@my-life-buddies/cli 0.13.0 → 0.13.3

package/dist/bin/core.js

@@ -2465,10 +2465,14 @@ var MlbDevRegistrationClient = class {
   #baseUrl;
   #developerToken;
   #fetch;
+  #tokenStoreFor;
+  #refreshToken;
   constructor(options) {
     this.#baseUrl = normalizePlatformUrl(options.baseUrl);
     this.#developerToken = safeCredential(options.developerToken, "developerToken");
     this.#fetch = options.fetch ?? globalThis.fetch;
+    this.#tokenStoreFor = options.tokenStoreFor;
+    this.#refreshToken = options.refreshToken ?? false;
     if (typeof this.#fetch !== "function") {
       throw new TypeError("A Fetch API implementation is required");
     }
@@ -2538,6 +2542,13 @@ var MlbDevRegistrationClient = class {
         message: "buddy.agent.json \u4E2D\u7684 buddyId \u65E0\u6548\u3002"
       });
     }
+    options.signal.throwIfAborted();
+    const store = this.#tokenStoreFor?.(request.devAgentId);
+    const cached = this.#refreshToken ? void 0 : await store?.load();
+    if (cached !== void 0) {
+      options.signal.throwIfAborted();
+      return Object.freeze({ devAgentId: request.devAgentId, appServerUrl: new URL(this.#baseUrl), agentToken: safeCredential(cached, "agentToken") });
+    }
     const body = object2(await this.#request(
       `/cli/buddies/${encodeURIComponent(request.devAgentId)}`,
       {
@@ -2552,10 +2563,13 @@ var MlbDevRegistrationClient = class {
         message: "\u642D\u5B50\u8BE6\u60C5\u54CD\u5E94\u7F3A\u5C11\u5339\u914D\u7684 id \u6216 Buddy token\u3002"
       });
     }
+    const token = safeCredential(body.token, "agentToken");
+    options.signal.throwIfAborted();
+    await store?.save(token);
     return Object.freeze({
       devAgentId: request.devAgentId,
       appServerUrl: new URL(this.#baseUrl),
-      agentToken: safeCredential(body.token, "agentToken")
+      agentToken: token
     });
   }
   async listOnline(options) {
@@ -2942,7 +2956,7 @@ function validateRegistration(value, expectedAgentId) {
     throw new BuddyDevError({
       code: "DEV_APP_SERVER_RESPONSE_INVALID",
       phase: "registration",
-      message: "DEV \u6302\u53F7\u6CA1\u6709\u8FD4\u56DE\u5339\u914D\u7684 Buddy \u8EAB\u4EFD\u4E0E\u77ED\u671F Buddy token\u3002"
+      message: "DEV \u6302\u53F7\u6CA1\u6709\u8FD4\u56DE\u5339\u914D\u7684 Buddy \u8EAB\u4EFD\u4E0E\u5F00\u53D1 Token\u3002"
     });
   }
   return value;
@@ -3291,6 +3305,183 @@ function createBuddyDevStarter(options = {}) {
   });
 }
 
+// packages/cli-core/src/dev/token-store.ts
+import { createHash as createHash5 } from "node:crypto";
+
+// packages/cli-core/src/cloud/credential-store.ts
+import { spawn } from "node:child_process";
+var DEFAULT_SERVICE = "com.xiaohongshu.buddy.developer-cli";
+var DEFAULT_ACCOUNT = "developer-session";
+var MAX_CREDENTIAL_BYTES = 32 * 1024;
+function safeLabel(value, fallback, name) {
+  const result = value ?? fallback;
+  if (!result || result !== result.trim() || /[\u0000-\u001f\u007f]/u.test(result) || result.length > 256) {
+    throw new TypeError(`${name} is invalid`);
+  }
+  return result;
+}
+function serialize(token) {
+  const value = JSON.stringify(token);
+  if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES) {
+    throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u4E91\u7AEF\u4F1A\u8BDD\u51ED\u636E\u8FC7\u5927\uFF0C\u672A\u4FDD\u5B58");
+  }
+  return value;
+}
+function parse(source) {
+  if (Buffer.byteLength(source, "utf8") > MAX_CREDENTIAL_BYTES) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  let value;
+  try {
+    value = JSON.parse(source);
+  } catch {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  const record2 = value;
+  if (Object.keys(record2).length !== 3 || typeof record2.accessToken !== "string" || typeof record2.subject !== "string" || !Number.isSafeInteger(record2.expiresAt)) {
+    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+  }
+  return Object.freeze({
+    accessToken: record2.accessToken,
+    subject: record2.subject,
+    expiresAt: record2.expiresAt
+  });
+}
+async function runCredentialCommand(input) {
+  return await new Promise((resolve17, reject) => {
+    const child = spawn(input.command, [...input.args], {
+      shell: false,
+      windowsHide: true,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    const stdout = [];
+    const stderr = [];
+    let outputBytes = 0;
+    const collect = (target, chunk) => {
+      outputBytes += chunk.byteLength;
+      if (outputBytes <= MAX_CREDENTIAL_BYTES) target.push(chunk);
+    };
+    child.stdout.on("data", (chunk) => collect(stdout, chunk));
+    child.stderr.on("data", (chunk) => collect(stderr, chunk));
+    child.once("error", reject);
+    child.once("close", (code2) => resolve17({
+      code: code2 ?? 1,
+      stdout: Buffer.concat(stdout).toString("utf8"),
+      stderr: Buffer.concat(stderr).toString("utf8")
+    }));
+    child.stdin.on("error", () => void 0);
+    child.stdin.end(input.input ?? "");
+  });
+}
+var SystemCredentialStore = class {
+  #platform;
+  #service;
+  #account;
+  #run;
+  constructor(options = {}) {
+    this.#platform = options.platform ?? process.platform;
+    this.#service = safeLabel(options.service, DEFAULT_SERVICE, "service");
+    this.#account = safeLabel(options.account, DEFAULT_ACCOUNT, "account");
+    this.#run = options.commandRunner ?? runCredentialCommand;
+    if (this.#platform !== "darwin") {
+      throw new CloudLifecycleError("INVALID_REQUEST", "\u642D\u642D CLI V1 \u7684\u5B89\u5168\u51ED\u636E\u5B58\u50A8\u76EE\u524D\u53EA\u652F\u6301 macOS Keychain");
+    }
+  }
+  async load() {
+    const result = await this.#run({
+      command: "security",
+      args: ["find-generic-password", "-s", this.#service, "-a", this.#account, "-w"]
+    });
+    if (result.code === 44) return void 0;
+    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u8BFB\u53D6 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u51ED\u636E");
+    const raw = result.stdout.trimEnd();
+    return /^(?:[a-fA-F0-9]{2})+$/u.test(raw) ? Buffer.from(raw, "hex").toString("utf8") : raw;
+  }
+  async save(source) {
+    if (!source || /[\u0000-\u001f\u007f]/u.test(source)) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
+    const line = ["add-generic-password", "-U", "-s", this.#service, "-a", this.#account, "-w", source].map((part) => `"${part.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`).join(" ") + "\n";
+    if (Buffer.byteLength(line, "utf8") >= 4096) {
+      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u51ED\u636E\u8D85\u8FC7 macOS \u5199\u5165\u957F\u5EA6\u9650\u5236\uFF0C\u672A\u4FDD\u5B58\uFF1B\u8BF7\u8054\u7CFB\u5E73\u53F0\u5904\u7406");
+    }
+    const result = await this.#run({
+      command: "security",
+      args: ["-i", "-q"],
+      input: line
+    });
+    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u628A\u642D\u642D\u51ED\u636E\u5199\u5165 macOS \u94A5\u5319\u4E32");
+    const saved = await this.load();
+    if (!saved || saved !== source) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u51ED\u636E\u5199\u5165\u540E\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u8BD5");
+  }
+  async clear() {
+    const result = await this.#run({
+      command: "security",
+      args: ["delete-generic-password", "-s", this.#service, "-a", this.#account]
+    });
+    if (result.code !== 0 && result.code !== 44) {
+      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u6E05\u9664 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u51ED\u636E");
+    }
+  }
+};
+var SystemCloudTokenStore = class {
+  #store;
+  constructor(options = {}) {
+    this.#store = new SystemCredentialStore(options);
+  }
+  async load() {
+    const raw = await this.#store.load();
+    return raw === void 0 ? void 0 : parse(raw);
+  }
+  async save(token) {
+    await this.#store.save(serialize(token));
+  }
+  async clear() {
+    await this.#store.clear();
+  }
+};
+
+// packages/cli-core/src/dev/token-store.ts
+var SystemBuddyTokenStore = class {
+  #store;
+  constructor(options) {
+    if (![options.subject, options.buddyId].every((value) => value.trim() && !/[\u0000-\u001f\u007f]/u.test(value))) throw new TypeError("\u5F00\u53D1 Token \u7684\u8D26\u53F7\u548C\u642D\u5B50 ID \u65E0\u6548");
+    const scope = JSON.stringify([normalizePlatformUrl(options.platformUrl).origin, options.subject, options.buddyId]);
+    this.#store = new SystemCredentialStore({
+      service: "com.xiaohongshu.buddy.developer-cli.dev-token",
+      account: createHash5("sha256").update(scope).digest("hex"),
+      platform: options.platform,
+      commandRunner: options.commandRunner
+    });
+  }
+  async load() {
+    const raw = await this.#store.load();
+    if (raw === void 0) return void 0;
+    let value;
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      throw corrupt();
+    }
+    if (typeof value !== "object" || value === null || Array.isArray(value) || Object.keys(value).length !== 1 || !("token" in value)) throw corrupt();
+    return validateToken(value.token);
+  }
+  async save(token) {
+    await this.#store.save(JSON.stringify({ token: validateToken(token) }));
+  }
+  async clear() {
+    await this.#store.clear();
+  }
+};
+function corrupt() {
+  return new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u672C\u673A\u5F00\u53D1\u51ED\u636E\u683C\u5F0F\u65E0\u6548\uFF0C\u8BF7\u4F7F\u7528 --refresh-token \u91CD\u65B0\u9886\u53D6");
+}
+function validateToken(value) {
+  if (typeof value !== "string" || !value.trim() || /[\u0000-\u001f\u007f]/u.test(value) || value.length > 1024) throw corrupt();
+  return value;
+}
+
 // packages/cli-core/src/commands/dev.ts
 var DevCommandUsageError = class extends Error {
   constructor(message) {
@@ -3299,12 +3490,13 @@ var DevCommandUsageError = class extends Error {
   }
 };
 var DEV_COMMAND_HELP = `\u7528\u6CD5:
-  buddy-cli dev [--app-server <App Server URL>] [--directory <\u9879\u76EE\u76EE\u5F55>]
+  buddy-cli dev [--app-server <App Server URL>] [--directory <\u9879\u76EE\u76EE\u5F55>] [--refresh-token]
 
 \u8BF4\u660E:
   \u672A\u914D\u7F6E\u5730\u5740\u65F6\u8FDE\u63A5 MLB \u6D4B\u8BD5\u73AF\u5883 ${DEFAULT_MLB_TEST_URL}\uFF08HTTP \u4EC5\u9650\u6D4B\u8BD5\uFF09\u3002
   CLI \u7EDF\u4E00\u542F\u52A8\u5E76\u7BA1\u7406\u5DE5\u7A0B\u4E2D\u7684\u5B98\u65B9 Runtime\u3002
-  DEV \u4F1A\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55\u83B7\u53D6\u5F00\u53D1\u8005\u4F1A\u8BDD\uFF0C\u518D\u8BFB\u53D6\u5F53\u524D buddy.agent.json \u4E2D\u7684 buddyId \u5BF9\u5E94\u7684 Buddy token\u3002`;
+  DEV \u4F1A\u901A\u8FC7\u6D4F\u89C8\u5668\u767B\u5F55\u83B7\u53D6\u5F00\u53D1\u8005\u4F1A\u8BDD\uFF0C\u518D\u8BFB\u53D6\u5F53\u524D buddy.agent.json \u4E2D\u7684 buddyId \u5BF9\u5E94\u7684\u5F00\u53D1 Token\uFF0C\u4FDD\u5B58\u5230\u7CFB\u7EDF\u94A5\u5319\u4E32\u4F9B\u540E\u7EED\u590D\u7528\u3002
+  --refresh-token \u91CD\u65B0\u9886\u53D6\u5DF2\u6709\u5F00\u53D1 Token\uFF0C\u7528\u4E8E\u670D\u52A1\u7AEF\u91CD\u7F6E\u540E\u7684\u672C\u673A\u66F4\u65B0\uFF1B\u4E0D\u4F1A\u751F\u6210\u65B0\u5BC6\u94A5\u3002`;
 function valueAfter(args, index, flag2) {
   const value = args[index + 1];
   if (value === void 0 || !value.trim()) throw new DevCommandUsageError(`${flag2} \u7F3A\u5C11\u503C`);
@@ -3319,6 +3511,7 @@ function parseDevArguments(args) {
   let directorySet = false;
   let appServer;
   let help = false;
+  let refreshToken = false;
   for (let index = 0; index < args.length; index += 1) {
     const flag2 = args[index];
     if (flag2 === "--help" || flag2 === "-h") {
@@ -3326,6 +3519,11 @@ function parseDevArguments(args) {
       help = true;
       continue;
     }
+    if (flag2 === "--refresh-token") {
+      if (refreshToken) throw new DevCommandUsageError("--refresh-token \u4E0D\u80FD\u91CD\u590D");
+      refreshToken = true;
+      continue;
+    }
     const value = valueAfter(args, index, flag2 ?? "\u53C2\u6570");
     index += 1;
     switch (flag2) {
@@ -3341,7 +3539,7 @@ function parseDevArguments(args) {
         throw new DevCommandUsageError(`\u672A\u77E5 dev \u53C2\u6570 ${flag2}`);
     }
   }
-  return { directory, appServer, help };
+  return { directory, appServer, help, refreshToken };
 }
 function appServerUrl(override, env) {
   try {
@@ -3375,7 +3573,7 @@ async function runDevCommand(args, io, options = {}) {
     const root = await (options.resolveProjectRoot ?? requireBuddyAgentProjectRoot)(requestedRoot);
     const environment = options.env ?? process.env;
     const url = appServerUrl(parsed.appServer, environment);
-    const authorizationInput = { appServerUrl: url };
+    const authorizationInput = { appServerUrl: url, ...parsed.refreshToken ? { refreshToken: true } : {} };
     if (!options.authorize) {
       throw new DevCommandUsageError("\u5F53\u524D CLI Host \u5C1A\u672A\u914D\u7F6E\u642D\u642D\u8D26\u53F7\u767B\u5F55 Adapter");
     }
@@ -3478,7 +3676,7 @@ var MemoryCloudTokenStore = class {
     return this.#token === void 0 ? void 0 : frozenClone(this.#token);
   }
   async save(token) {
-    this.#token = validateToken(token);
+    this.#token = validateToken2(token);
   }
   async clear() {
     this.#token = void 0;
@@ -3534,7 +3732,7 @@ var CloudAuthenticator = class {
     }
     if (stored === void 0) return void 0;
     try {
-      const token = validateToken(stored);
+      const token = validateToken2(stored);
       if (token.expiresAt > this.#now() + this.#minimumValidityMs) return token;
     } catch {
     }
@@ -3555,7 +3753,7 @@ var CloudAuthenticator = class {
         "\u6D4F\u89C8\u5668\u767B\u5F55\u8FD4\u56DE\u7684 state \u4E0D\u5339\u914D\uFF1B\u51ED\u636E\u672A\u4FDD\u5B58"
       );
     }
-    const token = validateToken(resultRecord.token);
+    const token = validateToken2(resultRecord.token);
     if (token.expiresAt <= this.#now() + this.#minimumValidityMs) {
       throw new CloudLifecycleError("AUTH_TOKEN_EXPIRED", "\u6D4F\u89C8\u5668\u767B\u5F55\u8FD4\u56DE\u4E86\u5DF2\u8FC7\u671F\u6216\u5373\u5C06\u8FC7\u671F\u7684\u4F1A\u8BDD");
     }
@@ -3563,7 +3761,7 @@ var CloudAuthenticator = class {
     return token;
   }
 };
-function validateToken(value) {
+function validateToken2(value) {
   try {
     const input = record(value, "cloud token");
     exactKeys(input, ["accessToken", "subject", "expiresAt"], [], "cloud token");
@@ -3866,8 +4064,8 @@ var HttpDeveloperPlatformClient = class {
 };
 
 // packages/cli-core/src/cloud/browser-login.ts
-import { createHash as createHash5, randomBytes } from "node:crypto";
-import { spawn } from "node:child_process";
+import { createHash as createHash6, randomBytes } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
 import { createServer } from "node:http";
 
 // packages/cli-core/src/cloud/login-result.ts
@@ -3927,7 +4125,7 @@ function browserCommand(url) {
 async function openExternalUrl(url) {
   const launch = browserCommand(url);
   await new Promise((resolve17, reject) => {
-    const child = spawn(launch.command, launch.args, { shell: false, stdio: "ignore", windowsHide: true });
+    const child = spawn2(launch.command, launch.args, { shell: false, stdio: "ignore", windowsHide: true });
     child.once("error", reject);
     child.once("exit", (code2) => code2 === 0 ? resolve17() : reject(new Error(`browser launcher exited with ${code2 ?? "unknown"}`)));
   });
@@ -3974,7 +4172,7 @@ var LoopbackBrowserLoginAdapter = class {
     if (request.signal?.aborted) throw request.signal.reason;
     const callbackSecret = randomBytes(24).toString("hex");
     const codeVerifier = randomBytes(32).toString("base64url");
-    const codeChallenge = createHash5("sha256").update(codeVerifier).digest("base64url");
+    const codeChallenge = createHash6("sha256").update(codeVerifier).digest("base64url");
     let requestId = "";
     let settle;
     let reject;
@@ -4110,126 +4308,8 @@ var LoopbackBrowserLoginAdapter = class {
   }
 };
 
-// packages/cli-core/src/cloud/credential-store.ts
-import { spawn as spawn2 } from "node:child_process";
-var DEFAULT_SERVICE = "com.xiaohongshu.buddy.developer-cli";
-var DEFAULT_ACCOUNT = "developer-session";
-var MAX_CREDENTIAL_BYTES = 32 * 1024;
-function safeLabel(value, fallback, name) {
-  const result = value ?? fallback;
-  if (!result || result !== result.trim() || /[\u0000-\u001f\u007f]/u.test(result) || result.length > 256) {
-    throw new TypeError(`${name} is invalid`);
-  }
-  return result;
-}
-function serialize(token) {
-  const value = JSON.stringify(token);
-  if (Buffer.byteLength(value, "utf8") > MAX_CREDENTIAL_BYTES) {
-    throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u4E91\u7AEF\u4F1A\u8BDD\u51ED\u636E\u8FC7\u5927\uFF0C\u672A\u4FDD\u5B58");
-  }
-  return value;
-}
-function parse(source) {
-  if (Buffer.byteLength(source, "utf8") > MAX_CREDENTIAL_BYTES) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  let value;
-  try {
-    value = JSON.parse(source);
-  } catch {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  const record2 = value;
-  if (Object.keys(record2).length !== 3 || typeof record2.accessToken !== "string" || typeof record2.subject !== "string" || !Number.isSafeInteger(record2.expiresAt)) {
-    throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u7CFB\u7EDF\u51ED\u636E\u683C\u5F0F\u65E0\u6548");
-  }
-  return Object.freeze({
-    accessToken: record2.accessToken,
-    subject: record2.subject,
-    expiresAt: record2.expiresAt
-  });
-}
-async function runCredentialCommand(input) {
-  return await new Promise((resolve17, reject) => {
-    const child = spawn2(input.command, [...input.args], {
-      shell: false,
-      windowsHide: true,
-      stdio: ["pipe", "pipe", "pipe"]
-    });
-    const stdout = [];
-    const stderr = [];
-    let outputBytes = 0;
-    const collect = (target, chunk) => {
-      outputBytes += chunk.byteLength;
-      if (outputBytes <= MAX_CREDENTIAL_BYTES) target.push(chunk);
-    };
-    child.stdout.on("data", (chunk) => collect(stdout, chunk));
-    child.stderr.on("data", (chunk) => collect(stderr, chunk));
-    child.once("error", reject);
-    child.once("close", (code2) => resolve17({
-      code: code2 ?? 1,
-      stdout: Buffer.concat(stdout).toString("utf8"),
-      stderr: Buffer.concat(stderr).toString("utf8")
-    }));
-    child.stdin.on("error", () => void 0);
-    child.stdin.end(input.input ?? "");
-  });
-}
-var SystemCloudTokenStore = class {
-  #platform;
-  #service;
-  #account;
-  #run;
-  constructor(options = {}) {
-    this.#platform = options.platform ?? process.platform;
-    this.#service = safeLabel(options.service, DEFAULT_SERVICE, "service");
-    this.#account = safeLabel(options.account, DEFAULT_ACCOUNT, "account");
-    this.#run = options.commandRunner ?? runCredentialCommand;
-    if (this.#platform !== "darwin") {
-      throw new CloudLifecycleError("INVALID_REQUEST", "\u642D\u642D CLI V1 \u7684\u5B89\u5168\u767B\u5F55\u5B58\u50A8\u76EE\u524D\u53EA\u652F\u6301 macOS Keychain");
-    }
-  }
-  async load() {
-    const result = await this.#run({
-      command: "security",
-      args: ["find-generic-password", "-s", this.#service, "-a", this.#account, "-w"]
-    });
-    if (result.code === 44) return void 0;
-    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u8BFB\u53D6 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u767B\u5F55\u72B6\u6001");
-    const raw = result.stdout.trimEnd();
-    return parse(/^(?:[a-fA-F0-9]{2})+$/u.test(raw) ? Buffer.from(raw, "hex").toString("utf8") : raw);
-  }
-  async save(token) {
-    const source = serialize(token);
-    const line = ["add-generic-password", "-U", "-s", this.#service, "-a", this.#account, "-w", source].map((part) => `"${part.replace(/\\/gu, "\\\\").replace(/"/gu, '\\"')}"`).join(" ") + "\n";
-    if (Buffer.byteLength(line, "utf8") >= 4096) {
-      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u767B\u5F55\u51ED\u636E\u8D85\u8FC7 macOS \u5199\u5165\u957F\u5EA6\u9650\u5236\uFF0C\u672A\u4FDD\u5B58\uFF1B\u8BF7\u8054\u7CFB\u5E73\u53F0\u5904\u7406");
-    }
-    const result = await this.#run({
-      command: "security",
-      args: ["-i", "-q"],
-      input: line
-    });
-    if (result.code !== 0) throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u628A\u642D\u642D\u767B\u5F55\u72B6\u6001\u5199\u5165 macOS \u94A5\u5319\u4E32");
-    const saved = await this.load();
-    if (!saved || serialize(saved) !== source) throw new CloudLifecycleError("AUTH_CREDENTIAL_CORRUPT", "\u767B\u5F55\u51ED\u636E\u5199\u5165\u540E\u6821\u9A8C\u5931\u8D25\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55");
-  }
-  async clear() {
-    const result = await this.#run({
-      command: "security",
-      args: ["delete-generic-password", "-s", this.#service, "-a", this.#account]
-    });
-    if (result.code !== 0 && result.code !== 44) {
-      throw new CloudLifecycleError("AUTH_TOKEN_INVALID", "\u65E0\u6CD5\u6E05\u9664 macOS \u94A5\u5319\u4E32\u4E2D\u7684\u642D\u642D\u767B\u5F55\u72B6\u6001");
-    }
-  }
-};
-
 // packages/cli-core/src/cloud/mock-client.ts
-import { createHash as createHash6, randomBytes as randomBytes2 } from "node:crypto";
+import { createHash as createHash7, randomBytes as randomBytes2 } from "node:crypto";
 var MockDeveloperPlatformClient = class {
   #now;
   #buddies = /* @__PURE__ */ new Map();
@@ -4257,7 +4337,7 @@ var MockDeveloperPlatformClient = class {
     const current = this.#require(request.id);
     validateBuddyMetaUpdate(request.meta);
     const onlyAvatar = Object.keys(request.meta).every((key) => key === "avatar");
-    const avatar = request.avatar ? `/media/avatar-${request.id}.webp?v=${createHash6("sha256").update(request.avatar.bytes).digest("hex").slice(0, 16)}` : request.meta.avatar === null ? null : current.meta?.avatar ?? null;
+    const avatar = request.avatar ? `/media/avatar-${request.id}.webp?v=${createHash7("sha256").update(request.avatar.bytes).digest("hex").slice(0, 16)}` : request.meta.avatar === null ? null : current.meta?.avatar ?? null;
     const next = this.#value({ ...current, meta: { ...onlyAvatar ? current.meta : request.meta, avatar }, updatedAt: this.#now() });
     this.#buddies.set(request.id, next);
     return structuredClone(next);
@@ -5319,7 +5399,7 @@ async function scanExternalSkillPortability(options) {
 }
 
 // packages/cli-core/src/push/preflight.ts
-import { createHash as createHash7 } from "node:crypto";
+import { createHash as createHash8 } from "node:crypto";
 import { lstat as lstat10, open as open5, readdir as readdir5, realpath as realpath4 } from "node:fs/promises";
 import { isAbsolute as isAbsolute3, join as join13, relative as relative2, resolve as resolve15, sep as sep2, win32 as win323 } from "node:path";
 
@@ -5419,7 +5499,7 @@ function error(options) {
   throw new PushPreflightError(options);
 }
 function sha256(value) {
-  return `sha256:${createHash7("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash8("sha256").update(value).digest("hex")}`;
 }
 function positiveLimit(value, name, hardMaximum) {
   if (!Number.isSafeInteger(value) || value < 1 || value > hardMaximum) {
@@ -5665,7 +5745,7 @@ async function hashRegularFile(options) {
         message: `\u751F\u6210\u6E05\u5355\u65F6\u6587\u4EF6\u53D1\u751F\u53D8\u5316\uFF1A${options.portablePath}`
       });
     }
-    const hash3 = createHash7("sha256");
+    const hash3 = createHash8("sha256");
     const captured = [];
     const buffer = Buffer.allocUnsafe(READ_BUFFER_BYTES);
     let bytes = 0;
@@ -6124,7 +6204,7 @@ async function createPushPreflight(options) {
 }
 
 // packages/cli-core/src/push/bundle.ts
-import { createHash as createHash8 } from "node:crypto";
+import { createHash as createHash9 } from "node:crypto";
 import { lstat as lstat11, readFile as readFile11, realpath as realpath5 } from "node:fs/promises";
 import { join as join14, relative as relative3, sep as sep3, win32 as win324 } from "node:path";
 import { Writable } from "node:stream";
@@ -6133,7 +6213,7 @@ import { createGzip } from "node:zlib";
 import { pack } from "tar-stream";
 var MEDIA_TYPE = "application/gzip";
 function digest2(bytes) {
-  return `sha256:${createHash8("sha256").update(bytes).digest("hex")}`;
+  return `sha256:${createHash9("sha256").update(bytes).digest("hex")}`;
 }
 function changed(path, message, cause) {
   throw new PushPreflightError({
@@ -6182,7 +6262,7 @@ async function createPushSourceBundle(plan) {
     schemaVersion: "1",
     files: files.map((file) => ({ path: file.path, bytes: file.bytes, digest: file.digest }))
   });
-  const calculatedBundleDigest = `sha256:${createHash8("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
+  const calculatedBundleDigest = `sha256:${createHash9("sha256").update(`buddy-push-bundle-v1\0${descriptor}`).digest("hex")}`;
   if (calculatedBundleDigest !== plan.bundleDigest) {
     changed(plan.projectRoot, "\u63D0\u4EA4\u6E05\u5355\u8EAB\u4EFD\u5728\u6253\u5305\u524D\u53D1\u751F\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C push");
   }
@@ -6840,6 +6920,7 @@ export {
   PromptCancelledError,
   PushPreflightError,
   SkillPortabilityScanError,
+  SystemBuddyTokenStore,
   SystemCloudTokenStore,
   abortedDevError,
   applyBuddyDraftInitialization,