@optima-chat/dev-skills 0.8.0 → 0.8.2

package/.claude/commands/logs.md

@@ -50,7 +50,8 @@
   - `ci` - CI 持续集成环境（开发环境，默认）
   - `stage` - Stage 预发布环境（ECS Fargate）
   - `prod` - 生产环境（ECS Fargate）
-  - `cn-prod`（别名 `cn`）- 阿里云 cn-prod 环境（SAE，cn-beijing，经 buildbox 取日志）
+  - `cn-prod`（别名 `cn`）- 阿里云 cn-prod 环境（SAE，cn-beijing，`optima-logs` 直连 SLS）
+  - `cn-stage` - 阿里云 cn-stage 预发环境（SAE，cn-beijing，`optima-logs` 直连 SLS）
 
 ## 示例
 
@@ -72,7 +73,7 @@
 - `ci` 或未指定 → 使用 SSH + Docker Compose（第 0 节，默认）
 - `stage` → 使用 AWS CloudWatch Logs - ECS（第 1 节）
 - `prod` → 使用 AWS CloudWatch Logs - ECS（第 2 节）
-- `cn-prod` / `cn` → 阿里云 SAE，经 buildbox 调 `DescribeInstanceLog`（第 3 节）
+- `cn-prod` / `cn` / `cn-stage` → 阿里云 SLS，`optima-logs` 直连（第 3 节，免 buildbox）
 
 ### 0. CI 环境（environment = "ci" 或默认）
 
@@ -211,59 +212,38 @@ aws logs get-log-events --log-group-name /ecs/commerce-backend-prod --log-stream
 
 **注意**: `optima-store` 仅在 Stage 环境部署
 
-### 3. cn-prod 环境（environment = "cn-prod" 或 "cn"）
+### 3. cn-prod / cn-stage 环境（environment = "cn-prod"/"cn" 或 "cn-stage"）
 
-**部署方式**: 阿里云 **SAE**（Serverless App Engine，cn-beijing），不是 ECS/CloudWatch。
-**访问方式**: 经 buildbox（`root@47.94.105.163`，唯一装了 `aliyun-optima` profile + VPC 可达的机器）调 SAE OpenAPI。
+**部署方式**: 阿里云 **SAE**（cn-beijing），不是 ECS/CloudWatch。
+**访问方式**: ✅ **用 `optima-logs` CLI 直连阿里云 SLS**，不再经 buildbox。
 
-> ⚠️ SAE **未配 SLS**，stdout 日志只能用 `DescribeInstanceLog` 取实例**当前缓冲**（非历史检索；重启/滚动后旧日志丢）。要历史检索需给 SAE 配 SLS。
+> ✅ 现状更新（2026-06-16）：cn-prod / cn-stage 全部服务**已接 SLS**（含 ECI 的 `agent-runtime`）。
+> SLS `GetLogs` 是公网控制面 API，本机 `aliyun-optima` profile 直连即可，支持**历史检索 + 时间窗 + 关键词**——
+> 旧的「SSH buildbox → SAE `DescribeInstanceLog` 取当前缓冲」流程已弃用（缓冲式、重启即丢、不能检索）。
 
-**日志链**: service → AppId → GroupId → InstanceId → `DescribeInstanceLog`
-
-**关键坑**（实测）:
-- API 是 RPC-style `aliyun sae DescribeInstanceLog`，ROA 路径是 `/pop/v1/sam/**instance**/describeInstanceLog`（不是 `/sam/app/...`，写错报 "can not find api by path"）。
-- buildbox 密码在 1P `op://Optima/gdmixcizjci5bvuu3nuvgg4ooe/password`（标题带括号必须用 item ID）。
-
-**service → AppId 映射**（cn-prod，2026-06-01；新增/变动用 `aliyun sae ListApplications` 重查）:
+**推荐用法（首选）**:
+```bash
+optima-logs gateway-core                       # 默认 cn-prod，最近 1h，100 行
+optima-logs gateway-core --env cn-stage
+optima-logs agent-runtime --env cn-prod --since 2h   # ECI 容器也直接可见
+optima-logs user-auth --grep error -n 200
+optima-logs gateway-core --since 30m --json | jq .   # 机器可读
+```
 
-| service | AppId |
-|---|---|
-| `gateway-core` | `a08ce23f-3d3e-4d89-a2cf-53c8adba614e` |
-| `agentic-chat` | `6e290c73-a646-43ef-9da5-ad0b2e7eff73` |
-| `gw-admin` | `c6bc5a78-b27f-46e2-825a-eaa338c23645` |
-| `user-auth` | `d6fbf9de-fed6-4165-978f-7b3a0a456acc` |
-| `user-auth-admin` | `54093f99-37bf-4354-abd7-f6e76abdbcb6` |
-| `optima-scout` | `f5bb7e82-e57c-4bd4-83ae-2c25f8d38647` |
-| `optima-skills` | `55a63ee7-fb75-46e4-99f3-20854a699237` |
-| `infisical` | `52b33fc6-b26d-495a-8885-225d38b3d42f` |
+参数：`--env stage|prod|cn-prod|cn-stage`、`--since 30m|2h|1d`、`--grep <kw>`、`--lines/-n <N>`、`--json`。
+`service` == SLS logstore 名（同名）。列全部 logstore：
+`aliyun sls ListLogStores --project optima-cn-prod-1911493506120573 --region cn-beijing --profile aliyun-optima`
 
-**完整脚本**（本地跑、经 buildbox 中转；改 `SERVICE`/`LINES`）:
+**底层（仅参考，正常用 `optima-logs` 即可）**:
+- SLS project：`optima-cn-prod-1911493506120573` / `optima-cn-stage-1911493506120573`（`optima-<env>-<accountId>`）。
+- logstore = service 名；日志正文在 `content` 字段。
 ```bash
-SERVICE=gateway-core; LINES=80
-BBPW=$(op-win read "op://Optima/gdmixcizjci5bvuu3nuvgg4ooe/password")
-declare -A APPID=(
-  [gateway-core]=a08ce23f-3d3e-4d89-a2cf-53c8adba614e
-  [agentic-chat]=6e290c73-a646-43ef-9da5-ad0b2e7eff73
-  [gw-admin]=c6bc5a78-b27f-46e2-825a-eaa338c23645
-  [user-auth]=d6fbf9de-fed6-4165-978f-7b3a0a456acc
-  [user-auth-admin]=54093f99-37bf-4354-abd7-f6e76abdbcb6
-  [optima-scout]=f5bb7e82-e57c-4bd4-83ae-2c25f8d38647
-  [optima-skills]=55a63ee7-fb75-46e4-99f3-20854a699237
-  [infisical]=52b33fc6-b26d-495a-8885-225d38b3d42f )
-AID=${APPID[$SERVICE]}
-sshpass -p "$BBPW" ssh -o StrictHostKeyChecking=no root@47.94.105.163 "bash -s" <<REMOTE | tail -n $LINES
-P="--region cn-beijing --profile aliyun-optima"
-GID=\$(aliyun sae GET /pop/v1/sam/app/describeApplicationGroups --AppId $AID \$P 2>/dev/null | python3 -c "import sys,json;print(json.load(sys.stdin)['Data'][0]['GroupId'])")
-IID=\$(aliyun sae GET /pop/v1/sam/app/describeApplicationInstances --AppId $AID --GroupId \$GID \$P 2>/dev/null | python3 -c "import sys,json;d=json.load(sys.stdin)['Data'];print((d if isinstance(d,list) else d['Instances'])[0]['InstanceId'])")
-aliyun sae DescribeInstanceLog --InstanceId "\$IID" \$P 2>/dev/null | python3 -c "import sys,json;print(json.load(sys.stdin).get('Data',''))"
-REMOTE
+NOW=$(date +%s); FROM=$((NOW-3600))
+aliyun sls GetLogs --project optima-cn-prod-1911493506120573 --logstore gateway-core \
+  --from $FROM --to $NOW --line 100 --reverse true --query error \
+  --region cn-beijing --profile aliyun-optima
 ```
 
-**局限 / 提示**:
-- 只取第 1 个 InstanceId；多副本要遍历 `Data` 里全部 instance。
-- `agent-runtime` 不在 SAE（是 ECI 动态容器）——它的日志看 `gateway-core` 里 `eci-bridge` 的转发/错误行，或单独查对应 ECI。
-- 过滤：把上面输出 `| grep -iE 'error|eci|fail'` 即可（例：排 agentic-chat 链路 ECI 失败就 grep `gateway-core` 日志的 `eci-bridge`）。
-
 ## 完整示例脚本
 
 ### Stage 环境

package/bin/cli.js

@@ -36,7 +36,7 @@ switch (command) {
     log('  optima-generate-test-token [--env production]        Generate test token', 'cyan');
     log('  optima-grant-balance <email> --amount <usd> [--env]  Grant USD wallet balance', 'cyan');
     log('  optima-grant-subscription <email|phone|userId> --plan <p> [--env] Grant subscription', 'cyan');
-    log('  /logs <service> [lines] [env]                        View service logs (skill)', 'cyan');
+    log('  optima-logs <service> [--env] [--since] [--grep] [-n]  View logs (cn=SLS 直连/aws=CloudWatch)', 'cyan');
     log('  /restart-ecs <service> [env]                         Restart ECS service (skill)', 'cyan');
 
     log('\nSupported Services:', 'yellow');

package/bin/helpers/billing-http.ts

@@ -1,6 +1,6 @@
 import { execSync } from 'child_process';
 import { fetchInfisicalSecret } from './infisical-secrets';
-import { getInfisicalConfig, getInfisicalToken, getCnInfisicalToken, getCnSecrets } from './db-utils';
+import { getInfisicalConfig, getInfisicalToken, getCnInfisicalToken, getCnSecrets, resolveUserId } from './db-utils';
 
 const USER_AUTH_URLS: Record<string, string> = {
   stage: 'https://auth.stage.optima.onl',
@@ -292,6 +292,25 @@ export async function resolveUserIdByEmail(env: string, email: string): Promise<
   return parsed.user_id;
 }
 
+/**
+ * Resolve email → userId across all envs, picking the path that exists for
+ * each cloud. AWS (stage/prod) reaches the database over the RDS SSH tunnel
+ * (db-utils.resolveUserId). cn-prod / cn-stage have no tunnel into the Aliyun
+ * VPC-internal RDS, so they resolve via user-auth's internal HTTP lookup
+ * (resolveUserIdByEmail) — the cn dev-skills token carries the
+ * internal:users:write scope that endpoint requires. Lets the entitlement
+ * subcommands support cn the same way grant-subscription already does, without
+ * each call site re-implementing the branch.
+ */
+export async function resolveUserIdByEmailAnyEnv(env: string, email: string): Promise<string> {
+  if (env === 'cn-prod' || env === 'cn-stage') {
+    return resolveUserIdByEmail(env, email);
+  }
+  const cfg = getInfisicalConfig();
+  const token = getInfisicalToken(cfg);
+  return resolveUserId(email, env, cfg, token);
+}
+
 /**
  * Resolve a user's id by phone via user-auth's internal lookup endpoint
  * (POST /api/v1/internal/users/lookup with {phone}). Mirrors

package/bin/helpers/confirm-prompt.ts

@@ -1,17 +1,21 @@
 import * as readline from 'readline';
 
 /**
- * On prod, print the resolved action and require typing "yes" to proceed.
- * No-op on stage or when --yes was passed. Exits 1 if user declines.
+ * On a production env, print the resolved action and require typing "yes" to
+ * proceed. Both AWS `prod` and Aliyun `cn-prod` are production — cn-prod must
+ * gate identically or the cn rollout silently loses the prod safety prompt.
+ * No-op on stage / cn-stage or when --yes was passed. Exits 1 if user declines.
  */
+const PROD_ENVS = new Set(['prod', 'cn-prod']);
+
 export async function confirmIfProd(
   env: string,
   actionDescription: string,
   skipFlag: boolean,
 ): Promise<void> {
-  if (env !== 'prod' || skipFlag) return;
+  if (!PROD_ENVS.has(env) || skipFlag) return;
 
-  console.log(`\n⚠️  About to perform on PROD:\n${actionDescription}\n`);
+  console.log(`\n⚠️  About to perform on ${env.toUpperCase()}:\n${actionDescription}\n`);
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const answer = await new Promise<string>((resolve) => {
     rl.question('Type "yes" to confirm: ', (a) => { rl.close(); resolve(a.trim()); });

package/bin/helpers/discount/create.ts

@@ -1,4 +1,4 @@
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd } from '../billing-http';
 import { confirmIfProd } from '../confirm-prompt';
 
 interface CreateArgs {
@@ -34,7 +34,7 @@ Optional:
   --ends <date>            Valid-until
   --max <N>                Max total redemptions (default: unlimited; 1 = single-use)
   --campaign <label>       Grouping label
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
     process.exit(0);
   }
@@ -62,7 +62,7 @@ Optional:
 
 export async function runCreate(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
   await confirmIfProd(args.env, `Create discount code ${args.code.toUpperCase()} (${args.percentOff}% off)`, args.yes);
 
   const body: Record<string, unknown> = { code: args.code, percentOff: args.percentOff };

package/bin/helpers/discount/disable.ts

@@ -1,4 +1,4 @@
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd } from '../billing-http';
 import { confirmIfProd } from '../confirm-prompt';
 
 interface DisableArgs {
@@ -15,7 +15,7 @@ Required:
   --code <CODE>
 
 Optional:
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
     process.exit(0);
   }
@@ -36,7 +36,7 @@ Optional:
 
 export async function runDisable(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
   await confirmIfProd(args.env, `Disable discount code ${args.code.toUpperCase()}`, args.yes);
   const res = await callBilling(args.env, 'PATCH', `/api/billing/admin/discount-codes/${encodeURIComponent(args.code)}`, { status: 'DISABLED' });
   console.log(`✓ Disabled (HTTP ${res.status}):`);

package/bin/helpers/discount/generate.ts

@@ -1,5 +1,5 @@
 import * as fs from 'fs';
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd } from '../billing-http';
 import { confirmIfProd } from '../confirm-prompt';
 
 interface GenArgs {
@@ -35,7 +35,7 @@ Optional:
   --products <a,b,...>     Limit to these productKeys
   --starts <date>          Valid-from (YYYY-MM-DD or ISO)
   --ends <date>            Valid-until
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
     process.exit(0);
   }
@@ -63,7 +63,7 @@ Optional:
 
 export async function runGenerate(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
   await confirmIfProd(args.env, `Generate ${args.count} unique discount codes (${args.percentOff}% off, campaign ${args.campaign})`, args.yes);
 
   const body: Record<string, unknown> = { count: args.count, percentOff: args.percentOff, campaign: args.campaign };

package/bin/helpers/discount/list.ts

@@ -1,4 +1,4 @@
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd } from '../billing-http';
 
 interface ListArgs {
   campaign?: string;
@@ -15,7 +15,7 @@ Optional:
   --campaign <label>       Filter by campaign
   --code <CODE>            Filter by exact code
   --limit <N>              Max rows (default 500, max 1000)
-  --env stage|prod         (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
     process.exit(0);
   }
   const out: Partial<ListArgs> = { env: 'stage' };
@@ -35,7 +35,7 @@ Optional:
 
 export async function runList(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
   const qs = new URLSearchParams();
   if (args.campaign) qs.set('campaign', args.campaign);
   if (args.code) qs.set('code', args.code);

package/bin/helpers/entitlement/grant.ts

@@ -1,6 +1,5 @@
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd, resolveUserIdByEmailAnyEnv } from '../billing-http';
 import { confirmIfProd } from '../confirm-prompt';
-import { getInfisicalConfig, getInfisicalToken, resolveUserId } from '../db-utils';
 
 interface GrantArgs {
   email: string;
@@ -21,7 +20,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy=<clientId>.`);
     process.exit(0);
@@ -47,11 +46,9 @@ Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy
 
 export async function runGrant(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
 
-  const cfg = getInfisicalConfig();
-  const token = getInfisicalToken(cfg);
-  const userId = await resolveUserId(args.email, args.env, cfg, token);
+  const userId = await resolveUserIdByEmailAnyEnv(args.env, args.email);
 
   await confirmIfProd(
     args.env,

package/bin/helpers/entitlement/list.ts

@@ -1,5 +1,4 @@
-import { callBilling, validateEnv } from '../billing-http';
-import { getInfisicalConfig, getInfisicalToken, resolveUserId } from '../db-utils';
+import { callBilling, validateEnvCnProd, resolveUserIdByEmailAnyEnv } from '../billing-http';
 
 interface ListArgs {
   email: string;
@@ -14,7 +13,7 @@ Required:
   --email <user-email>             Resolved to userId via user-auth DB
 
 Optional:
-  --env stage|prod                 (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
     process.exit(0);
   }
   const out: Partial<ListArgs> = { env: 'stage' };
@@ -42,11 +41,9 @@ interface EntitlementRow {
 
 export async function runList(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
 
-  const cfg = getInfisicalConfig();
-  const token = getInfisicalToken(cfg);
-  const userId = await resolveUserId(args.email, args.env, cfg, token);
+  const userId = await resolveUserIdByEmailAnyEnv(args.env, args.email);
 
   const res = await callBilling<{ entitlements: EntitlementRow[] }>(
     args.env,

package/bin/helpers/entitlement/revoke.ts

@@ -1,6 +1,5 @@
-import { callBilling, validateEnv } from '../billing-http';
+import { callBilling, validateEnvCnProd, resolveUserIdByEmailAnyEnv } from '../billing-http';
 import { confirmIfProd } from '../confirm-prompt';
-import { getInfisicalConfig, getInfisicalToken, resolveUserId } from '../db-utils';
 
 interface RevokeArgs {
   email: string;
@@ -28,7 +27,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Refuses non-ADMIN_GRANT sources (PAYMENT, PARTNER) with source-specific
 error pointing to the right reversal flow.`);
@@ -59,11 +58,9 @@ const PARTNER_REFUSAL = `refusing to revoke a PARTNER-source entitlement via CLI
 
 export async function runRevoke(argv: string[]): Promise<void> {
   const args = parseArgs(argv);
-  validateEnv(args.env);
+  validateEnvCnProd(args.env);
 
-  const cfg = getInfisicalConfig();
-  const token = getInfisicalToken(cfg);
-  const userId = await resolveUserId(args.email, args.env, cfg, token);
+  const userId = await resolveUserIdByEmailAnyEnv(args.env, args.email);
 
   // Step 1: Fetch user's entitlements
   const listRes = await callBilling<{ entitlements: EntitlementRow[] }>(

package/bin/helpers/logs.ts

@@ -0,0 +1,200 @@
+#!/usr/bin/env node
+/**
+ * optima-logs —— 一条命令直取服务日志,四环境统一,用 --env 区分。
+ *
+ *   stage / prod     : AWS CloudWatch(`aws logs tail /ecs/<svc>-<env>`)
+ *   cn-prod / cn-stage: 阿里云 SLS 直连(`aliyun sls GetLogs`)
+ *
+ * cn 的关键改进:旧流程要 SSH 进 buildbox 再调 SAE `DescribeInstanceLog`,
+ * 只能看实例**当前缓冲**(重启即丢、不能检索)。现在 cn-prod/cn-stage 全部
+ * 服务已接 SLS,GetLogs 是公网控制面 API,本机 `aliyun-optima` profile 直连即可:
+ *   - 免 buildbox 跳板
+ *   - 支持时间窗(--since)+ 关键词检索(--grep)+ 历史(重启不丢)
+ *
+ * 前置:
+ *   AWS  → 已配 aws CLI 凭证(ap-southeast-1)
+ *   cn   → 已配 aliyun CLI profile `aliyun-optima`(cn-beijing)
+ *
+ * 用法:
+ *   optima-logs gateway-core                       # 默认 cn-prod,最近 1h,100 行
+ *   optima-logs gateway-core --env cn-stage
+ *   optima-logs user-auth --env prod --since 2h
+ *   optima-logs commerce-backend --grep error -n 200
+ *   optima-logs gateway-core --since 30m --json     # 机器可读
+ *
+ * service == SLS logstore == AWS 日志组 `/ecs/<svc>-<env>` 的 <svc>(同名)。
+ */
+import { execFileSync } from 'child_process';
+
+const ALIYUN_ACCOUNT = '1911493506120573';
+const ALIYUN_PROFILE = 'aliyun-optima';
+const ALIYUN_REGION = 'cn-beijing';
+const AWS_REGION = 'ap-southeast-1';
+
+const AWS_ENVS = ['stage', 'prod'] as const;
+const CN_ENVS = ['cn-prod', 'cn-stage'] as const;
+type Env = (typeof AWS_ENVS)[number] | (typeof CN_ENVS)[number];
+const ALL_ENVS: Env[] = [...AWS_ENVS, ...CN_ENVS];
+
+const C = { g: '\x1b[32m', y: '\x1b[33m', b: '\x1b[34m', d: '\x1b[2m', n: '\x1b[0m' };
+
+interface Args {
+  service: string;
+  env: Env;
+  lines: number;
+  since: string; // 原样字符串,如 1h / 30m / 2d
+  grep?: string;
+  json: boolean;
+}
+
+const HELP = `Usage: optima-logs <service> [options]
+
+四环境统一查日志,cn 直连阿里云 SLS(免 buildbox),AWS 走 CloudWatch。
+
+Required:
+  <service>                服务名(== SLS logstore == /ecs/<svc>-<env> 的 <svc>)
+
+Optional:
+  --env <e>                stage | prod | cn-prod | cn-stage   (default: cn-prod)
+  --lines, -n <N>          返回行数                            (default: 100)
+  --since <dur>            时间窗,如 30m / 2h / 1d / 3600(秒)  (default: 1h)
+  --grep <kw>              关键词检索(cn=SLS query / aws=filter-pattern)
+  --json                   原始 JSON 输出(接管道)
+  --help, -h               显示本帮助
+
+Examples:
+  optima-logs gateway-core
+  optima-logs user-auth --env prod --since 2h
+  optima-logs commerce-backend --env cn-prod --grep error -n 200`;
+
+/** 把 30m / 2h / 1d / 纯秒 解析成秒数;同时回填给 aws 用的带单位字符串。 */
+function parseSince(raw: string): { sec: number; awsStr: string } {
+  const m = raw.match(/^(\d+)([smhdw]?)$/);
+  if (!m) throw new Error(`--since 格式非法: ${raw}(用 30m / 2h / 1d / 纯秒)`);
+  const n = parseInt(m[1], 10);
+  const unit = m[2] || 's';
+  const mult: Record<string, number> = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
+  return { sec: n * mult[unit], awsStr: `${n}${unit}` };
+}
+
+function parseArgs(argv: string[]): Args {
+  if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+    console.log(HELP);
+    process.exit(0);
+  }
+  const out: Partial<Args> = { env: 'cn-prod', lines: 100, since: '1h', json: false };
+  const positional: string[] = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const next = argv[i + 1];
+    switch (a) {
+      case '--env': out.env = next as Env; i++; break;
+      case '--lines': case '-n': {
+        const v = parseInt(next, 10);
+        if (isNaN(v) || v <= 0) throw new Error('--lines 需要正整数');
+        out.lines = v; i++; break;
+      }
+      case '--since': out.since = next; i++; break;
+      case '--grep': out.grep = next; i++; break;
+      case '--json': out.json = true; break;
+      default:
+        if (a.startsWith('-')) throw new Error(`未知参数: ${a}`);
+        positional.push(a);
+    }
+  }
+  if (positional.length === 0) throw new Error('缺少 <service>(见 --help)');
+  if (positional.length > 1) throw new Error(`多余参数: ${positional.slice(1).join(' ')}`);
+  out.service = positional[0];
+  if (!ALL_ENVS.includes(out.env as Env)) {
+    throw new Error(`--env 非法: ${out.env}(可选 ${ALL_ENVS.join(' | ')})`);
+  }
+  return out as Args;
+}
+
+function run(cmd: string, args: string[]): string {
+  return execFileSync(cmd, args, { encoding: 'utf-8', maxBuffer: 128 * 1024 * 1024 });
+}
+
+/** AWS CloudWatch:aws logs tail /ecs/<svc>-<env>。 */
+function fetchAws(args: Args): void {
+  const group = `/ecs/${args.service}-${args.env}`;
+  const { awsStr } = parseSince(args.since);
+  const cmd = ['logs', 'tail', group, '--since', awsStr, '--region', AWS_REGION, '--format', args.json ? 'json' : 'short'];
+  if (args.grep) cmd.push('--filter-pattern', args.grep);
+  process.stderr.write(`${C.d}# AWS CloudWatch ${group} (since ${awsStr}${args.grep ? `, grep "${args.grep}"` : ''})${C.n}\n`);
+  try {
+    process.stdout.write(run('aws', cmd));
+  } catch (e: any) {
+    if (/ResourceNotFoundException/.test(e.stderr || e.message || '')) {
+      throw new Error(`日志组不存在: ${group}\n  确认服务名/环境对,或该服务未部署在 ${args.env}。`);
+    }
+    throw new Error(e.stderr || e.message);
+  }
+}
+
+/** 阿里云 SLS:aliyun sls GetLogs,project=optima-<env>-<account>,logstore=service。 */
+function fetchCn(args: Args): void {
+  const project = `optima-${args.env}-${ALIYUN_ACCOUNT}`;
+  const { sec } = parseSince(args.since);
+  const now = Math.floor(Date.now() / 1000);
+  const from = now - sec;
+  const cmd = [
+    'sls', 'GetLogs',
+    '--project', project,
+    '--logstore', args.service,
+    '--from', String(from),
+    '--to', String(now),
+    '--line', String(args.lines),
+    '--reverse', 'true', // 先拿最新 N 条
+    '--region', ALIYUN_REGION,
+    '--profile', ALIYUN_PROFILE,
+  ];
+  if (args.grep) { cmd.push('--query', args.grep); }
+  process.stderr.write(`${C.d}# 阿里云 SLS ${project}/${args.service} (since ${args.since}${args.grep ? `, query "${args.grep}"` : ''})${C.n}\n`);
+
+  let raw: string;
+  try {
+    raw = run('aliyun', cmd);
+  } catch (e: any) {
+    const msg = e.stderr || e.message || '';
+    if (/LogStoreNotExist|ProjectNotExist/.test(msg)) {
+      throw new Error(`SLS logstore 不存在: ${project}/${args.service}\n  确认服务名对,或该服务未接 SLS。列全部:\n  aliyun sls ListLogStores --project ${project} --region ${ALIYUN_REGION} --profile ${ALIYUN_PROFILE}`);
+    }
+    throw new Error(msg);
+  }
+
+  const rows: Array<Record<string, string>> = JSON.parse(raw || '[]');
+  // reverse=true 取到的是新→旧,翻回旧→新便于阅读
+  rows.reverse();
+  if (args.json) {
+    console.log(JSON.stringify(rows, null, 2));
+    return;
+  }
+  if (rows.length === 0) {
+    process.stderr.write(`${C.y}(无日志:该时间窗内 ${args.service} 无输出,或 --grep 没命中)${C.n}\n`);
+    return;
+  }
+  for (const r of rows) {
+    // SLS 存的 content 已含容器时间戳 + stream(stdout/stderr)前缀,直接打印即可
+    process.stdout.write((r.content ?? JSON.stringify(r)) + '\n');
+  }
+}
+
+function main(): void {
+  let args: Args;
+  try {
+    args = parseArgs(process.argv.slice(2));
+  } catch (e: any) {
+    console.error(`${C.y}✗ ${e.message}${C.n}`);
+    process.exit(1);
+  }
+  try {
+    if (CN_ENVS.includes(args.env as any)) fetchCn(args);
+    else fetchAws(args);
+  } catch (e: any) {
+    console.error(`${C.y}✗ ${e.message}${C.n}`);
+    process.exit(1);
+  }
+}
+
+main();

package/dist/bin/helpers/billing-http.js

@@ -6,6 +6,7 @@ exports.getServiceToken = getServiceToken;
 exports.callBilling = callBilling;
 exports.callSkills = callSkills;
 exports.resolveUserIdByEmail = resolveUserIdByEmail;
+exports.resolveUserIdByEmailAnyEnv = resolveUserIdByEmailAnyEnv;
 exports.resolveUserIdByPhone = resolveUserIdByPhone;
 exports.getUserById = getUserById;
 const child_process_1 = require("child_process");
@@ -256,6 +257,24 @@ async function resolveUserIdByEmail(env, email) {
     console.log(`✓ Found user: ${parsed.user_id}`);
     return parsed.user_id;
 }
+/**
+ * Resolve email → userId across all envs, picking the path that exists for
+ * each cloud. AWS (stage/prod) reaches the database over the RDS SSH tunnel
+ * (db-utils.resolveUserId). cn-prod / cn-stage have no tunnel into the Aliyun
+ * VPC-internal RDS, so they resolve via user-auth's internal HTTP lookup
+ * (resolveUserIdByEmail) — the cn dev-skills token carries the
+ * internal:users:write scope that endpoint requires. Lets the entitlement
+ * subcommands support cn the same way grant-subscription already does, without
+ * each call site re-implementing the branch.
+ */
+async function resolveUserIdByEmailAnyEnv(env, email) {
+    if (env === 'cn-prod' || env === 'cn-stage') {
+        return resolveUserIdByEmail(env, email);
+    }
+    const cfg = (0, db_utils_1.getInfisicalConfig)();
+    const token = (0, db_utils_1.getInfisicalToken)(cfg);
+    return (0, db_utils_1.resolveUserId)(email, env, cfg, token);
+}
 /**
  * Resolve a user's id by phone via user-auth's internal lookup endpoint
  * (POST /api/v1/internal/users/lookup with {phone}). Mirrors

package/dist/bin/helpers/confirm-prompt.js

@@ -36,13 +36,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.confirmIfProd = confirmIfProd;
 const readline = __importStar(require("readline"));
 /**
- * On prod, print the resolved action and require typing "yes" to proceed.
- * No-op on stage or when --yes was passed. Exits 1 if user declines.
+ * On a production env, print the resolved action and require typing "yes" to
+ * proceed. Both AWS `prod` and Aliyun `cn-prod` are production — cn-prod must
+ * gate identically or the cn rollout silently loses the prod safety prompt.
+ * No-op on stage / cn-stage or when --yes was passed. Exits 1 if user declines.
  */
+const PROD_ENVS = new Set(['prod', 'cn-prod']);
 async function confirmIfProd(env, actionDescription, skipFlag) {
-    if (env !== 'prod' || skipFlag)
+    if (!PROD_ENVS.has(env) || skipFlag)
         return;
-    console.log(`\n⚠️  About to perform on PROD:\n${actionDescription}\n`);
+    console.log(`\n⚠️  About to perform on ${env.toUpperCase()}:\n${actionDescription}\n`);
     const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
     const answer = await new Promise((resolve) => {
         rl.question('Type "yes" to confirm: ', (a) => { rl.close(); resolve(a.trim()); });

package/dist/bin/helpers/discount/create.js

@@ -24,7 +24,7 @@ Optional:
   --ends <date>            Valid-until
   --max <N>                Max total redemptions (default: unlimited; 1 = single-use)
   --campaign <label>       Grouping label
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -81,7 +81,7 @@ Optional:
 }
 async function runCreate(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Create discount code ${args.code.toUpperCase()} (${args.percentOff}% off)`, args.yes);
     const body = { code: args.code, percentOff: args.percentOff };
     if (args.productKeys)

package/dist/bin/helpers/discount/disable.js

@@ -11,7 +11,7 @@ Required:
   --code <CODE>
 
 Optional:
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -40,7 +40,7 @@ Optional:
 }
 async function runDisable(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Disable discount code ${args.code.toUpperCase()}`, args.yes);
     const res = await (0, billing_http_1.callBilling)(args.env, 'PATCH', `/api/billing/admin/discount-codes/${encodeURIComponent(args.code)}`, { status: 'DISABLED' });
     console.log(`✓ Disabled (HTTP ${res.status}):`);

package/dist/bin/helpers/discount/generate.js

@@ -59,7 +59,7 @@ Optional:
   --products <a,b,...>     Limit to these productKeys
   --starts <date>          Valid-from (YYYY-MM-DD or ISO)
   --ends <date>            Valid-until
-  --env stage|prod         (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
   --yes                    Skip prod confirmation`);
         process.exit(0);
     }
@@ -114,7 +114,7 @@ Optional:
 }
 async function runGenerate(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Generate ${args.count} unique discount codes (${args.percentOff}% off, campaign ${args.campaign})`, args.yes);
     const body = { count: args.count, percentOff: args.percentOff, campaign: args.campaign };
     if (args.productKeys)

package/dist/bin/helpers/discount/list.js

@@ -10,7 +10,7 @@ Optional:
   --campaign <label>       Filter by campaign
   --code <CODE>            Filter by exact code
   --limit <N>              Max rows (default 500, max 1000)
-  --env stage|prod         (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
         process.exit(0);
     }
     const out = { env: 'stage' };
@@ -45,7 +45,7 @@ Optional:
 }
 async function runList(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
     const qs = new URLSearchParams();
     if (args.campaign)
         qs.set('campaign', args.campaign);

package/dist/bin/helpers/entitlement/grant.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runGrant = runGrant;
 const billing_http_1 = require("../billing-http");
 const confirm_prompt_1 = require("../confirm-prompt");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement grant --email <user> --product-key <slug> --justification "..." [options]
@@ -15,7 +14,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy=<clientId>.`);
         process.exit(0);
@@ -57,10 +56,8 @@ Hardcoded server-side: source=ADMIN_GRANT, priceCents=0, currency=USD, grantedBy
 }
 async function runGrant(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     await (0, confirm_prompt_1.confirmIfProd)(args.env, `Action: GRANT product '${args.productKey}' to user ${args.email} (userId=${userId}) on ${args.env.toUpperCase()}\nJustification: ${args.justification}`, args.yes);
     console.log(`\n🎁 Granting ${args.productKey} to ${args.email}...`);
     const res = await (0, billing_http_1.callBilling)(args.env, 'POST', '/api/billing/admin/grant-entitlement', {

package/dist/bin/helpers/entitlement/list.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runList = runList;
 const billing_http_1 = require("../billing-http");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement list --email <user-email> [options]
@@ -11,7 +10,7 @@ Required:
   --email <user-email>             Resolved to userId via user-auth DB
 
 Optional:
-  --env stage|prod                 (default: stage)`);
+  --env stage|prod|cn-prod|cn-stage  (default: stage)`);
         process.exit(0);
     }
     const out = { env: 'stage' };
@@ -36,10 +35,8 @@ Optional:
 }
 async function runList(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     const res = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
     const rows = res.body.entitlements ?? [];
     if (rows.length === 0) {

package/dist/bin/helpers/entitlement/revoke.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runRevoke = runRevoke;
 const billing_http_1 = require("../billing-http");
 const confirm_prompt_1 = require("../confirm-prompt");
-const db_utils_1 = require("../db-utils");
 function parseArgs(argv) {
     if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
         console.log(`Usage: optima-entitlement revoke --email <user> --product-key <slug> --reason "..." [options]
@@ -15,7 +14,7 @@ Required:
 
 Optional:
   --yes                            Skip prod confirmation prompt (no-op on stage)
-  --env stage|prod                 (default: stage)
+  --env stage|prod|cn-prod|cn-stage  (default: stage)
 
 Refuses non-ADMIN_GRANT sources (PAYMENT, PARTNER) with source-specific
 error pointing to the right reversal flow.`);
@@ -60,10 +59,8 @@ const PAYMENT_REFUSAL = `refusing to revoke a PAYMENT-source entitlement via CLI
 const PARTNER_REFUSAL = `refusing to revoke a PARTNER-source entitlement via CLI; PARTNER grants are issued out-of-band and must be reversed via the partner contract / process that issued them. Manual psql is the escape hatch if absolutely necessary.`;
 async function runRevoke(argv) {
     const args = parseArgs(argv);
-    (0, billing_http_1.validateEnv)(args.env);
-    const cfg = (0, db_utils_1.getInfisicalConfig)();
-    const token = (0, db_utils_1.getInfisicalToken)(cfg);
-    const userId = await (0, db_utils_1.resolveUserId)(args.email, args.env, cfg, token);
+    (0, billing_http_1.validateEnvCnProd)(args.env);
+    const userId = await (0, billing_http_1.resolveUserIdByEmailAnyEnv)(args.env, args.email);
     // Step 1: Fetch user's entitlements
     const listRes = await (0, billing_http_1.callBilling)(args.env, 'GET', `/api/billing/admin/entitlements?userId=${encodeURIComponent(userId)}`);
     const all = listRes.body.entitlements ?? [];

package/dist/bin/helpers/logs.js

@@ -0,0 +1,207 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * optima-logs —— 一条命令直取服务日志,四环境统一,用 --env 区分。
+ *
+ *   stage / prod     : AWS CloudWatch(`aws logs tail /ecs/<svc>-<env>`)
+ *   cn-prod / cn-stage: 阿里云 SLS 直连(`aliyun sls GetLogs`)
+ *
+ * cn 的关键改进:旧流程要 SSH 进 buildbox 再调 SAE `DescribeInstanceLog`,
+ * 只能看实例**当前缓冲**(重启即丢、不能检索)。现在 cn-prod/cn-stage 全部
+ * 服务已接 SLS,GetLogs 是公网控制面 API,本机 `aliyun-optima` profile 直连即可:
+ *   - 免 buildbox 跳板
+ *   - 支持时间窗(--since)+ 关键词检索(--grep)+ 历史(重启不丢)
+ *
+ * 前置:
+ *   AWS  → 已配 aws CLI 凭证(ap-southeast-1)
+ *   cn   → 已配 aliyun CLI profile `aliyun-optima`(cn-beijing)
+ *
+ * 用法:
+ *   optima-logs gateway-core                       # 默认 cn-prod,最近 1h,100 行
+ *   optima-logs gateway-core --env cn-stage
+ *   optima-logs user-auth --env prod --since 2h
+ *   optima-logs commerce-backend --grep error -n 200
+ *   optima-logs gateway-core --since 30m --json     # 机器可读
+ *
+ * service == SLS logstore == AWS 日志组 `/ecs/<svc>-<env>` 的 <svc>(同名)。
+ */
+const child_process_1 = require("child_process");
+const ALIYUN_ACCOUNT = '1911493506120573';
+const ALIYUN_PROFILE = 'aliyun-optima';
+const ALIYUN_REGION = 'cn-beijing';
+const AWS_REGION = 'ap-southeast-1';
+const AWS_ENVS = ['stage', 'prod'];
+const CN_ENVS = ['cn-prod', 'cn-stage'];
+const ALL_ENVS = [...AWS_ENVS, ...CN_ENVS];
+const C = { g: '\x1b[32m', y: '\x1b[33m', b: '\x1b[34m', d: '\x1b[2m', n: '\x1b[0m' };
+const HELP = `Usage: optima-logs <service> [options]
+
+四环境统一查日志,cn 直连阿里云 SLS(免 buildbox),AWS 走 CloudWatch。
+
+Required:
+  <service>                服务名(== SLS logstore == /ecs/<svc>-<env> 的 <svc>)
+
+Optional:
+  --env <e>                stage | prod | cn-prod | cn-stage   (default: cn-prod)
+  --lines, -n <N>          返回行数                            (default: 100)
+  --since <dur>            时间窗,如 30m / 2h / 1d / 3600(秒)  (default: 1h)
+  --grep <kw>              关键词检索(cn=SLS query / aws=filter-pattern)
+  --json                   原始 JSON 输出(接管道)
+  --help, -h               显示本帮助
+
+Examples:
+  optima-logs gateway-core
+  optima-logs user-auth --env prod --since 2h
+  optima-logs commerce-backend --env cn-prod --grep error -n 200`;
+/** 把 30m / 2h / 1d / 纯秒 解析成秒数;同时回填给 aws 用的带单位字符串。 */
+function parseSince(raw) {
+    const m = raw.match(/^(\d+)([smhdw]?)$/);
+    if (!m)
+        throw new Error(`--since 格式非法: ${raw}(用 30m / 2h / 1d / 纯秒)`);
+    const n = parseInt(m[1], 10);
+    const unit = m[2] || 's';
+    const mult = { s: 1, m: 60, h: 3600, d: 86400, w: 604800 };
+    return { sec: n * mult[unit], awsStr: `${n}${unit}` };
+}
+function parseArgs(argv) {
+    if (argv.length === 0 || argv[0] === '-h' || argv[0] === '--help') {
+        console.log(HELP);
+        process.exit(0);
+    }
+    const out = { env: 'cn-prod', lines: 100, since: '1h', json: false };
+    const positional = [];
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = argv[i + 1];
+        switch (a) {
+            case '--env':
+                out.env = next;
+                i++;
+                break;
+            case '--lines':
+            case '-n': {
+                const v = parseInt(next, 10);
+                if (isNaN(v) || v <= 0)
+                    throw new Error('--lines 需要正整数');
+                out.lines = v;
+                i++;
+                break;
+            }
+            case '--since':
+                out.since = next;
+                i++;
+                break;
+            case '--grep':
+                out.grep = next;
+                i++;
+                break;
+            case '--json':
+                out.json = true;
+                break;
+            default:
+                if (a.startsWith('-'))
+                    throw new Error(`未知参数: ${a}`);
+                positional.push(a);
+        }
+    }
+    if (positional.length === 0)
+        throw new Error('缺少 <service>(见 --help)');
+    if (positional.length > 1)
+        throw new Error(`多余参数: ${positional.slice(1).join(' ')}`);
+    out.service = positional[0];
+    if (!ALL_ENVS.includes(out.env)) {
+        throw new Error(`--env 非法: ${out.env}(可选 ${ALL_ENVS.join(' | ')})`);
+    }
+    return out;
+}
+function run(cmd, args) {
+    return (0, child_process_1.execFileSync)(cmd, args, { encoding: 'utf-8', maxBuffer: 128 * 1024 * 1024 });
+}
+/** AWS CloudWatch:aws logs tail /ecs/<svc>-<env>。 */
+function fetchAws(args) {
+    const group = `/ecs/${args.service}-${args.env}`;
+    const { awsStr } = parseSince(args.since);
+    const cmd = ['logs', 'tail', group, '--since', awsStr, '--region', AWS_REGION, '--format', args.json ? 'json' : 'short'];
+    if (args.grep)
+        cmd.push('--filter-pattern', args.grep);
+    process.stderr.write(`${C.d}# AWS CloudWatch ${group} (since ${awsStr}${args.grep ? `, grep "${args.grep}"` : ''})${C.n}\n`);
+    try {
+        process.stdout.write(run('aws', cmd));
+    }
+    catch (e) {
+        if (/ResourceNotFoundException/.test(e.stderr || e.message || '')) {
+            throw new Error(`日志组不存在: ${group}\n  确认服务名/环境对,或该服务未部署在 ${args.env}。`);
+        }
+        throw new Error(e.stderr || e.message);
+    }
+}
+/** 阿里云 SLS:aliyun sls GetLogs,project=optima-<env>-<account>,logstore=service。 */
+function fetchCn(args) {
+    const project = `optima-${args.env}-${ALIYUN_ACCOUNT}`;
+    const { sec } = parseSince(args.since);
+    const now = Math.floor(Date.now() / 1000);
+    const from = now - sec;
+    const cmd = [
+        'sls', 'GetLogs',
+        '--project', project,
+        '--logstore', args.service,
+        '--from', String(from),
+        '--to', String(now),
+        '--line', String(args.lines),
+        '--reverse', 'true', // 先拿最新 N 条
+        '--region', ALIYUN_REGION,
+        '--profile', ALIYUN_PROFILE,
+    ];
+    if (args.grep) {
+        cmd.push('--query', args.grep);
+    }
+    process.stderr.write(`${C.d}# 阿里云 SLS ${project}/${args.service} (since ${args.since}${args.grep ? `, query "${args.grep}"` : ''})${C.n}\n`);
+    let raw;
+    try {
+        raw = run('aliyun', cmd);
+    }
+    catch (e) {
+        const msg = e.stderr || e.message || '';
+        if (/LogStoreNotExist|ProjectNotExist/.test(msg)) {
+            throw new Error(`SLS logstore 不存在: ${project}/${args.service}\n  确认服务名对,或该服务未接 SLS。列全部:\n  aliyun sls ListLogStores --project ${project} --region ${ALIYUN_REGION} --profile ${ALIYUN_PROFILE}`);
+        }
+        throw new Error(msg);
+    }
+    const rows = JSON.parse(raw || '[]');
+    // reverse=true 取到的是新→旧,翻回旧→新便于阅读
+    rows.reverse();
+    if (args.json) {
+        console.log(JSON.stringify(rows, null, 2));
+        return;
+    }
+    if (rows.length === 0) {
+        process.stderr.write(`${C.y}(无日志:该时间窗内 ${args.service} 无输出,或 --grep 没命中)${C.n}\n`);
+        return;
+    }
+    for (const r of rows) {
+        // SLS 存的 content 已含容器时间戳 + stream(stdout/stderr)前缀,直接打印即可
+        process.stdout.write((r.content ?? JSON.stringify(r)) + '\n');
+    }
+}
+function main() {
+    let args;
+    try {
+        args = parseArgs(process.argv.slice(2));
+    }
+    catch (e) {
+        console.error(`${C.y}✗ ${e.message}${C.n}`);
+        process.exit(1);
+    }
+    try {
+        if (CN_ENVS.includes(args.env))
+            fetchCn(args);
+        else
+            fetchAws(args);
+    }
+    catch (e) {
+        console.error(`${C.y}✗ ${e.message}${C.n}`);
+        process.exit(1);
+    }
+}
+main();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {
@@ -9,6 +9,7 @@
     "optima-generate-test-token": "dist/bin/helpers/generate-test-token.js",
     "optima-grant-balance": "dist/bin/helpers/grant-balance.js",
     "optima-grant-subscription": "dist/bin/helpers/grant-subscription.js",
+    "optima-logs": "dist/bin/helpers/logs.js",
     "optima-plugin": "dist/bin/helpers/plugin.js",
     "optima-discount": "dist/bin/helpers/discount.js",
     "optima-product": "dist/bin/helpers/product.js",