@newlandnpt/pep-cli 0.6.1 → 0.8.0

package/README.md

@@ -72,16 +72,17 @@ The issuer is fixed at build time:
 `--issuer` remains available only as a temporary override — it is **not** remembered, so every
 `auth login` needs it again. That is why the built-in default decides where most users land.
 
-⚠ **The npm release is currently built from `development`** — it ships
-`https://pep-webapp-dev.onrender.com` (see `prepack` in `package.json`). This is a deliberate
-temporary state: production is not going live in the near term and this build is for other
-departments to use now.
+The npm release is built from `production` — it ships `https://pep.newlandnpt.us` and that
+deployment's `client_id`. Both are baked in at build time, so a release already out in the wild
+cannot be repointed; a change to either needs a new version.
 
-`https://pep.newlandnpt.us/.well-known/openid-configuration` still returns **404** (last checked
-2026-09-09) — the production domain does not serve the authorization server yet, so a
-`production` build fails at discovery on the user's very first `auth login`. **Switch `prepack`
-back to `production` and publish immediately once that endpoint is live**: the issuer is baked in
-at build time, so releases already out in the wild cannot be repointed.
+⚠ **This package is only ready-to-use against production.** `/authorize` looks the `client_id` up
+in each deployment's own database, so the baked one does not exist on dev or view. To reach a
+non-production deployment you must pass **both** flags, **every login** — neither is remembered:
+
+```powershell
+pep auth login --issuer https://pep-webapp-dev.onrender.com --client-id <that deployment's id>
+```
 
 ## Skills
 
@@ -193,6 +194,31 @@ offers".
 Skills that are **new upstream** are still installed by `update` — the test is "was mine and is now
 gone", not "is absent".
 
+## Maven credentials
+
+```powershell
+pep nexus setup
+```
+
+Asks PEP for your Maven repository credential and saves it as the two environment variables the
+Newland Android SDK reads (`NEWLAND_MAVEN_USERNAME` / `NEWLAND_MAVEN_PASSWORD`). Windows uses
+`setx`; macOS keeps a marked block in your shell profile, backed up first.
+
+**The password is never printed.** The credential is derived from who you are, so running this
+again — on this machine or any other — hands you the same one; nothing is lost by not showing it.
+Use `--print-env` when you want the two lines on stdout instead:
+
+```bash
+eval "$(pep nexus setup --print-env)"    # the shell you are in gets them now
+```
+
+The credential is per person, not per company — colleagues get their own, and so does the same
+account on a second machine.
+
+⚠ Persistence only reaches **new** processes. A running IDE keeps the environment it started with,
+and the Gradle daemon outlives the IDE, so after the first setup: quit Android Studio completely,
+run `gradlew --stop`, then reopen.
+
 `pep auth token` writes only the access token to stdout, so agents can use it without parsing status
 text. Refresh occurs automatically shortly before expiry and the rotated refresh token replaces the old
 credential atomically.

package/dist/pep.cjs

@@ -9,7 +9,7 @@ var import_node_path2 = require("node:path");
 var import_promises = require("node:fs/promises");
 var import_node_os = require("node:os");
 var import_node_path = require("node:path");
-var DEFAULT_CLIENT_ID = "pep-cli";
+var DEFAULT_CLIENT_ID = "a96eccf418a4591f738e395fa6d0a0ef";
 var DEFAULT_REDIRECT_URI = "http://localhost:53682/callback";
 var DEFAULT_SCOPES = [
   "openid",
@@ -21,13 +21,13 @@ var DEFAULT_SCOPES = [
 ];
 var DEFAULT_RESOURCES = ["urn:newland:pep:docs"];
 var LEGACY_PACKAGE = "semi-integration";
-var DEFAULT_DOCS_URL = "https://pep-developer-docs.onrender.com";
+var DEFAULT_DOCS_URL = "https://docs.newlandnpt.us";
 function issuerForEnvironment(environment) {
   if (environment === "production") return "https://pep.newlandnpt.us";
   if (environment === "view") return "https://pep-webapp-view.onrender.com";
   return "https://pep-webapp-dev.onrender.com";
 }
-var BUILD_ENVIRONMENT = false ? "development" : "development";
+var BUILD_ENVIRONMENT = false ? "development" : "production";
 var DEFAULT_ISSUER = issuerForEnvironment(BUILD_ENVIRONMENT);
 function configuredIssuer(explicitIssuer) {
   return explicitIssuer ?? DEFAULT_ISSUER;
@@ -51,6 +51,9 @@ function defaultSkillsDirectory() {
 function claudeSkillsDirectory() {
   return (0, import_node_path.join)((0, import_node_os.homedir)(), ".claude", "skills");
 }
+function samePlace(a, b) {
+  return a.toLowerCase() === b.toLowerCase();
+}
 function userSkillsTarget() {
   return { directory: defaultSkillsDirectory(), linkInto: claudeSkillsDirectory() };
 }
@@ -971,7 +974,7 @@ function describeFailure2(status, code) {
     return "This access token carries no `nexus-credentials:write` scope. Ask an operator to add it to this client's allowed_scopes in PEP, then run `pep auth login` again \u2014 existing tokens do not gain new scopes.";
   }
   if (status === 409) {
-    return "This organisation already has a Maven credential. PEP does not store the password, so it cannot be shown again \u2014 ask an operator to reset it in Nexus, or reuse the one you saved earlier.";
+    return "This PEP deployment still issues one Maven credential per company, so it cannot give you yours again. Newer PEP issues one per person and can always re-derive it \u2014 ask an operator to upgrade this deployment; until then, copy the credential from the machine that has it.";
   }
   if (status === 503) {
     return "PEP could not reach Nexus (not configured, or upstream is down). This is a platform-side problem \u2014 retrying will not help. Report it to a PEP operator.";
@@ -1102,6 +1105,14 @@ function readTar(bytes) {
 
 // src/skills-service.ts
 var ARCHIVE_PATH = "/api/skills/archive";
+var MAX_ARCHIVE_BYTES = 64 * 1024 * 1024;
+var MAX_UNPACKED_BYTES = 256 * 1024 * 1024;
+var MAX_ENTRIES = 1e4;
+function tooBig(what, limit) {
+  return new Error(
+    `The skills archive is too large (${what} exceeds ${Math.round(limit / 1024 / 1024)} MiB). Refusing to unpack it.`
+  );
+}
 var SKILL_MANIFEST = "SKILL.md";
 function planSkillFiles(entries) {
   const roots = [];
@@ -1116,13 +1127,13 @@ function planSkillFiles(entries) {
   for (const root of roots) {
     const name = root[root.length - 1];
     const where = root.join("/");
-    const first = seen.get(name);
+    const first = seen.get(name.toLowerCase());
     if (first !== void 0) {
       throw new Error(
         `Two skills in this package would both be called "${name}": ${first} and ${where}. Skill names come from the directory name, so they must be unique within a package.`
       );
     }
-    seen.set(name, where);
+    seen.set(name.toLowerCase(), where);
   }
   const files = [];
   for (const entry of entries) {
@@ -1137,9 +1148,38 @@ function planSkillFiles(entries) {
   }
   return files;
 }
+async function readCapped(response, limit) {
+  const reader = response.body?.getReader();
+  if (!reader) return new Uint8Array(await response.arrayBuffer());
+  const chunks = [];
+  let total = 0;
+  for (; ; ) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.byteLength;
+    if (total > limit) {
+      await reader.cancel();
+      throw tooBig("the download", limit);
+    }
+    chunks.push(value);
+  }
+  const out = new Uint8Array(total);
+  let at = 0;
+  for (const chunk of chunks) {
+    out.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return out;
+}
+function assertInside(base, target) {
+  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(base), (0, import_node_path4.resolve)(target));
+  if (rel === "" || rel.startsWith("..") || (0, import_node_path4.isAbsolute)(rel)) {
+    throw new Error(`Refusing an archive entry that escapes its directory: ${target}`);
+  }
+}
 function segmentsOf(path) {
-  const segments = path.split("/").filter((one) => one !== "" && one !== ".");
-  if (segments.some((one) => one === "..")) {
+  const segments = path.split(/[\\/]+/).filter((one) => one !== "" && one !== ".");
+  if (segments.some((one) => one === ".." || /^[a-z]:$/i.test(one))) {
     throw new Error(`Refusing an archive entry that escapes its directory: ${path}`);
   }
   return segments;
@@ -1195,6 +1235,12 @@ function hashSkill(files) {
   }
   return hash.digest("hex").slice(0, 32);
 }
+function otherClaimant(packages, self, directory, skill) {
+  const wanted = skill.toLowerCase();
+  return Object.entries(packages).find(
+    ([other, pkg]) => other !== self && samePlace(pkg.directory, directory) && Object.keys(pkg.skills).some((one) => one.toLowerCase() === wanted)
+  )?.[0];
+}
 async function removeSkills(name, store) {
   const state = await store.read();
   const pkg = state?.packages[name];
@@ -1204,9 +1250,7 @@ async function removeSkills(name, store) {
   const deleted = [];
   const keptForOthers = [];
   for (const skill of Object.keys(pkg.skills).sort()) {
-    const owner = Object.entries(state.packages).find(
-      ([other, one]) => other !== name && one.directory === pkg.directory && skill in one.skills
-    )?.[0];
+    const owner = otherClaimant(state.packages, name, pkg.directory, skill);
     if (owner !== void 0) {
       keptForOthers.push({ skill, owner });
       continue;
@@ -1248,10 +1292,8 @@ async function updateSkills(dependencies) {
   const commit = response.headers.get("x-skills-commit") ?? void 0;
   const state = await dependencies.stateStore.read();
   const previous = state?.packages[name];
-  const sameTarget = previous?.directory === dependencies.directory && previous?.linkedInto === dependencies.linkInto;
-  const claimedElsewhere = (skill) => Object.entries(state?.packages ?? {}).find(
-    ([other, pkg]) => other !== name && pkg.directory === dependencies.directory && skill in pkg.skills
-  )?.[0];
+  const sameTarget = previous !== void 0 && samePlace(previous.directory, dependencies.directory) && (previous.linkedInto === void 0 ? dependencies.linkInto === void 0 : dependencies.linkInto !== void 0 && samePlace(previous.linkedInto, dependencies.linkInto));
+  const claimedElsewhere = (skill) => otherClaimant(state?.packages ?? {}, name, dependencies.directory, skill);
   const gone = previous !== void 0 && sameTarget ? await missingSkills(previous.directory, Object.keys(previous.skills)) : /* @__PURE__ */ new Set();
   const nothingToRestore = !dependencies.restoreMissing || gone.size === 0;
   const standing = Object.keys(previous?.skills ?? {}).flatMap((skill) => {
@@ -1262,8 +1304,23 @@ async function updateSkills(dependencies) {
     await response.body?.cancel();
     return { status: "unchanged", name, commit, conflicts: standing };
   }
-  const gzipped = new Uint8Array(await response.arrayBuffer());
-  const files = planSkillFiles(readTar((0, import_node_zlib.gunzipSync)(gzipped)));
+  const gzipped = await readCapped(response, dependencies.maxArchiveBytes ?? MAX_ARCHIVE_BYTES);
+  let unpacked;
+  try {
+    unpacked = (0, import_node_zlib.gunzipSync)(gzipped, { maxOutputLength: MAX_UNPACKED_BYTES });
+  } catch (error) {
+    if (error.code === "ERR_BUFFER_TOO_LARGE") {
+      throw tooBig("the unpacked archive", MAX_UNPACKED_BYTES);
+    }
+    throw error;
+  }
+  const entries = readTar(unpacked);
+  if (entries.length > MAX_ENTRIES) {
+    throw new Error(
+      `The skills archive holds ${entries.length} files (limit ${MAX_ENTRIES}). Refusing to unpack it.`
+    );
+  }
+  const files = planSkillFiles(entries);
   const bySkill = /* @__PURE__ */ new Map();
   for (const file of files) {
     const group = bySkill.get(file.skill);
@@ -1300,6 +1357,7 @@ async function updateSkills(dependencies) {
   if (previous !== void 0) {
     const stale = sameTarget ? removed : Object.keys(previous.skills);
     for (const skill of stale) {
+      if (otherClaimant(state?.packages ?? {}, name, previous.directory, skill)) continue;
       await (0, import_promises4.rm)((0, import_node_path4.join)(previous.directory, skill), { recursive: true, force: true });
       if (previous.linkedInto !== void 0) {
         await (0, import_promises4.rm)((0, import_node_path4.join)(previous.linkedInto, skill), { recursive: true, force: true });
@@ -1313,6 +1371,7 @@ async function updateSkills(dependencies) {
   for (const file of files) {
     if (untouched.has(file.skill)) continue;
     const target = (0, import_node_path4.join)(dependencies.directory, file.skill, ...file.path.split("/"));
+    assertInside(dependencies.directory, target);
     await (0, import_promises4.mkdir)((0, import_node_path4.dirname)(target), { recursive: true });
     await (0, import_promises4.writeFile)(target, file.data);
   }
@@ -1353,7 +1412,9 @@ async function updateSkills(dependencies) {
     updated,
     unchanged,
     skills,
-    fileCount: files.filter((one) => !skipped.includes(one.skill)).length,
+    // ⚠ 扣掉的是 `untouched` 全部（用户删的 + 让给别的包的），不只是 skipped ——
+    // 让开没写的那些文件算进去，「N file(s)」就是句假话。
+    fileCount: files.filter((one) => !untouched.has(one.skill)).length,
     removed,
     skipped,
     conflicts,
@@ -1365,7 +1426,7 @@ async function updateSkills(dependencies) {
 }
 
 // src/cli.ts
-var VERSION = false ? "0.0.0-dev" : "0.6.1";
+var VERSION = false ? "0.0.0-dev" : "0.8.0";
 function usage() {
   return `PEP CLI ${VERSION}
 
@@ -1380,7 +1441,7 @@ Usage:
   pep skills remove <repo>
   pep docs list [--docs-url <url>]
   pep docs get <path> [--docs-url <url>]
-  pep nexus setup
+  pep nexus setup [--print-env]
 
 The issuer is built into this executable. --issuer overrides it for that one command and is
 NOT remembered \u2014 pass it every time you log in against a non-default deployment.
@@ -1441,15 +1502,20 @@ hand is left alone.
 straight to \`pep docs get\` to print that document as markdown on stdout. The documentation
 site is built in (${DEFAULT_DOCS_URL}); --docs-url overrides it and is then remembered.
 
-\`pep nexus setup\` asks PEP for this organisation's Maven repository credential and saves it as
-the two environment variables the Newland Android SDK reads \u2014 \`${USERNAME_VAR}\` and
-\`${PASSWORD_VAR}\` \u2014 so you do not copy anything by hand. On Windows it writes them to your user
-environment (\`setx\`); on macOS it keeps a marked block in your shell profile, backing the file up
-first and touching nothing else. Either way persistence only affects NEW shells, so the two lines
-are also printed on stdout: \`eval "$(pep nexus setup)"\` uses them in the current one.
-Only Android needs this \u2014 the Windows and iOS SDKs are cloned from Git, not pulled from Maven.
-The password is shown by PEP once and never stored, so a second run reports 409 rather than
-handing it out again.`;
+\`pep nexus setup\` asks PEP for your Maven repository credential and saves it as the two
+environment variables the Newland Android SDK reads \u2014 \`${USERNAME_VAR}\` and \`${PASSWORD_VAR}\`
+\u2014 so you do not copy anything by hand. On Windows it writes them to your user environment
+(\`setx\`); on macOS it keeps a marked block in your shell profile, backing the file up first and
+touching nothing else. Either way persistence only affects NEW shells.
+
+**The password is never printed.** The credential is derived from who you are, so running this
+again \u2014 on this machine or any other \u2014 hands you the same one. Nothing is lost by not showing it.
+\`--print-env\` writes the two lines to stdout instead, for
+\`eval "$(pep nexus setup --print-env)"\` when you want the shell you are in to have them now.
+
+The credential is per person, not per company: your colleagues get their own, and so does the same
+account on a second machine. Only Android needs this \u2014 the Windows and iOS SDKs are cloned from
+Git, not pulled from Maven.`;
 }
 function reportUpdate(result) {
   const conflicts = () => {
@@ -1561,6 +1627,33 @@ function targetForSource(chosen, recorded) {
     ...recorded.linkedInto !== void 0 ? { linkInto: recorded.linkedInto } : {}
   };
 }
+function nexusReport(result, printEnv) {
+  const stdout = printEnv ? [result.lines] : [];
+  const stderr = [];
+  const persisted = result.persisted;
+  if (persisted.status === "windows") {
+    stderr.push(`Saved ${USERNAME_VAR} and ${PASSWORD_VAR} to your Windows user environment.`);
+    stderr.push("Existing terminals do not see them \u2014 open a new one.");
+    stderr.push("Android Studio / IntelliJ must be fully quit and reopened \u2014 its built-in");
+    stderr.push("terminal inherits the old environment too.");
+    stderr.push("Then stop the Gradle daemon, which outlives the IDE: `gradlew --stop`.");
+  } else if (persisted.status === "manual") {
+    stderr.push(
+      `Nothing was written${persisted.path ? ` to ${persisted.path}` : ""}: ${persisted.reason}`
+    );
+    stderr.push("Run this again to get the same credential \u2014 it is derived, not stored.");
+  } else {
+    stderr.push(
+      persisted.status === "profile-replaced" ? `Replaced the pep-cli block in ${persisted.path}` : `Appended a pep-cli block to ${persisted.path}`
+    );
+    if (persisted.backupPath) stderr.push(`Backup: ${persisted.backupPath}`);
+    stderr.push("New shells will have it; this one will not until you re-source the profile.");
+    stderr.push("Android Studio / IntelliJ must be fully quit and reopened, then");
+    stderr.push("stop the Gradle daemon, which outlives it: `./gradlew --stop`.");
+  }
+  stderr.push(`Nexus user: ${result.username}`);
+  return { stdout, stderr };
+}
 async function main() {
   const args = process.argv.slice(2);
   if (args.length === 0 || args.includes("--help") || args.includes("-h")) {
@@ -1618,30 +1711,16 @@ ${usage()}`);
     if (command !== "setup") throw new Error(`Unknown nexus command.
 
 ${usage()}`);
+    const printEnv = flag(args, "--print-env");
     if (args.length > 0) throw new Error(`Unknown option: ${args[0]}`);
     const authorization = await auth.currentAuthorization();
     const result = await setupNexusCredential({
       issuer: authorization.issuer,
       accessToken: authorization.accessToken
     });
-    console.log(result.lines);
-    const persisted = result.persisted;
-    if (persisted.status === "windows") {
-      console.error(`Saved ${USERNAME_VAR} and ${PASSWORD_VAR} to your Windows user environment.`);
-      console.error("Existing terminals do not see them \u2014 open a new one (or use the lines above).");
-    } else if (persisted.status === "manual") {
-      console.error(
-        `Nothing was written${persisted.path ? ` to ${persisted.path}` : ""}: ${persisted.reason}`
-      );
-      console.error("The two lines above are the only copy \u2014 PEP does not store the password.");
-    } else {
-      console.error(
-        persisted.status === "profile-replaced" ? `Replaced the pep-cli block in ${persisted.path}` : `Appended a pep-cli block to ${persisted.path}`
-      );
-      if (persisted.backupPath) console.error(`Backup: ${persisted.backupPath}`);
-      console.error("New shells will have it; this one will not until you re-source the profile.");
-    }
-    console.error(`Nexus user: ${result.username}`);
+    const report = nexusReport(result, printEnv);
+    for (const line of report.stdout) console.log(line);
+    for (const line of report.stderr) console.error(line);
     return;
   }
   if (group === "skills") {
@@ -1723,7 +1802,10 @@ ${usage()}`);
       );
     }
     const wanted = named.length > 0 ? named : installed;
-    const targets = chosenTarget ? wanted.filter((one) => state?.packages[one]?.directory === chosenTarget.directory) : wanted;
+    const targets = chosenTarget ? wanted.filter((one) => {
+      const at = state?.packages[one]?.directory;
+      return at !== void 0 && samePlace(at, chosenTarget.directory);
+    }) : wanted;
     if (targets.length === 0) {
       console.error(`No skills are installed in ${chosenTarget?.directory}.`);
       console.error("`pep skills update` (no flag) refreshes every repository where it lives;");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@newlandnpt/pep-cli",
-  "version": "0.6.1",
+  "version": "0.8.0",
   "description": "PEP CLI —— 凭 PEP 身份读取 Newland 开发者文档与 agent skills",
   "license": "UNLICENSED",
   "type": "module",
@@ -28,7 +28,7 @@
     "build:installer": "node scripts/build-installer.mjs production",
     "build:installer:dev": "node scripts/build-installer.mjs development",
     "build:installer:prod": "node scripts/build-installer.mjs production",
-    "prepack": "node scripts/build-js.mjs development",
+    "prepack": "node scripts/build-js.mjs production",
     "build:exe:view": "node scripts/build-exe.mjs view",
     "build:installer:view": "node scripts/build-installer.mjs view"
   },