin');
+        mkdirSync(bin, { mode: 0o700 });
+        for (const name of ['open', 'xdg-open'])
+            writeFileSync(join(bin, name), OPEN_SHIM, { mode: 0o700 });
+        linkFile = join(dir, 'links');
+        writeFileSync(linkFile, '', { mode: 0o600 });
+        script = join(dir, 'pty.exp');
+        if (plan.pty)
+            writeFileSync(script, PTY_SCRIPT, { mode: 0o600 });
+        env = { ...prependPath(plan.env, [bin, ...plan.pathPrefix]), M2_AUTH_LINK_FILE: linkFile };
+    }
+    catch (error) {
+        removeDir();
+        throw error;
+    }
+    let linkLines = 0;
+    const readLinkFile = () => {
+        let text;
+        try {
+            text = readFileSync(linkFile, 'utf8');
+        }
+        catch {
+            return; // 临时目录已删（结束或 killNow）
+        }
+        // 最后一段可能是替身还没写完的半行
+        const lines = text.split('\n').slice(0, -1);
+        for (const line of lines.slice(linkLines))
+            offer(line);
+        linkLines = lines.length;
+    };
+    const poll = plan.linkSource === 'open' ? setInterval(readLinkFile, options.pollMs) : null;
+    poll?.unref();
+    let scanned = '';
+    const onOutput = plan.linkSource === 'output'
+        ? (chunk) => {
+            scanned = (scanned + chunk).slice(-2 * MAX_AUTH_LINK_CHARS);
+            for (const link of linksInOutput(scanned))
+                offer(link);
+        }
+        : undefined;
+    const timer = setTimeout(() => {
+        timedOut = true;
+        current?.terminate(options.graceMs, 'timed out', true);
+    }, options.timeoutMs);
+    timer.unref();
+    const execute = async () => {
+        const outputs = [];
+        let last = null;
+        try {
+            for (const step of plan.steps) {
+                if (canceled || timedOut)
+                    break;
+                const command = plan.pty ? EXPECT_PATH : step.command;
+                const args = plan.pty ? ['-f', script, '--', step.command, ...step.args] : step.args;
+                current = startCommand(command, args, { env, cwd: plan.cwd, maxOutput: AUTH_STREAM_KEEP, onOutput });
+                last = await current.result;
+                current = null;
+                outputs.push(combinedOutput(last));
+                if (last.code !== 0 && !step.ignoreFailure)
+                    break;
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            if (poll)
+                clearInterval(poll);
+            removeDir();
+        }
+        const outcome = canceled ? 'canceled' : timedOut ? 'timed_out' : last?.code === 0 ? 'succeeded' : 'failed';
+        return { outcome, exitCode: last?.code ?? null, output: outputTail(outputs.filter((part) => part.length > 0).join('\n')) };
+    };
+    return {
+        result: execute(),
+        cancel() {
+            if (canceled)
+                return;
+            canceled = true;
+            current?.terminate(options.graceMs, 'canceled');
+        },
+        killNow() {
+            canceled = true;
+            current?.kill('bridge is shutting down');
+            clearTimeout(timer);
+            if (poll)
+                clearInterval(poll);
+            removeDir();
+        },
+    };
+}
+export class AuthorizationManager {
+    options;
+    /** 按 agent 记：同一 agent 的两次授权会争同一个本机回调端口（Cursor 固定 8787）、写同一份凭证 */
+    entries = new Map();
+    constructor(options = {}) {
+        this.options = options;
+    }
+    async run(request) {
+        const { agent, action } = request;
+        if (this.entries.has(agent))
+            throw new BridgeFailure('auth_busy', `another sign-in for ${agent} is in progress`, { agent });
+        const entry = { ownerId: request.ownerId, canceled: false, run: null };
+        this.entries.set(agent, entry);
+        const canceledResult = { agent, action, outcome: 'canceled', exitCode: null, output: '', precheck: null };
+        let ran;
+        try {
+            const plan = await request.plan();
+            if (entry.canceled)
+                return canceledResult;
+            const start = this.options.start ?? startAuthRun;
+            entry.run = start(plan, {
+                timeoutMs: this.options.timeoutMs ?? AUTH_TIMEOUT_MS,
+                graceMs: this.options.graceMs ?? AUTH_KILL_GRACE_MS,
+                pollMs: this.options.pollMs ?? AUTH_LINK_POLL_MS,
+                onLink: (url) => request.onLink({ url, open: plan.opens }),
+            });
+            ran = await entry.run.result;
+        }
+        finally {
+            // 命令结束即释放：端口与凭证的争用已经结束，之后的预检不需要占着
+            if (this.entries.get(agent) === entry)
+                this.entries.delete(agent);
+        }
+        if (ran.outcome === 'canceled' || entry.canceled)
+            return { ...canceledResult, exitCode: ran.exitCode, output: ran.output };
+        return { agent, action, ...ran, precheck: await request.precheck() };
+    }
+    /** 页面取消：只有发起的连接能取消 */
+    cancel(ownerId, agent) {
+        const entry = this.entries.get(agent);
+        if (!entry || entry.ownerId !== ownerId)
+            return false;
+        entry.canceled = true;
+        entry.run?.cancel();
+        return true;
+    }
+    /** 连接关闭 */
+    cancelOwner(ownerId) {
+        for (const [agent, entry] of this.entries)
+            if (entry.ownerId === ownerId)
+                this.cancel(ownerId, agent);
+    }
+    /** bridge 退出：同步杀掉全部并删除临时目录 */
+    killAllNow() {
+        for (const entry of this.entries.values()) {
+            entry.canceled = true;
+            entry.run?.killNow();
+        }
+    }
+}

package/dist/bridge/env.js

@@ -105,3 +105,15 @@ export function buildProbeEnv(source = process.env, platform = process.platform)
 export function buildNpmEnv(source = process.env, platform = process.platform) {
     return { ...buildAgentEnv(source, platform), ...pick(source, (name) => NPM_CONFIG_NAMES.includes(name)) };
 }
+/**
+ * 把目录排到 PATH 最前（D10：让 connect 的 cli.js 与授权命令找得到适配器自带的 claude / codex 和 bridge 自己的 node）。
+ * Windows 的环境变量名不区分大小写，白名单保留的可能是 `Path`：改写原来那个键，不另加一个 `PATH`。
+ */
+export function prependPath(env, dirs, platform = process.platform) {
+    if (dirs.length === 0)
+        return env;
+    const key = platform === 'win32' ? (Object.keys(env).find((name) => name.toUpperCase() === 'PATH') ?? 'PATH') : 'PATH';
+    const separator = platform === 'win32' ? ';' : ':';
+    const current = env[key];
+    return { ...env, [key]: [...dirs, ...(current ? [current] : [])].join(separator) };
+}

package/dist/bridge/errors.js

@@ -0,0 +1,9 @@
+export class BridgeFailure extends Error {
+    code;
+    data;
+    constructor(code, message, data) {
+        super(message);
+        this.code = code;
+        this.data = data;
+    }
+}

package/dist/bridge/exec.js

@@ -9,6 +9,9 @@
  * 超时必须真的封顶：命令可能再拉起子进程（`claude mcp list` 会启动用户配置的 stdio MCP 做健康检查，npm ci 有自己的子进程），
  * 孙进程继承了输出管道时，'close' 要等它们全部退出才触发。所以 POSIX 下每条命令是独立进程组，超时对整组 SIGKILL 并**立即**返回，
  * 不再等 'close'。bridge 退出时 killActiveExecs 清掉仍在运行的命令（main.ts 的退出路径调用）。
+ *
+ * startCommand 是可从外部结束的版本（授权命令：页面取消、连接关闭、10 分钟超时，见 authorize.ts）；execCommand 建在它上面，
+ * 两者共用同一个 active 集合，所以 bridge 退出时授权命令也一起被清理（design D7）。
  */
 import { spawn } from 'node:child_process';
 const DEFAULT_MAX_OUTPUT = 1024 * 1024;
@@ -34,22 +37,56 @@ export function killActiveExecs() {
         killTree(child);
     active.clear();
 }
-export const execCommand = (command, args, options) => new Promise((resolve) => {
+function signalTree(child, signal) {
+    if (child.pid === undefined)
+        return;
+    try {
+        if (GROUPS)
+            process.kill(-child.pid, signal);
+        else
+            child.kill(signal);
+    }
+    catch {
+        // ESRCH：已经退出，'close' 会照常结束这条命令
+    }
+}
+export function startCommand(command, args, options) {
     const max = options.maxOutput ?? DEFAULT_MAX_OUTPUT;
     let stdout = '';
     let stderr = '';
     let settled = false;
-    let timer;
+    let graceTimer;
     let child;
-    const finish = (result, timedOut = false) => {
+    let resolve = () => undefined;
+    const result = new Promise((done) => {
+        resolve = done;
+    });
+    const finish = (outcome, timedOut = false) => {
         if (settled)
             return;
         settled = true;
-        if (timer)
-            clearTimeout(timer);
+        if (graceTimer)
+            clearTimeout(graceTimer);
         if (child)
             active.delete(child);
-        resolve({ ...result, stdout, stderr, timedOut });
+        resolve({ ...outcome, stdout, stderr, timedOut });
+    };
+    const kill = (error, timedOut = false) => {
+        if (settled)
+            return;
+        if (child)
+            killTree(child);
+        finish({ code: null, signal: null, error }, timedOut);
+    };
+    const handle = {
+        result,
+        kill,
+        terminate(graceMs, error, timedOut = false) {
+            if (settled || !child || graceTimer)
+                return;
+            signalTree(child, 'SIGTERM');
+            graceTimer = setTimeout(() => kill(error, timedOut), graceMs);
+        },
     };
     try {
         child = spawn(command, args, {
@@ -64,25 +101,29 @@ export const execCommand = (command, args, options) => new Promise((resolve) =>
     catch (error) {
         // 同步抛出只发生在参数非法时；按启动失败处理
         finish({ code: null, signal: null, error: error instanceof Error ? error.message : String(error) });
-        return;
+        return handle;
     }
     const running = child;
     active.add(running);
-    timer = setTimeout(() => {
-        killTree(running);
-        finish({ code: null, signal: null, error: `timed out after ${options.timeoutMs}ms` }, true);
-    }, options.timeoutMs);
     running.stdout?.setEncoding('utf8');
     running.stderr?.setEncoding('utf8');
     running.stdout?.on('data', (chunk) => {
         stdout = (stdout + chunk).slice(-max);
+        options.onOutput?.(chunk);
     });
     running.stderr?.on('data', (chunk) => {
         stderr = (stderr + chunk).slice(-max);
+        options.onOutput?.(chunk);
     });
     running.on('error', (error) => finish({ code: null, signal: null, error: error.message }));
     running.on('close', (code, signal) => finish({ code, signal, error: null }));
-});
+    return handle;
+}
+export const execCommand = (command, args, options) => {
+    const running = startCommand(command, args, options);
+    const timer = setTimeout(() => running.kill(`timed out after ${options.timeoutMs}ms`, true), options.timeoutMs);
+    return running.result.finally(() => clearTimeout(timer));
+};
 /** stdout 与 stderr 合并（有些 CLI 把状态写在 stderr，例如 `codex login status`） */
 export function combinedOutput(result) {
     const parts = [result.stdout, result.stderr, result.error ?? ''].filter((part) => part.length > 0);

package/dist/bridge/install-layout.js

@@ -0,0 +1,37 @@
+/**
+ * 一次性安装在 `~/.m2canvas` 下的目录布局（change acp-bridge-one-time-install D15）。
+ *
+ * 同一份布局还写死在两个 sh 脚本里：安装脚本 `public/connect/install.sh` 与启动器源 `packages/connect/install/m2-bridge.sh`
+ * （脚本不能 import 这里）。改这里要同批改那两处；脚本测试会按这里的路径核对它们的产物。
+ *
+ * 全部在用户主目录下，不写任何系统目录、不注册任何启动项、不改 PATH（`connect/local-bridge` 契约 14 delta）。
+ * 其余已有文件（配对记录 `bridge-pairings.json`、状态文件 `bridge-<port>.json`、适配器 `acp-adapters/`）位置不变。
+ */
+import { join } from 'node:path';
+export function installLayout(home) {
+    const root = join(home, '.m2canvas');
+    const bridge = join(root, 'bridge');
+    const logs = join(root, 'logs');
+    return {
+        root,
+        runtime: join(root, 'runtime'),
+        bridge,
+        current: join(bridge, 'current'),
+        previous: join(bridge, 'previous'),
+        rejected: join(bridge, 'rejected'),
+        launcher: join(root, 'bin', 'm2-bridge'),
+        logs,
+        updateLog: join(logs, 'update.log'),
+        workspace: join(root, 'workspace'),
+        adapters: join(root, 'acp-adapters'),
+    };
+}
+/** 版本目录里的文件：这个版本用哪份 Node（绝对路径一行）。回退版本时 Node 跟着一起回退 */
+export const NODE_PATH_FILE = 'node-path';
+/** 版本目录内 connect 包的位置（npm tarball 解开后的 `package/` 改名而来） */
+export function connectPackageDir(versionDir) {
+    return join(versionDir, 'node_modules', '@m2canvas', 'connect');
+}
+export function connectCliPath(versionDir) {
+    return join(connectPackageDir(versionDir), 'dist', 'cli.js');
+}