@shundoo-ai/dsh-cosmic 1.0.19 → 1.0.21

package/skills/cosmic-build/scripts/_http_client.py

@@ -1,15 +1,15 @@
 #!/usr/bin/env python3
-"""统一 HTTP 客户端 — 默认启用 TLS 证书校验。
+"""Unified HTTP client — TLS certificate verification enabled by default.
 
-TLS 配置来源，优先级从高到低：
-  1. 环境变量（临时排障用，覆盖一切）：
-       KD_INSECURE_TLS=1      禁用 TLS 校验（开发环境使用，启用时 stderr 打印告警）
-       KD_CA_BUNDLE=/path     挂载私有 CA 证书包（自签/私有化环境）
-  2. appconfig.json 的 tls 段（常驻配置，由 appconfig_load.load_tls_config 读取）：
+TLS configuration sources, in descending priority:
+  1. Environment variables (for temporary troubleshooting, overrides everything):
+       KD_INSECURE_TLS=1      Disable TLS verification (for dev environment use; prints warning to stderr when enabled)
+       KD_CA_BUNDLE=/path     Mount private CA certificate bundle (self-signed/privatized environments)
+  2. The ``tls`` block in appconfig.json (persistent config, read by appconfig_load.load_tls_config):
        {"tls": {"insecure": false, "caBundle": "/path/to/ca.pem"}}
-  3. 都没有 → 系统默认 CA 校验（安全兜底）。
+  3. Neither → system default CA verification (secure fallback).
 
-「跳过校验」(insecure) 只有在显式开启时才生效；缺配置一律走校验。
+"Insecure" (skip verification) only takes effect when explicitly enabled; missing config always defaults to verification.
 """
 
 from __future__ import annotations
@@ -32,21 +32,34 @@ DEFAULT_USER_AGENT = (
 
 
 def with_default_user_agent(headers: dict | None = None) -> dict:
-    """Return a headers dict with the repo-standard User-Agent enforced."""
+    """Return a headers dict with the repo-standard User-Agent enforced.
+
+    本地补丁 #2：同时声明 ``Accept-Encoding: gzip``（响应解压见 ``_read_response``）。
+    """
     merged = dict(headers or {})
     merged['User-Agent'] = DEFAULT_USER_AGENT
+    merged.setdefault('Accept-Encoding', 'gzip')
     return merged
 
 
+def _read_response(resp) -> bytes:
+    """读取响应体；服务端返回 gzip 压缩时自动解压（本地补丁 #2）。"""
+    raw = resp.read()
+    content_encoding = (resp.headers.get('Content-Encoding') or '').lower()
+    if content_encoding == 'gzip':
+        return gzip.decompress(raw)
+    return raw
+
+
 def _resolve_tls_settings() -> tuple[bool, str]:
-    """合并 TLS 配置：环境变量优先，其次 appconfig.json，最后安全默认。
+    """Merge TLS config: env vars first, then appconfig.json, then secure default.
 
-    返回 ``(insecure, ca_bundle)``。
+    Returns ``(insecure, ca_bundle)``.
     """
     insecure = False
     ca_bundle = ""
 
-    # 第 2 优先级：appconfig.json 的 tls 段（缺失 / 读取失败时安全默认）
+    # Priority 2: ``tls`` block in appconfig.json (secure default when missing / read fails)
     try:
         from appconfig_load import load_tls_config
 
@@ -56,7 +69,7 @@ def _resolve_tls_settings() -> tuple[bool, str]:
     except Exception:
         pass
 
-    # 第 1 优先级：环境变量覆盖 appconfig
+    # Priority 1: env vars override appconfig
     env_insecure = os.environ.get('KD_INSECURE_TLS', '').strip()
     if env_insecure:
         insecure = env_insecure in ('1', 'true', 'yes', 'on')
@@ -68,17 +81,17 @@ def _resolve_tls_settings() -> tuple[bool, str]:
 
 
 def create_ssl_context() -> ssl.SSLContext:
-    """创建 SSL 上下文，默认启用 TLS 证书校验。
+    """Create an SSL context with TLS certificate verification enabled by default.
 
-    insecure=true 时跳过校验（开发态），打印 stderr 告警。
-    ca_bundle 指向私有 CA 证书包。配置来源见模块 docstring。
+    When insecure=true, skip verification (dev mode), and print a warning to stderr.
+    ca_bundle points to a private CA certificate bundle. See module docstring for config sources.
     """
     insecure, ca_bundle = _resolve_tls_settings()
 
     if insecure:
         print(
-            '[WARNING] TLS 证书校验已禁用 (insecure)。'
-            '凭证可能被中间人攻击截获。',
+            '[WARNING] TLS certificate verification is DISABLED (insecure). '
+            'Credentials may be intercepted via man-in-the-middle attack.',
             file=sys.stderr,
         )
         ctx = ssl.create_default_context()
@@ -89,8 +102,8 @@ def create_ssl_context() -> ssl.SSLContext:
     if ca_bundle:
         if not os.path.exists(ca_bundle):
             print(
-                f'[WARNING] caBundle={ca_bundle} 文件不存在，'
-                f'回退到系统默认 CA 证书。',
+                f'[WARNING] caBundle={ca_bundle} file does not exist, '
+                f'falling back to system default CA certificates.',
                 file=sys.stderr,
             )
         else:
@@ -103,10 +116,10 @@ _ssl_context: ssl.SSLContext | None = None
 
 
 def get_ssl_context() -> ssl.SSLContext:
-    """获取缓存的 SSL 上下文（单例）。
+    """Get the cached SSL context (singleton).
 
-    供直接使用 http.client 的调用方（run.py、search_form_by_token.py）引用；
-    调用方需自行判断 URL scheme 是否为 https 再传入。
+    For callers that use http.client directly (run.py, search_form_by_token.py);
+    callers must check whether the URL scheme is https before passing it in.
     """
     global _ssl_context
     if _ssl_context is None:
@@ -115,22 +128,22 @@ def get_ssl_context() -> ssl.SSLContext:
 
 
 def _ssl_context_for_url(url: str) -> ssl.SSLContext | None:
-    """仅对 HTTPS URL 返回 TLS 校验上下文；HTTP URL 不需要 TLS，返回 None。"""
+    """Return TLS verification context only for HTTPS URLs; HTTP URLs do not need TLS, return None."""
     if url.startswith('https://'):
         return get_ssl_context()
     return None
 
 
 def _is_transient(exc: Exception) -> bool:
-    """判断是否为瞬态网络错误，值得重试。"""
+    """Determine whether this is a transient network error worth retrying."""
     if isinstance(exc, ssl.SSLError):
         return True
     if isinstance(exc, ConnectionError):
         return True
-    # 读超时抛出的是裸的 socket.timeout / TimeoutError，不会被包进 URLError，
-    # 因此下面基于错误信息的分支永远命中不到。读取大型标准单据（例如带上百个
-    # 分录字段的单据 schema）时第一次调用就会触发，过去会直接失败，而同样的
-    # 请求重试一次却能成功。
+    # A read timeout arrives as a bare socket.timeout / TimeoutError, not wrapped in
+    # URLError, so the message-based branch below never saw it. Reading a large standard
+    # bill (for example the schema of a bill with hundreds of entry fields) hits this on the
+    # first call and used to fail outright even though an identical retry succeeds.
     if isinstance(exc, (socket.timeout, TimeoutError)):
         return True
     if isinstance(exc, urllib.error.URLError):
@@ -144,7 +157,7 @@ def _is_transient(exc: Exception) -> bool:
 
 
 def _is_tls_transient(exc: Exception) -> bool:
-    """判断重试前是否需要创建新的 SSLContext。"""
+    """Return whether a retry should use a fresh SSLContext."""
     if isinstance(exc, ssl.SSLError):
         return True
     if isinstance(exc, urllib.error.URLError):
@@ -157,7 +170,7 @@ def _is_tls_transient(exc: Exception) -> bool:
 
 
 def _reset_tls_context_for_retry(exc: Exception) -> None:
-    """SSL/EOF 失败后丢弃缓存的 TLS 会话状态。"""
+    """Drop cached TLS session state after an SSL/EOF failure."""
     global _ssl_context
     if _is_tls_transient(exc):
         _ssl_context = None
@@ -167,31 +180,23 @@ _RETRIES = 3
 _RETRY_DELAY = 1.0
 
 
-def retry_call(fn, *args, **kwargs):
-    """对 fn(*args, **kwargs) 执行瞬态错误自动重试（指数退避）。"""
-    for attempt in range(1, _RETRIES + 1):
+def retry_call(fn, *args, retry_on_transient=True, **kwargs):
+    """Execute fn(*args, **kwargs) with automatic retries on transient errors (exponential backoff)."""
+    attempts = _RETRIES if retry_on_transient else 1
+    for attempt in range(1, attempts + 1):
         try:
             return fn(*args, **kwargs)
         except Exception as exc:
-            if attempt < _RETRIES and _is_transient(exc):
+            if attempt < attempts and _is_transient(exc):
                 _reset_tls_context_for_retry(exc)
                 delay = _RETRY_DELAY * (2 ** (attempt - 1))
-                print(f"[retry {attempt}/{_RETRIES}] {type(exc).__name__}: {exc} — {delay:.0f}s 后重试",
+                print(f"[retry {attempt}/{attempts}] {type(exc).__name__}: {exc} — retrying in {delay:.0f}s",
                       file=sys.stderr)
                 time.sleep(delay)
             else:
                 raise
 
 
-def _read_response(resp) -> bytes:
-    """读取响应体；服务端返回 gzip 压缩时自动解压。"""
-    raw = resp.read()
-    content_encoding = (resp.headers.get('Content-Encoding', '') or '').lower()
-    if content_encoding == 'gzip':
-        return gzip.decompress(raw)
-    return raw
-
-
 def http_post_json(
     url: str,
     data: dict,
@@ -199,13 +204,12 @@ def http_post_json(
     headers: dict | None = None,
     timeout: int = 30,
 ) -> dict:
-    """发送 POST JSON 请求。HTTPS 默认启用 TLS 校验，HTTP 不走 TLS。"""
+    """Send a POST JSON request. HTTPS enables TLS verification by default; HTTP does not use TLS."""
     body = json.dumps(data, ensure_ascii=False).encode('utf-8')
     all_headers = with_default_user_agent({'Content-Type': 'application/json'})
     if headers:
         all_headers.update(headers)
     all_headers['User-Agent'] = DEFAULT_USER_AGENT
-    all_headers['Accept-Encoding'] = 'gzip'
     req = urllib.request.Request(
         url, data=body, headers=all_headers, method='POST',
     )
@@ -221,10 +225,8 @@ def http_get_json(
     headers: dict | None = None,
     timeout: int = 30,
 ) -> dict:
-    """发送 GET JSON 请求。HTTPS 默认启用 TLS 校验，HTTP 不走 TLS。"""
-    all_headers = with_default_user_agent(headers)
-    all_headers['Accept-Encoding'] = 'gzip'
-    req = urllib.request.Request(url, headers=all_headers)
+    """Send a GET JSON request. HTTPS enables TLS verification by default; HTTP does not use TLS."""
+    req = urllib.request.Request(url, headers=with_default_user_agent(headers))
     with urllib.request.urlopen(
         req, timeout=timeout, context=_ssl_context_for_url(url),
     ) as resp:
@@ -237,10 +239,8 @@ def http_get_text(
     headers: dict | None = None,
     timeout: int = 30,
 ) -> str:
-    """发送 GET 请求。HTTPS 默认启用 TLS 校验，HTTP 不走 TLS。"""
-    all_headers = with_default_user_agent(headers)
-    all_headers['Accept-Encoding'] = 'gzip'
-    req = urllib.request.Request(url, headers=all_headers)
+    """Send a GET request. HTTPS enables TLS verification by default; HTTP does not use TLS."""
+    req = urllib.request.Request(url, headers=with_default_user_agent(headers))
     with urllib.request.urlopen(
         req, timeout=timeout, context=_ssl_context_for_url(url),
     ) as resp:

package/skills/cosmic-build/scripts/appconfig_load.py

@@ -5,7 +5,7 @@ Path priority:
 1. KD_APPCONFIG override, for tests or special environments.
 2. Walk upward from this script and stop at the first directory containing both
    config/ and preset-data/; use config/appconfig.json there.
-3. Fallback to the user's home directory: ~/kd/appconfig.json.
+3. Fallback to the workspace: `<cwd>/app/config/appconfig.json`（本地补丁 #3）。
 """
 
 from __future__ import annotations
@@ -25,7 +25,7 @@ def appconfig_path() -> Path:
     config_root = _find_config_root(Path(__file__).resolve())
     if config_root:
         return config_root / "config" / "appconfig.json"
-    # 回退：固定指向工作区 app/config（应用级配置，非 _runtime 运行时临时数据；
+    # 本地补丁 #3：回退固定指向工作区 app/config（应用级配置，非 _runtime 运行时临时数据；
     # 同 kd_env_loader._kd_config_path 的 ws_cfg 模式）
     return Path(os.getcwd()) / "app" / "config" / "appconfig.json"
 

package/skills/cosmic-build/scripts/apply_report_filter_extension.py

@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+"""Apply the versioned typed report filter extension to an explicitly selected platform module."""
+import argparse
+import json
+import subprocess
+from pathlib import Path
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--project-root", required=True)
+    parser.add_argument("--dry-run", action="store_true")
+    args = parser.parse_args()
+    project = Path(args.project_root).resolve()
+    asset = Path(__file__).resolve().parents[1] / "assets" / "platform-report-filters"
+    helper = project / "src" / "main" / "java" / "kd" / "bos" / "designer" / "property" / "setting" / "TypedReportFilterFields.java"
+    if helper.exists() and helper.read_bytes() != (asset / helper.name).read_bytes():
+        print(json.dumps({"status": False, "reason": "existing-helper-differs"})); return 2
+    repo = subprocess.run(["git", "rev-parse", "--show-toplevel"], cwd=project, capture_output=True, text=True, check=True).stdout.strip()
+    directory = project.relative_to(Path(repo).resolve()).as_posix()
+    command = ["git", "apply", "--ignore-whitespace", "--directory=" + directory, str(asset / "platform.patch")]
+    check = subprocess.run([*command[:2], "--check", *command[2:]], cwd=repo, capture_output=True, text=True)
+    if check.returncode:
+        reverse = subprocess.run([*command[:2], "--reverse", "--check", *command[2:]], cwd=repo, capture_output=True, text=True)
+        if reverse.returncode:
+            print(json.dumps({"status": False, "reason": "platform-source-version-mismatch", "diagnostics": check.stderr[-2000:]})); return 2
+        if not helper.exists() and not args.dry_run:
+            helper.write_bytes((asset / helper.name).read_bytes())
+        print(json.dumps({"status": True, "changed": False, "alreadyApplied": True, "dryRun": args.dry_run})); return 0
+    if not args.dry_run:
+        subprocess.run(command, cwd=repo, check=True)
+        helper.parent.mkdir(parents=True, exist_ok=True)
+        helper.write_bytes((asset / helper.name).read_bytes())
+    print(json.dumps({"status": True, "changed": not args.dry_run, "dryRun": args.dry_run, "projectRoot": str(project)}))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skills/cosmic-build/scripts/bootstrap_cosmic_context.py

@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import argparse
+import contextlib
 import json
 import sys
 from pathlib import Path
@@ -22,7 +23,13 @@ from project_paths import (
     write_runtime_context,
 )
 
-from kd_env_loader import get_locale
+from kd_env_loader import get_locale, load_environment_identity
+from execution_binding import execution_binding
+
+if hasattr(sys.stdout, "reconfigure"):
+    sys.stdout.reconfigure(encoding="utf-8", errors="replace")
+if hasattr(sys.stderr, "reconfigure"):
+    sys.stderr.reconfigure(encoding="utf-8", errors="replace")
 
 def _write_json(path: Path, data: dict[str, Any]) -> None:
     path.parent.mkdir(parents=True, exist_ok=True)
@@ -219,7 +226,7 @@ def _sync_locale_only(project_root: Path, output_root_name: str) -> int:
     return 0
 
 
-def main(argv: list[str] | None = None) -> int:
+def _main_impl(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description="Bootstrap app-build runtime context")
     parser.add_argument("--project-root", required=True, help="Workspace root")
     parser.add_argument("--app-code", default="", help="Confirmed app code")
@@ -393,13 +400,16 @@ def main(argv: list[str] | None = None) -> int:
         "standard": bool(standard),
         "appIsv": app_isv,
         "appOwnershipEvidence": ownership_evidence,
+        "environment": load_environment_identity(),
         "rootDir": str(Path(__file__).resolve().parents[1]),
+        "executionBinding": execution_binding(),
         # locale is re-read from ~/.kd/config.json on every bootstrap,
         # ensuring the user's global language switch takes effect immediately
         # (not locked by a stale value in context.json).
         # get_locale() has a built-in fallback (returns 'zh_CN' on error or missing), so it never writes empty.
         "locale": get_locale(),
     }
+    global _BOOTSTRAP_RESULT
     runtime_path = write_runtime_context(project_root, context, output_root_name)
 
     biz_cloud_id = biz_cloud_id_arg
@@ -432,6 +442,9 @@ def main(argv: list[str] | None = None) -> int:
         app_description=str(archive.get("appDescription") or app_description),
     )
 
+    _BOOTSTRAP_RESULT = {"context": str(runtime_path), "archive": str(archive_path),
+                         "workspace": str(workspace_path), "appRoot": str(workspace_path.parents[2]),
+                         "appCode": app_code, "appId": app_id, "executionBinding": execution_binding()}
     print("[OK] bootstrap complete")
     print(f"context={runtime_path}")
     print(f"archive={archive_path}")
@@ -464,11 +477,33 @@ def _print_paths_block(project_root: Path, app_code: str, output_root_name: str,
     runtime_dir = Path(app_root) / "_runtime"
 
     print("[paths]")
+    print(f"revision={execution_binding()['revision']}")
     print(f"python={sys.executable}")
     print(f"cosmic_api={cosmic_api}")
     if ui_api.exists():
         print(f"ui_api={ui_api}")
     print(f"appRoot={app_root}")
     print(f"runtimeDir={runtime_dir}")
+_BOOTSTRAP_RESULT = None
+
+
+def main(argv: list[str] | None = None) -> int:
+    global _BOOTSTRAP_RESULT
+    _BOOTSTRAP_RESULT = None
+    arguments = list(sys.argv[1:] if argv is None else argv)
+    if "--stdout" not in arguments:
+        return _main_impl(arguments)
+    arguments.remove("--stdout")
+    try:
+        with contextlib.redirect_stdout(sys.stderr):
+            code = _main_impl(arguments)
+    except (SystemExit, Exception) as exc:
+        print(json.dumps({"status": False, "errorCategory": "environment",
+                          "message": str(exc), "data": None, "executionBinding": execution_binding()}, ensure_ascii=False))
+        return 2
+    print(json.dumps({"status": code == 0, "data": _BOOTSTRAP_RESULT or {"locale": get_locale()}}, ensure_ascii=False))
+    return code
+
+
 if __name__ == "__main__":
     raise SystemExit(main())