@shubao-ai/shubao-cli 0.1.1

package/LICENSE

@@ -0,0 +1,3 @@
+MIT License
+
+Copyright (c) 2026 Shubao AI

package/README.md

@@ -0,0 +1,28 @@
+# shubao
+
+数宝小助手
+
+## 使用
+
+### 方式一（推荐：npx 即用）
+
+```bash
+npx @shubao-ai/shubao-cli
+```
+
+### 方式二（全局安装重复使用）
+
+```bash
+npm install -g @shubao-ai/shubao-cli
+shubao
+```
+
+## 命令
+
+```bash
+shubao init                    # 初始化服务地址
+shubao auth                    # 登录认证
+shubao account status          # 查看账户与积分
+shubao doctor                  # 环境诊断
+shubao --help                  # 查看完整帮助
+```

package/dist/src/api/account.js

@@ -0,0 +1,2 @@
+export async function getAccount(client, key) { return client.request("/api/v1/market/account", key); }
+export async function getBalance(client, key) { return client.request("/api/v1/market/account/balance", key); }

package/dist/src/api/client.js

@@ -0,0 +1,21 @@
+export class APIError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.code = code;
+        this.status = status;
+    }
+}
+import { normalizeServerURL } from "../config/server-url.js";
+export class Client {
+    server;
+    constructor(server) { this.server = normalizeServerURL(server); }
+    async request(path, token, init = {}) {
+        const res = await fetch(new URL(path, this.server), { ...init, headers: { "Content-Type": "application/json", ...(token ? { Authorization: `Bearer ${token}` } : {}), ...(init.headers ?? {}) } });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok || (body.code !== undefined && body.code !== 0))
+            throw new APIError(String(body.code ?? res.status), body.message ?? `HTTP ${res.status}`, res.status);
+        return (body.data ?? body);
+    }
+}

package/dist/src/api/execution.js

@@ -0,0 +1,12 @@
+export async function getMarketAsset(client, key, assetID) {
+    return client.request(`/api/v1/market/assets/${encodeURIComponent(assetID)}`, key);
+}
+export async function createExecutionQuote(client, runtimeToken, assetID, snapshotID, input) {
+    return client.request(`/api/v1/market/assets/${encodeURIComponent(assetID)}/execution-quotes`, runtimeToken, { method: "POST", body: JSON.stringify({ snapshot_id: snapshotID, input }) });
+}
+export async function createExecution(client, runtimeToken, assetID, quoteID, idempotencyKey, input) {
+    return client.request(`/api/v1/market/assets/${encodeURIComponent(assetID)}/executions`, runtimeToken, { method: "POST", body: JSON.stringify({ quote_id: quoteID, idempotency_key: idempotencyKey, input }) });
+}
+export async function getExecution(client, runtimeToken, runID) {
+    return client.request(`/api/v1/market/executions/${encodeURIComponent(runID)}`, runtimeToken);
+}

package/dist/src/api/runtime.js

@@ -0,0 +1,3 @@
+export async function bootstrapDevice(client, key) { return client.request("/api/v1/runtime/devices/bootstrap", key, { method: "POST", body: JSON.stringify({ device_name: `${process.platform} shubao-cli`, platform: process.platform, arch: process.arch, client_name: "shubao-cli", client_version: "0.1.1" }) }); }
+export async function revokeBootstrapDevice(client, key, deviceID) { await client.request(`/api/v1/runtime/devices/bootstrap/${encodeURIComponent(deviceID)}`, key, { method: "DELETE" }); }
+export async function exchangeRuntimeToken(client, refresh) { return client.request("/api/v1/runtime/access-tokens", undefined, { method: "POST", headers: { Authorization: `Device ${refresh}` } }); }

package/dist/src/app.js

@@ -0,0 +1,181 @@
+import { banner } from "./ui/banner.js";
+import { mainMenu } from "./ui/main-menu.js";
+import { DEFAULT_SERVER, loadConfig } from "./config/config.js";
+import { FileCredentialStore } from "./storage/credential-store.js";
+import { authInteractive, authStatus, revokeLocal, authJSONMessage, authSuccessMessage } from "./commands/auth.js";
+import { doctor } from "./commands/doctor.js";
+import { formatAccountStatus, getAccountStatus } from "./commands/account.js";
+import { runAsset } from "./commands/run.js";
+import { init } from "./commands/init.js";
+import { normalizeServerURL } from "./config/server-url.js";
+import { ShellProfileStore } from "./storage/env-store.js";
+import { redact } from "./auth/key-format.js";
+import { confirm, input } from "@inquirer/prompts";
+const dim = "\u001B[2m";
+const reset = "\u001B[0m";
+const clear = "\u001B[2J";
+const home = "\u001B[H";
+const help = `数宝小助手
+
+命令：
+  shubao init                    初始化服务地址
+  shubao auth [--stdin]          登录认证（--stdin 从标准输入读 API Key）
+  shubao auth status             查看登录状态
+  shubao auth revoke             清除本地凭证（不影响服务端 API Key）
+  shubao account status [--json] 查看账户与积分余额
+  shubao run <asset-id> --input <json> [--yes] [--idempotency-key <key>] [--json]
+                                 执行指定资产（按冻结价格扣点）
+  shubao doctor                  环境与健康检查
+  shubao --server <url> <command>  临时指定服务端地址
+
+常用选项：
+  --json            以 JSON 输出（account status / run）
+  --yes             跳过价格确认直接执行（run）
+  --storage <类型>  凭证存储位置：config（默认）| env
+  -v, --version     显示版本号
+  -h, --help        显示本帮助
+
+用法：
+  npx @shubao-ai/shubao-cli          一次性执行（推荐）
+  npm install -g @shubao-ai/shubao-cli  全局安装后直接用 shubao`;
+export async function run(argv) {
+    const version = "0.1.1";
+    let args = [...argv];
+    let serverOverride;
+    const pos = args.indexOf("--server");
+    if (pos >= 0) {
+        serverOverride = args[pos + 1];
+        args.splice(pos, 2);
+    }
+    if (args.includes("--version") || args.includes("-v"))
+        return void console.log(version);
+    if (args.includes("--help") || args.includes("-h"))
+        return void console.log(help);
+    const config = await loadConfig();
+    const server = normalizeServerURL(serverOverride || process.env.SHUBAO_API_BASE_URL || config.server || DEFAULT_SERVER);
+    const store = new FileCredentialStore();
+    if (args[0] === "init")
+        return void console.log(await init());
+    if (args[0] === "account" && (!args[1] || args[1] === "status")) {
+        const value = await getAccountStatus(server, store);
+        return void console.log(args.includes("--json") ? JSON.stringify(value) : formatAccountStatus(value));
+    }
+    if (args[0] === "run") {
+        const assetID = args[1];
+        const rawInput = readOption(args, "--input");
+        if (!assetID || !rawInput)
+            throw new Error("用法：shubao run <asset-id> --input <json>");
+        let input;
+        try {
+            input = JSON.parse(rawInput);
+        }
+        catch {
+            throw new Error("--input 必须是 JSON 对象");
+        }
+        if (!input || Array.isArray(input) || typeof input !== "object")
+            throw new Error("--input 必须是 JSON 对象");
+        const result = await runAsset(server, store, assetID, input, { yes: args.includes("--yes"), idempotencyKey: readOption(args, "--idempotency-key"), confirm: async (price) => confirm({ message: `本次执行将按冻结价格扣除 ${price} 点，是否继续？`, default: false }) });
+        if (!result)
+            return void console.log("已取消，未创建 Execution。");
+        return void console.log(args.includes("--json") ? JSON.stringify(result) : `Execution：${result.execution.id}\n状态：${result.execution.status}\n冻结价格：${result.price_points} 点\n结果：${JSON.stringify(result.execution.output_json ?? {})}`);
+    }
+    if (args[0] === "auth" && args[1] === "status")
+        return void console.log(await authStatus(server, store));
+    if (args[0] === "auth" && args[1] === "revoke") {
+        const storage = readOption(args, "--storage") ?? "all";
+        if (storage !== "config" && storage !== "env" && storage !== "all")
+            throw new Error("--storage 仅支持 config、env 或 all");
+        await revokeLocal(server, store, storage);
+        return void console.log("已删除指定本地凭证；未撤销服务端 API Key。");
+    }
+    if (args[0] === "auth") {
+        const storage = readOption(args, "--storage") ?? "config";
+        if (storage !== "config" && storage !== "env")
+            throw new Error("--storage 仅支持 config 或 env");
+        const stdin = args.includes("--stdin");
+        if (storage === "env") {
+            const allowed = stdin ? args.includes("--allow-plaintext-env-storage") : await confirm({ message: "警告：API Key 将以明文保存在 Shell 配置中。是否继续？", default: false });
+            if (!allowed)
+                throw Object.assign(new Error("已取消明文环境变量存储"), { code: "PLAINTEXT_ENV_STORAGE_NOT_CONFIRMED" });
+        }
+        const key = stdin ? (await readStdin()).trim() : "";
+        const json = args.includes("--json");
+        return void console.log(key ? (await authFromKey(server, key, store, storage, json)) : await authInteractive(server, store, storage, new ShellProfileStore()));
+    }
+    if (args[0] === "doctor")
+        return void (await doctor(server, store)).forEach((line) => console.log(line));
+    await interactiveLoop(server, store);
+}
+// 交互式主菜单：只有用户选择「退出」才会结束。
+// 每轮操作结果展示后，等用户按回车再清屏回到干净的主菜单——像终端本身一样，
+// 屏幕只显示当前这一轮，不堆积历史。
+async function interactiveLoop(server, store) {
+    while (true) {
+        // 清屏 + 打印 banner，让每轮都从干净屏幕开始。
+        process.stdout.write(`${clear}${home}`);
+        console.log(banner());
+        const status = await readLocalLoginStatus(server, store);
+        const choice = await mainMenu(status);
+        if (choice === "exit") {
+            console.log("👋 再见！");
+            return;
+        }
+        console.log();
+        try {
+            if (choice === "auth") {
+                if (status && !(await confirm({ message: `已登录 ${status.account}（${status.apiKeyPrefix}），重新认证将覆盖现有凭证。是否继续？`, default: false }))) {
+                    console.log(`${dim}已取消，保留现有凭证。${reset}`);
+                }
+                else {
+                    console.log(await authInteractive(server, store));
+                }
+            }
+            else if (choice === "doctor") {
+                (await doctor(server, store)).forEach((line) => console.log(line));
+            }
+        }
+        catch (error) {
+            const code = error.code ?? "";
+            if (code === "USER_CANCELLED" || code === "PLAINTEXT_ENV_STORAGE_NOT_CONFIRMED") {
+                console.log(`${dim}已取消。${reset}`);
+            }
+            else {
+                console.log(`${dim}操作失败：${error.message ?? "未知错误"}${reset}`);
+            }
+        }
+        // 结果展示完，等用户确认后再清屏回菜单——避免还没看完就被刷掉。
+        await waitForReturn(`${dim}按回车返回主菜单…${reset}`);
+    }
+}
+// 读本地凭证并查一次账户名，用于在主菜单展示当前登录状态。
+// 网络失败时退化为只显示脱敏 Key 前缀，不影响进菜单。
+async function readLocalLoginStatus(server, store) {
+    try {
+        const envKey = process.env.SHUBAO_API_KEY?.trim() || null;
+        const configKey = await store.getApiKey(server);
+        const key = envKey ?? configKey;
+        if (!key)
+            return null;
+        const apiKeyPrefix = redact(key);
+        try {
+            const account = await getAccountStatus(server, store);
+            const name = account.account.display_name ?? account.account.nickname ?? account.account.name ?? "已认证账户";
+            return { account: name, apiKeyPrefix };
+        }
+        catch {
+            return { account: envKey ? "环境变量凭证" : "已认证账户", apiKeyPrefix };
+        }
+    }
+    catch {
+        return null;
+    }
+}
+function readOption(args, name) { const index = args.indexOf(name); return index >= 0 ? args[index + 1] : undefined; }
+async function authFromKey(server, key, store, storage, json = false) { const { authenticate } = await import("./commands/auth.js"); const envStore = new ShellProfileStore(); const result = await authenticate(server, key, store, storage, envStore); if (json)
+    return authJSONMessage(storage, envStore); return authSuccessMessage(result.account, result.deviceId, key, storage, envStore); }
+async function readStdin() { const chunks = []; for await (const chunk of process.stdin)
+    chunks.push(Buffer.from(chunk)); return Buffer.concat(chunks).toString("utf8"); }
+// 等用户按一次回车再继续。用 inquirer 的 input 接管 stdin，避免与菜单抢输入。
+async function waitForReturn(hint) {
+    await input({ message: hint, default: "" });
+}

package/dist/src/auth/key-format.js

@@ -0,0 +1,10 @@
+export function parseHelperKey(value) {
+    const match = /^sbk_([A-Za-z0-9]{4,32})_([A-Za-z0-9]{24,128})$/.exec(value.trim());
+    return match ? { publicId: match[1], secret: match[2] } : null;
+}
+export function redact(value) {
+    const clean = value.trim();
+    if (clean.length < 8)
+        return "[REDACTED]";
+    return `${clean.slice(0, 4)}_****${clean.slice(-4)}`;
+}

package/dist/src/auth/redaction.js

@@ -0,0 +1,7 @@
+export function redactText(value) {
+    return value
+        .replace(/sbk_[A-Za-z0-9]+_[A-Za-z0-9]+/g, "sbk_****")
+        .replace(/rt_[A-Za-z0-9]+/g, "rt_****")
+        .replace(/rr_[A-Za-z0-9]+/g, "rr_****")
+        .replace(/(Authorization|Bearer|Cookie)\s*[: ]\s*[^\s]+/gi, "$1: [REDACTED]");
+}

package/dist/src/auth/runtime-token.js

@@ -0,0 +1,14 @@
+import { exchangeRuntimeToken } from "../api/runtime.js";
+// Runtime tokens live in memory only. They are refreshed once near expiry and
+// never written to disk or a target application's configuration.
+export class RuntimeTokenCache {
+    cached;
+    async get(client, refreshSecret) {
+        if (this.cached && this.cached.expiresAt - Date.now() > 60_000)
+            return this.cached.token;
+        const next = await exchangeRuntimeToken(client, refreshSecret);
+        this.cached = { token: next.access_token, expiresAt: Date.parse(next.expires_at) };
+        return next.access_token;
+    }
+    clear() { this.cached = undefined; }
+}

package/dist/src/commands/account.js

@@ -0,0 +1,16 @@
+import { Client } from "../api/client.js";
+import { getAccount, getBalance } from "../api/account.js";
+import { RuntimeTokenCache } from "../auth/runtime-token.js";
+import { loadConfig } from "../config/config.js";
+import { loadRuntimeCredentials } from "./credentials.js";
+export async function getAccountStatus(server, store, cache = new RuntimeTokenCache()) {
+    const client = new Client(server);
+    const credentials = await loadRuntimeCredentials(server, store);
+    const [account, balance, config] = await Promise.all([getAccount(client, credentials.apiKey), getBalance(client, credentials.apiKey), loadConfig()]);
+    await cache.get(client, credentials.refreshSecret);
+    return { account, balance, credential_source: credentials.source, api_key_prefix: credentials.apiKeyPrefix, device_id: config.deviceId, runtime_token_exchange: "available" };
+}
+export function formatAccountStatus(value) {
+    const name = value.account.display_name ?? value.account.nickname ?? value.account.name ?? "已验证用户";
+    return `账户：${name}\n账户状态：${value.account.status ?? "unknown"}\n凭证来源：${value.credential_source}\nAPI Key：${value.api_key_prefix}\nRuntime Device：${value.device_id ? `已登记（${value.device_id}）` : "未登记"}\npoints：${value.balance.points}\nRuntime Token Exchange：可用`;
+}

package/dist/src/commands/auth.js

@@ -0,0 +1,84 @@
+import { password } from "@inquirer/prompts";
+import { Client } from "../api/client.js";
+import { getAccount } from "../api/account.js";
+import { bootstrapDevice, revokeBootstrapDevice } from "../api/runtime.js";
+import { parseHelperKey, redact } from "../auth/key-format.js";
+import { clearDeviceConfig, loadConfig, saveConfig } from "../config/config.js";
+import { ShellProfileStore } from "../storage/env-store.js";
+const mint = "\u001B[96m";
+const bold = "\u001B[1m";
+const reset = "\u001B[0m";
+export async function authenticate(server, key, store, source = "config", envStore = new ShellProfileStore(), deps = {}) {
+    if (!parseHelperKey(key))
+        throw Object.assign(new Error("API Key 格式无效"), { code: "KEY_INVALID" });
+    const client = new Client(server);
+    const account = await getAccount(client, key);
+    const bootstrap = await bootstrapDevice(client, key);
+    try {
+        if (source === "config")
+            await store.setApiKey(server, key);
+        await store.setRefreshSecret(server, bootstrap.refresh_secret);
+        if (source === "env")
+            await envStore.write(key, server);
+        const config = { ...(await (deps.loadConfig ?? loadConfig)()), server, deviceId: bootstrap.device.id };
+        await (deps.saveConfig ?? saveConfig)(config);
+    }
+    catch (error) {
+        await Promise.allSettled([store.deleteApiKey(server), store.deleteRefreshSecret(server)]);
+        await (deps.clearDeviceConfig ?? clearDeviceConfig)(server, bootstrap.device.id).catch(() => undefined);
+        if (source === "env")
+            await envStore.revoke().catch(() => undefined);
+        try {
+            await (deps.revokeDevice ?? revokeBootstrapDevice)(client, key, bootstrap.device.id);
+        }
+        catch {
+            (deps.onRollbackWarning ?? (() => console.warn("警告：运行设备撤销未确认，请在账户安全设置中检查。")))();
+        }
+        throw error;
+    }
+    return { account: account.display_name ?? account.nickname ?? account.name ?? "已验证用户", deviceId: bootstrap.device.id };
+}
+export async function authInteractive(server, store, source = "config", envStore = new ShellProfileStore(), deps = {}) {
+    const readSecret = deps.readSecret ?? (() => password({
+        message: "请输入数宝 API 密钥（输入内容将隐藏）",
+        mask: "*",
+        theme: {
+            prefix: { idle: `${mint}  ?${reset}`, done: `${mint}  ✓${reset}` },
+            style: { message: (text) => `${bold}${mint}${text}${reset}` },
+        },
+    }));
+    const key = await readSecret();
+    const result = await authenticate(server, key, store, source, envStore);
+    return authSuccessMessage(result.account, result.deviceId, key, source, envStore);
+}
+export function authSuccessMessage(account, deviceID, key, source, envStore) {
+    const message = `认证成功：${account}，API Key ${redact(key)}，设备 ${deviceID.slice(0, 10)}…`;
+    if (source !== "env" || !envStore)
+        return message;
+    const profile = envStore.path();
+    return `${message}\n已写入 ${profile}。\n请执行：\n${envStore.reloadCommand()}\n或重新打开终端使配置生效。`;
+}
+export function authJSONMessage(source, envStore) {
+    if (source !== "env" || !envStore)
+        return JSON.stringify({});
+    return JSON.stringify({ profile_path: envStore.path(), reload_command: envStore.reloadCommand() });
+}
+export async function authStatus(server, store, deps = {}) {
+    const client = new Client(server);
+    const envKey = process.env.SHUBAO_API_KEY?.trim() || null;
+    const configKey = await store.getApiKey(server);
+    if (envKey && configKey && envKey !== configKey)
+        throw Object.assign(new Error("环境变量与配置文件中的 API 密钥不一致"), { code: "CREDENTIAL_SOURCE_CONFLICT" });
+    const key = envKey ?? configKey;
+    if (!key)
+        return "未配置本地 API 密钥";
+    const account = await getAccount(client, key);
+    const config = await (deps.loadConfig ?? loadConfig)();
+    return `凭证来源：${envKey ? "环境变量" : "配置文件"}\n服务：${client.server}\nAPI Key：${redact(key)}\n账户：${account.display_name ?? account.nickname ?? account.name ?? "已验证"}\n设备：${config.deviceId ? `${config.deviceId.slice(0, 10)}…` : "按需创建"}`;
+}
+export async function revokeLocal(server, store, source = "all", envStore = new ShellProfileStore()) {
+    if (source === "config" || source === "all")
+        await Promise.all([store.deleteApiKey(server), store.deleteRefreshSecret(server)]);
+    if (source === "env" || source === "all")
+        await envStore.revoke();
+}

package/dist/src/commands/credentials.js

@@ -0,0 +1,20 @@
+import { parseHelperKey, redact } from "../auth/key-format.js";
+import { Client } from "../api/client.js";
+import { bootstrapDevice } from "../api/runtime.js";
+export async function loadRuntimeCredentials(server, store) {
+    const envKey = process.env.SHUBAO_API_KEY?.trim() || null;
+    const configKey = await store.getApiKey(server);
+    if (envKey && configKey && envKey !== configKey)
+        throw Object.assign(new Error("环境变量与配置文件中的 API 密钥不一致"), { code: "CREDENTIAL_SOURCE_CONFLICT" });
+    const apiKey = envKey ?? configKey;
+    if (!apiKey)
+        throw Object.assign(new Error("未配置 API 密钥"), { code: "NOT_AUTHENTICATED" });
+    if (!parseHelperKey(apiKey))
+        throw Object.assign(new Error("API Key 格式无效"), { code: "KEY_INVALID" });
+    let refreshSecret = await store.getRefreshSecret(server);
+    if (!refreshSecret) {
+        refreshSecret = (await bootstrapDevice(new Client(server), apiKey)).refresh_secret;
+        await store.setRefreshSecret(server, refreshSecret);
+    }
+    return { apiKey, refreshSecret, source: envKey ? "env" : "config", apiKeyPrefix: redact(apiKey) };
+}

package/dist/src/commands/doctor.js

@@ -0,0 +1,40 @@
+import { Client } from "../api/client.js";
+import { getAccount } from "../api/account.js";
+import { redact } from "../auth/key-format.js";
+import { loadConfig } from "../config/config.js";
+// 诊断只关心两件事：配置文件是否已生成、本地 API Key 是否能通过服务端校验。
+// 服务端地址属于实现细节，不在此暴露给用户。
+export async function doctor(server, store, deps = {}) {
+    const lines = [];
+    // ① 配置文件：init 是否执行过（config.json 是否存在并含服务地址）
+    let configured = false;
+    try {
+        const config = await (deps.loadConfig ?? loadConfig)();
+        configured = Boolean(config.server);
+    }
+    catch { /* 配置文件缺失或损坏，视为未配置 */ }
+    lines.push(configured ? "✓ 已初始化配置" : "✗ 未初始化：请先执行 shubao init");
+    // ② API Key 有效性：合并 env/config 后，调一次服务端验证
+    const envKey = process.env.SHUBAO_API_KEY?.trim() || null;
+    const configKey = await store.getApiKey(server).catch(() => null);
+    if (envKey && configKey && envKey !== configKey) {
+        lines.push("✗ 凭证来源冲突：环境变量与配置文件中的 API Key 不一致");
+        return lines;
+    }
+    const key = envKey ?? configKey;
+    if (!key) {
+        lines.push("✗ 未配置 API Key");
+        return lines;
+    }
+    const client = new Client(server);
+    try {
+        const account = await getAccount(client, key);
+        const name = account.display_name ?? account.nickname ?? account.name ?? "已验证用户";
+        lines.push(`✓ API Key 有效（账户：${name}，${redact(key)}）`);
+    }
+    catch (error) {
+        const message = error.message ?? "未知错误";
+        lines.push(`✗ API Key 校验失败：${message}`);
+    }
+    return lines;
+}

package/dist/src/commands/init.js

@@ -0,0 +1,3 @@
+import { input } from "@inquirer/prompts";
+import { DEFAULT_SERVER, loadConfig, saveConfig } from "../config/config.js";
+export async function init() { const current = await loadConfig(); const server = await input({ message: "服务地址", default: current.server || DEFAULT_SERVER }); await saveConfig({ ...current, server: server.replace(/\/$/, "") }); return `已保存服务地址：${server}`; }

package/dist/src/commands/run.js

@@ -0,0 +1,41 @@
+import { randomUUID } from "node:crypto";
+import { APIError, Client } from "../api/client.js";
+import { createExecution, createExecutionQuote, getExecution, getMarketAsset } from "../api/execution.js";
+import { RuntimeTokenCache } from "../auth/runtime-token.js";
+import { loadRuntimeCredentials } from "./credentials.js";
+async function withRuntimeToken(cache, client, refresh, action) {
+    try {
+        return await action(await cache.get(client, refresh));
+    }
+    catch (error) {
+        if (!(error instanceof APIError) || error.status !== 401)
+            throw error;
+        cache.clear();
+        return action(await cache.get(client, refresh));
+    }
+}
+export async function runAsset(server, store, assetID, input, options) {
+    const client = new Client(server);
+    const credentials = await loadRuntimeCredentials(server, store);
+    const cache = options.cache ?? new RuntimeTokenCache();
+    const asset = await getMarketAsset(client, credentials.apiKey, assetID);
+    const snapshotID = asset.package_snapshot_id ?? asset.snapshot_id;
+    if (!snapshotID)
+        throw Object.assign(new Error("资产没有可执行的已发布 Snapshot"), { code: "ASSET_SNAPSHOT_NOT_FOUND" });
+    const quote = await withRuntimeToken(cache, client, credentials.refreshSecret, (token) => createExecutionQuote(client, token, assetID, snapshotID, input));
+    if (!options.yes && !(await options.confirm?.(quote.price_points)))
+        return null;
+    const idempotencyKey = options.idempotencyKey ?? randomUUID();
+    const created = await withRuntimeToken(cache, client, credentials.refreshSecret, (token) => createExecution(client, token, assetID, quote.quote.id, idempotencyKey, input));
+    let current = created.execution;
+    let steps = [];
+    for (let i = 0; i < 20 && !["succeeded", "failed"].includes(current.status); i++) {
+        await (options.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms))))(250);
+        const status = await withRuntimeToken(cache, client, credentials.refreshSecret, (token) => getExecution(client, token, current.id));
+        current = status.execution;
+        steps = status.steps;
+    }
+    if (!["succeeded", "failed"].includes(current.status))
+        throw Object.assign(new Error("执行轮询超时"), { code: "EXECUTION_TIMEOUT" });
+    return { quote_id: quote.quote.id, price_points: quote.price_points, execution: current, steps };
+}

package/dist/src/config/config.js

@@ -0,0 +1,47 @@
+import { chmod, mkdir, readFile, rename, stat, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { normalizeServerURL } from "./server-url.js";
+export const DEFAULT_SERVER = "https://shubao.wuhuangwansui.cn";
+export class ConfigStore {
+    dir;
+    file;
+    constructor(home = homedir()) { this.dir = join(home, ".config", "shubao-cli"); this.file = join(this.dir, "config.json"); }
+    async load() {
+        try {
+            const parsed = JSON.parse(await readFile(this.file, "utf8"));
+            return { ...parsed, server: normalizeServerURL(parsed.server || DEFAULT_SERVER) };
+        }
+        catch {
+            return { server: DEFAULT_SERVER };
+        }
+    }
+    async save(config) {
+        await mkdir(this.dir, { recursive: true, mode: 0o700 });
+        await chmod(this.dir, 0o700);
+        const tmp = `${this.file}.tmp`;
+        try {
+            await writeFile(tmp, JSON.stringify({ ...config, server: normalizeServerURL(config.server) }), { mode: 0o600 });
+            await rename(tmp, this.file);
+            await chmod(this.file, 0o600);
+        }
+        catch (error) {
+            await unlink(tmp).catch(() => undefined);
+            throw error;
+        }
+    }
+    async clearDevice(server, deviceID) {
+        const current = await this.load();
+        if (current.server !== normalizeServerURL(server) || current.deviceId !== deviceID)
+            return;
+        await this.save({ server: current.server });
+    }
+    async permissions() {
+        const [dir, file] = await Promise.all([stat(this.dir), stat(this.file)]);
+        return { dir: dir.mode & 0o777, file: file.mode & 0o777 };
+    }
+}
+const defaultStore = new ConfigStore();
+export async function loadConfig() { return defaultStore.load(); }
+export async function saveConfig(config) { return defaultStore.save(config); }
+export async function clearDeviceConfig(server, deviceID) { return defaultStore.clearDevice(server, deviceID); }

package/dist/src/config/server-url.js

@@ -0,0 +1,29 @@
+import { isIP } from "node:net";
+export class ServerURLError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+export function normalizeServerURL(value) {
+    if (/[\x00-\x1F\x7F]/.test(value))
+        throw new ServerURLError("INVALID_SERVER_URL", "服务地址不能包含控制字符");
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        throw new ServerURLError("INVALID_SERVER_URL", "服务地址无效");
+    }
+    if (!url.hostname || url.username || url.password || url.search || url.hash || !/^\/*$/.test(url.pathname)) {
+        throw new ServerURLError("INVALID_SERVER_URL", "服务地址只能是无路径的 HTTP(S) 根地址");
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:")
+        throw new ServerURLError("INVALID_SERVER_URL", "服务地址必须使用 HTTP(S)");
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const local = host === "localhost" || host === "::1" || isIP(host) === 4 && host === "127.0.0.1";
+    if (url.protocol === "http:" && !local)
+        throw new ServerURLError("INSECURE_SERVER_URL", "远程服务地址必须使用 HTTPS");
+    return `${url.protocol}//${url.host}`;
+}

package/dist/src/index.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import { run } from "./app.js";
+run(process.argv.slice(2)).catch((error) => {
+    if (error.name === "ExitPromptError" || error.message?.includes("force closed the prompt")) {
+        console.log("\n已取消操作。");
+        process.exitCode = 130;
+        return;
+    }
+    console.error(`数宝小助手错误：${error.message ?? "发生未知错误"}`);
+    process.exitCode = 1;
+});

package/dist/src/storage/credential-store.js

@@ -0,0 +1,31 @@
+import { ConfigStore } from "../config/config.js";
+import { normalizeServerURL } from "../config/server-url.js";
+export class MemoryCredentialStore {
+    values = new Map();
+    key(server, type) { return `${type}:${server}`; }
+    async getApiKey(server) { return this.values.get(this.key(server, "api")) ?? null; }
+    async setApiKey(server, value) { this.values.set(this.key(server, "api"), value); }
+    async deleteApiKey(server) { this.values.delete(this.key(server, "api")); }
+    async getRefreshSecret(server) { return this.values.get(this.key(server, "refresh")) ?? null; }
+    async setRefreshSecret(server, value) { this.values.set(this.key(server, "refresh"), value); }
+    async deleteRefreshSecret(server) { this.values.delete(this.key(server, "refresh")); }
+}
+export class FileCredentialStore {
+    configStore;
+    refreshSecrets = new Map();
+    constructor(configStore = new ConfigStore()) {
+        this.configStore = configStore;
+    }
+    async matchingConfig(server) {
+        const normalizedServer = normalizeServerURL(server);
+        const current = await this.configStore.load();
+        return current.server === normalizedServer ? current : null;
+    }
+    async getApiKey(server) { return (await this.matchingConfig(server))?.apiKey ?? null; }
+    async setApiKey(server, value) { await this.configStore.save({ ...(await this.matchingConfig(server) ?? { server: normalizeServerURL(server) }), apiKey: value }); }
+    async deleteApiKey(server) { const config = await this.matchingConfig(server); if (!config)
+        return; const { apiKey: _, ...rest } = config; await this.configStore.save(rest); }
+    async getRefreshSecret(server) { return this.refreshSecrets.get(normalizeServerURL(server)) ?? null; }
+    async setRefreshSecret(server, value) { this.refreshSecrets.set(normalizeServerURL(server), value); }
+    async deleteRefreshSecret(server) { this.refreshSecrets.delete(normalizeServerURL(server)); }
+}

package/dist/src/storage/env-store.js

@@ -0,0 +1,96 @@
+import { chmod, copyFile, mkdir, readFile, rename, stat, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { parseHelperKey } from "../auth/key-format.js";
+import { normalizeServerURL } from "../config/server-url.js";
+const START = "# >>> shubao helper >>>";
+const END = "# <<< shubao helper <<<";
+const MANAGED = new RegExp(`${escapeRegExp(START)}[\\s\\S]*?${escapeRegExp(END)}\\n?`, "g");
+export class EnvStorageError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+export class ShellProfileStore {
+    home;
+    shell;
+    platform;
+    profilePath;
+    constructor(options = {}) {
+        this.home = options.home ?? homedir();
+        this.shell = options.shell ?? process.env.SHELL ?? "";
+        this.platform = options.platform ?? process.platform;
+        this.profilePath = options.profilePath;
+    }
+    path() {
+        if (this.profilePath)
+            return this.profilePath;
+        if (this.platform === "win32")
+            throw new EnvStorageError("ENV_STORAGE_NOT_IMPLEMENTED_ON_PLATFORM", "Windows 环境变量存储暂未实现");
+        const name = basename(this.shell);
+        if (name === "zsh")
+            return join(this.home, ".zshrc");
+        if (name === "bash")
+            return join(this.home, ".bashrc");
+        throw new EnvStorageError("ENV_STORAGE_SHELL_NOT_SUPPORTED", "仅支持 zsh 或 bash 的环境变量存储");
+    }
+    reloadCommand() {
+        const path = this.path();
+        return `source ${shellQuote(path)}`;
+    }
+    async write(apiKey, server) {
+        if (!parseHelperKey(apiKey) || /[\r\n]/.test(apiKey))
+            throw new EnvStorageError("KEY_INVALID", "API Key 格式无效");
+        const normalizedServer = normalizeServerURL(server);
+        const path = this.path();
+        let existing = "";
+        let mode = 0o600;
+        try {
+            const info = await stat(path);
+            mode = info.mode & 0o777;
+            existing = await readFile(path, "utf8");
+            await copyFile(path, `${path}.shubao-helper.bak`);
+            await chmod(`${path}.shubao-helper.bak`, 0o600);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        const withoutManaged = existing.replace(MANAGED, "").replace(/\n{3,}/g, "\n\n").replace(/\s*$/, "");
+        const block = `${START}\nexport SHUBAO_API_KEY="${apiKey}"\nexport SHUBAO_API_BASE_URL="${normalizedServer}"\n${END}\n`;
+        await atomicWrite(path, `${withoutManaged}${withoutManaged ? "\n\n" : ""}${block}`, Math.min(mode, 0o600));
+        return path;
+    }
+    async revoke() {
+        const path = this.path();
+        let existing;
+        let mode = 0o600;
+        try {
+            const info = await stat(path);
+            mode = info.mode & 0o777;
+            existing = await readFile(path, "utf8");
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return;
+            throw error;
+        }
+        if (!MANAGED.test(existing))
+            return;
+        MANAGED.lastIndex = 0;
+        await copyFile(path, `${path}.shubao-helper.bak`);
+        await chmod(`${path}.shubao-helper.bak`, 0o600);
+        await atomicWrite(path, existing.replace(MANAGED, "").replace(/\n{3,}/g, "\n\n"), Math.min(mode, 0o600));
+    }
+}
+async function atomicWrite(path, content, mode) {
+    await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    const temp = `${path}.shubao-helper.tmp`;
+    await writeFile(temp, content, { encoding: "utf8", mode });
+    await rename(temp, path);
+    await chmod(path, mode);
+}
+function escapeRegExp(value) { return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"); }
+function shellQuote(value) { return `'${value.replace(/'/g, "'\\''")}'`; }

package/dist/src/ui/banner.js

@@ -0,0 +1,45 @@
+const mint = "\u001B[96m";
+const reset = "\u001B[0m";
+const width = 66;
+function visibleWidth(text) {
+    return [...text].reduce((total, character) => total + (/[^\u0000-\u00ff\u2500-\u259f]/u.test(character) ? 2 : 1), 0);
+}
+function center(text) {
+    return " ".repeat(Math.max(0, Math.floor((width - visibleWidth(text)) / 2))) + text;
+}
+function frame(lines) {
+    const border = "═".repeat(width);
+    const content = lines
+        .map((line) => `${mint}  ║${line}${" ".repeat(Math.max(0, width - visibleWidth(line)))}║${reset}`)
+        .join("\n");
+    return `${mint}  ╔${border}╗${reset}\n${content}\n${mint}  ╚${border}╝${reset}`;
+}
+// FIGlet "Standard" font for "SHUBAO", generated with figlet-cli so the
+// glyphs are correct (hand-drawn art previously misspelled the word).
+// Uses only ASCII line characters so it renders uniformly in any
+// monospace terminal, unlike the previous █-block logo which skewed
+// when FULL BLOCK had non-unit width.
+const LOGO_LINES = [
+    "  ____  _   _ _   _ ____    _    ___  ",
+    " / ___|| | | | | | | __ )  / \\  / _ \\ ",
+    " \\___ \\| |_| | | | |  _ \\ / _ \\| | | |",
+    "  ___) |  _  | |_| | |_) / ___ \\ |_| |",
+    " |____/|_| |_|\\___/|____/_/   \\_\\___/ ",
+];
+export function banner() {
+    const logo = LOGO_LINES.map(center);
+    return [
+        "",
+        frame([
+            "",
+            ...logo,
+            "",
+            center("SHUBAO HELPER"),
+            center("数宝小助手  ·  v0.1.1"),
+            "",
+        ]),
+        "",
+        frame(["", center("主菜单"), ""]),
+        "",
+    ].join("\n");
+}

package/dist/src/ui/main-menu.js

@@ -0,0 +1,26 @@
+import { Separator, select } from "@inquirer/prompts";
+const mint = "\u001B[96m";
+const dim = "\u001B[2m";
+const bold = "\u001B[1m";
+const reset = "\u001B[0m";
+export async function mainMenu(status = null) {
+    const statusLine = status ? `${dim}当前已登录：${status.account}（${status.apiKeyPrefix}）${reset}\n  ` : "";
+    return select({
+        message: `${statusLine}${bold}${mint}请选择操作${reset}`,
+        choices: [
+            { name: `  账户与认证${status ? "（重新认证将覆盖现有凭证）" : ""}`, value: "auth" },
+            { name: "  系统诊断", value: "doctor" },
+            new Separator(`${dim}  ─────────────────────────────────${reset}`),
+            { name: "  退出", value: "exit" },
+        ],
+        theme: {
+            prefix: { idle: `${mint}  ?${reset}`, done: `${mint}  ✓${reset}` },
+            icon: { cursor: `${mint}›${reset}` },
+            style: {
+                message: (text) => text,
+                highlight: (text) => `${bold}${mint}${text}${reset}`,
+                keysHelpTip: () => `${dim}  ↑↓ 选择  ·  Enter 确认${reset}`,
+            },
+        },
+    });
+}

package/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "@shubao-ai/shubao-cli",
+  "version": "0.1.1",
+  "description": "数宝小助手",
+  "type": "module",
+  "bin": {
+    "shubao": "./dist/src/index.js"
+  },
+  "files": [
+    "dist/src",
+    "README.md",
+    "LICENSE",
+    "package.json"
+  ],
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --test dist/tests/*.test.js",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "@inquirer/prompts": "^7.8.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "typescript": "^5.7.2"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  }
+}