@shundoo-ai/dsh-cosmic 1.0.19 → 1.0.21

package/skills/cosmic-build/scripts/inspect_platform_sdk.py

@@ -0,0 +1,169 @@
+#!/usr/bin/env python3
+"""Read class signatures or selected bytecode from explicitly supplied target SDK libraries."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import json
+import os
+import re
+import shutil
+import subprocess
+import zipfile
+from pathlib import Path
+
+from appconfig_load import inspect_config
+
+
+class SdkError(ValueError):
+    def __init__(self, code: str, message: str):
+        super().__init__(message)
+        self.code = code
+
+
+def inspect_sdk(jars: list[str], selector: str, members: list[str] | None = None,
+                *, mode: str = "signatures", javap: str | None = None) -> dict:
+    if not re.fullmatch(r"[A-Za-z_$][\w$]*(?:\.[A-Za-z_$][\w$]*)*", selector):
+        raise SdkError("SDK_CLASS_INVALID", "Supply one exact class or simple class name")
+    if mode == "bytecode" and not members:
+        raise SdkError("SDK_MEMBER_REQUIRED", "Bytecode inspection requires at least one --member")
+    if mode not in ("locate", "signatures", "bytecode"):
+        raise SdkError("SDK_MODE_INVALID", "Use locate, signatures, or bytecode")
+    libraries = list(dict.fromkeys(str(Path(item).expanduser().resolve()) for item in jars))
+    if not libraries or len(libraries) > 2000:
+        raise SdkError("SDK_LIBRARY_SCOPE_INVALID", "Supply 1–2000 target SDK JARs or a bounded SDK directory")
+    candidates = []
+    for filename in libraries:
+        file = Path(filename)
+        if not file.is_file() or file.suffix.lower() != ".jar":
+            raise SdkError("SDK_JAR_UNAVAILABLE", f"Target JAR is unavailable: {file}")
+        with zipfile.ZipFile(file) as jar:
+            matches = [name for name in jar.namelist() if name.endswith(".class")
+                       and not name.startswith("META-INF/")
+                       and (name == selector.replace(".", "/") + ".class" if "." in selector
+                            else name.rsplit("/", 1)[-1] == selector + ".class")]
+            if not matches:
+                continue
+            manifest = jar.read("META-INF/MANIFEST.MF").decode("utf-8", "replace") if "META-INF/MANIFEST.MF" in jar.namelist() else ""
+            version = next((line.split(":", 1)[1].strip() for line in manifest.splitlines()
+                            if line.startswith("Implementation-Version:")), None)
+            digest = hashlib.sha256(file.read_bytes()).hexdigest()
+            candidates += [{"class": name[:-6].replace("/", "."), "jarPath": filename,
+                            "jarSha256": digest, "version": version,
+                            "classSha256": hashlib.sha256(jar.read(name)).hexdigest()}
+                           for name in matches]
+    if not candidates:
+        return {"status": False, "errorCode": "SDK_CLASS_NOT_FOUND", "class": selector,
+                "searchedJarCount": len(libraries),
+                "message": "No matching class in the supplied libraries; this does not establish absence from another SDK version"}
+    if len(candidates) != 1:
+        return {"status": False, "errorCode": "SDK_CLASS_AMBIGUOUS", "class": selector,
+                "candidateCount": len(candidates), "candidates": candidates[:50],
+                "message": "Select the exact class and target JAR; no library was chosen automatically"}
+    evidence = {"status": True, "mode": mode, **candidates[0], "searchedJarCount": len(libraries)}
+    if mode == "locate":
+        return evidence
+    config = inspect_config(write_derived=False)
+    configured = Path(str(config.get("JAVA_HOME") or "")) / "bin" / ("javap.exe" if os.name == "nt" else "javap")
+    executable = javap or (str(configured) if configured.is_file() else shutil.which("javap"))
+    if not executable:
+        raise SdkError("SDK_JAVAP_UNAVAILABLE", "javap is unavailable; supply --javap from the target JDK")
+    result = subprocess.run([executable, "-p" if mode == "bytecode" else "-public",
+                             "-c" if mode == "bytecode" else "-s", *([] if mode == "bytecode" else ["-constants"]), "-classpath",
+                             os.pathsep.join(libraries), evidence["class"]],
+                            capture_output=True, text=True, timeout=20, check=False)
+    if result.returncode != 0:
+        return {**evidence, "status": False, "errorCode": "SDK_JAVAP_FAILED",
+                "exitCode": result.returncode, "message": result.stderr.strip()[:1500]}
+    blocks = []
+    lines = result.stdout.splitlines()
+    for line in lines:
+        if re.match(r"^  \S.*;\s*$", line):
+            blocks.append({"declaration": line.strip(), "details": []})
+        elif blocks and line.strip() and line != "}":
+            blocks[-1]["details"].append(line.rstrip())
+    selected = [block for block in blocks if not members or any(
+        re.search(r"(?:^|[ .$])" + re.escape(member) + r"\s*(?:\(|=|;)", block["declaration"])
+        for member in members)]
+    missing = [member for member in members or [] if not any(
+        re.search(r"(?:^|[ .$])" + re.escape(member) + r"\s*(?:\(|=|;)", block["declaration"])
+        for block in selected)]
+    output = {**evidence, "javapPath": str(Path(executable).resolve()),
+              "declaration": next((line for line in lines if line.endswith("{")), ""),
+              "members": selected, "missingDeclaredMembers": missing,
+              "evidenceScope": "Target class declarations or selected bytecode only; inherited members and actual event execution require separate evidence"}
+    if len(json.dumps(output, ensure_ascii=False).encode("utf-8")) > 24 * 1024:
+        return {**evidence, "status": False, "errorCode": "SDK_OUTPUT_TOO_LARGE",
+                "message": "Select fewer --member names; no partial evidence was reported as complete"}
+    return output
+
+
+def inspect_reference(jars: list[str], selector: str, *, listing: bool = False, first_line: int = 1, limit: int = 80) -> dict:
+    if not selector or not 1 <= first_line or not 1 <= limit <= 500:
+        raise SdkError("SDK_REFERENCE_INVALID", "Supply a resource selector, positive first line and limit 1–500")
+    libraries = list(dict.fromkeys(str(Path(item).expanduser().resolve()) for item in jars))
+    if not libraries or len(libraries) > 2000:
+        raise SdkError("SDK_LIBRARY_SCOPE_INVALID", "Supply 1–2000 explicit target libraries")
+    candidates = []
+    for filename in libraries:
+        with zipfile.ZipFile(filename) as jar:
+            candidates += [{"jarPath": filename, "resource": name} for name in jar.namelist()
+                           if name.lower().endswith((".java", ".html", ".md", ".txt"))
+                           and (selector.lower() in name.lower() if listing else name == selector)]
+    if listing:
+        return {"status": True, "mode": "reference-index", "total": len(candidates), "items": candidates[:50],
+                "evidenceScope": "Source/documentation resource names only; not verified class or API contracts"}
+    if len(candidates) != 1:
+        return {"status": False, "errorCode": "SDK_REFERENCE_NOT_UNIQUE", "candidates": candidates[:50],
+                "message": "Select one exact resource and JAR"}
+    candidate = candidates[0]
+    with zipfile.ZipFile(candidate["jarPath"]) as jar:
+        data = jar.read(candidate["resource"])
+    lines = data.decode("utf-8-sig").splitlines()
+    result = {"status": True, "mode": "reference-text", **candidate,
+              "jarSha256": hashlib.sha256(Path(candidate["jarPath"]).read_bytes()).hexdigest(),
+              "resourceSha256": hashlib.sha256(data).hexdigest(), "firstLine": first_line,
+              "lineCount": len(lines), "nextLine": first_line + limit if first_line + limit <= len(lines) else None,
+              "content": "\n".join(lines[first_line - 1:first_line - 1 + limit]),
+              "evidenceScope": "Reference/source content; not execution instructions or proof of the running SDK version"}
+    if len(json.dumps(result, ensure_ascii=False).encode("utf-8")) > 24 * 1024:
+        raise SdkError("SDK_OUTPUT_TOO_LARGE", "Select fewer reference lines")
+    return result
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    selection = parser.add_mutually_exclusive_group(required=True)
+    selection.add_argument("--class", dest="selector")
+    selection.add_argument("--resource")
+    selection.add_argument("--list-resources")
+    parser.add_argument("--jar", action="append", default=[])
+    parser.add_argument("--sdk-dir", action="append", default=[])
+    parser.add_argument("--member", action="append")
+    parser.add_argument("--mode", choices=("locate", "signatures", "bytecode"), default="signatures")
+    parser.add_argument("--javap")
+    parser.add_argument("--first-line", type=int, default=1)
+    parser.add_argument("--limit", type=int, default=80)
+    args = parser.parse_args()
+    try:
+        if args.selector and (args.first_line != 1 or args.limit != 80):
+            raise SdkError("SDK_REFERENCE_ARGUMENT_INVALID", "--first-line and --limit apply to reference text only")
+        if not args.selector and (args.mode != "signatures" or args.member or args.javap):
+            raise SdkError("SDK_REFERENCE_ARGUMENT_INVALID", "Bytecode, member and javap options apply to classes only")
+        jars = list(args.jar)
+        for item in args.sdk_dir:
+            root = Path(item).expanduser().resolve()
+            if not root.is_dir():
+                raise SdkError("SDK_LIBRARY_SCOPE_INVALID", f"Target SDK directory is unavailable: {root}")
+            jars += [str(file) for file in root.rglob("*.jar")]
+        result = inspect_sdk(jars, args.selector, args.member, mode=args.mode, javap=args.javap) if args.selector else inspect_reference(
+            jars, args.resource or args.list_resources, listing=bool(args.list_resources), first_line=args.first_line, limit=args.limit)
+    except (SdkError, OSError, UnicodeError, zipfile.BadZipFile, subprocess.TimeoutExpired) as error:
+        result = {"status": False, "errorCode": getattr(error, "code", "SDK_INSPECTION_FAILED"), "message": str(error)}
+    print(json.dumps(result, ensure_ascii=False))
+    return 0 if result.get("status") is True else 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/skills/cosmic-build/scripts/kd_api.py

@@ -1,15 +1,15 @@
 #!/usr/bin/env python3
-"""业务唯一 API 入口（facade）。
+"""Unified business API entry point (facade).
 
-业务脚本只调 ``kd_api.post/get``，不感知：
-  - 增强型还是普通型
-  - getToken / getAppToken / login 的 URL
-  - accessToken 和 access_token 的差异
-  - x-acgw-identity 如何注入
-  - token 缓存 / 刷新
+Business scripts only call ``kd_api.post/get``, and are unaware of:
+  - enhanced vs. legacy authentication
+  - getToken / getAppToken / login URLs
+  - differences between accessToken and access_token
+  - how x-acgw-identity is injected
+  - token caching / refresh
 
-编排链：kd_env_loader(config 已解密) → kd_auth.get_token → kd_auth.make_auth_headers
-      → _http_client.http_post_json → 401（HTTP 或业务码）强刷重试一次。
+Orchestration chain: kd_env_loader(config decrypted) -> kd_auth.get_token -> kd_auth.make_auth_headers
+      -> _http_client.http_post_json -> 401 (HTTP or business code) force-refresh and retry once.
 """
 
 from __future__ import annotations
@@ -31,10 +31,10 @@ def _resolve_base(base_url: str | None, config: dict) -> str:
 
 def _request_once(url: str, config: dict, token: str, *, method: str,
                   body: dict | None, params: dict | None, style: str) -> dict:
-    """发一次请求 + body 级 401 归一化（HTTP 401 / 业务码 401 → TokenExpiredError）。
+    """Send a single request + body-level 401 normalization (HTTP 401 / business code 401 -> TokenExpiredError).
 
-    瞬态网络错误（SSL/连接重置）由 ``_http_client.retry_call`` 自动重试；
-    认证类失效（401）不被当作瞬态，直接抛 TokenExpiredError 由外层强刷。
+    GET transport failures can retry. POST response loss leaves the write unknown
+    and must never replay automatically. Confirmed auth rejection still permits refresh.
     """
     headers = kd_auth.make_auth_headers(config, token, style=style)
     try:
@@ -48,13 +48,14 @@ def _request_once(url: str, config: dict, token: str, *, method: str,
             )
         else:
             resp = _http_client.retry_call(
-                _http_client.http_post_json, url, body or {}, headers=headers, timeout=60
+                _http_client.http_post_json, url, body or {}, headers=headers, timeout=60,
+                retry_on_transient=False
             )
     except urllib.error.HTTPError as e:
         if e.code == 401:
             raise kd_auth.TokenExpiredError(f"HTTP 401 from {url}") from e
         raise
-    # body 级业务码 401 归一化（苍穹常返回 HTTP 200 + body errorCode=401）
+    # Body-level business code 401 normalization (platform often returns HTTP 200 + body errorCode=401)
     kd_auth.raise_if_token_expired(resp)
     return resp
 
@@ -78,14 +79,14 @@ def post(
     *,
     style: str = "kapi",
 ) -> dict:
-    """POST JSON 到苍穹 API。
+    """POST JSON to the platform API.
 
     Args:
-        base_url: 环境根 URL（如 https://xxx/ierp）；为 None 时回退 config['baseUrl']。
-        path: API 路径，如 "/kapi/v2/devportal/ai-meta/queryForms"。
-        config: server 配置（含 appId/appSecret/accountId/acgwIdentity 等；须已解密）。
-        body: 请求体。
-        style: header 风格；"kapi"→accessToken，"legacy_api"→access_token+api:true。
+        base_url: Environment root URL (e.g. https://xxx/ierp); falls back to config['baseUrl'] when None.
+        path: API path, e.g. "/kapi/v2/devportal/ai-meta/queryForms".
+        config: server configuration (includes appId/appSecret/accountId/acgwIdentity etc.; must be decrypted).
+        body: Request body.
+        style: header style; "kapi"->accessToken, "legacy_api"->access_token+api:true.
     """
     base = _resolve_base(base_url, config)
     return _call_with_retry(base, path, config, method="POST", body=body, params=None, style=style)
@@ -99,13 +100,13 @@ def get(
     *,
     style: str = "kapi",
 ) -> dict:
-    """GET JSON（query 参数）。"""
+    """GET JSON (query parameters)."""
     base = _resolve_base(base_url, config)
     return _call_with_retry(base, path, config, method="GET", body=None, params=params, style=style)
 
 
 def invalidate_cache(config: dict | None = None) -> None:
-    """强制下次调用重新获取 token（认证信息变更后）。"""
+    """Force the next call to re-fetch the token (after auth info changes)."""
     import kd_token_cache
 
     kd_token_cache.invalidate(None)

package/skills/cosmic-build/scripts/kd_auth.py

@@ -89,7 +89,7 @@ def build_app_token_payload(config: dict) -> dict[str, Any]:
 def build_login_payload(config: dict, app_token: str) -> dict[str, Any]:
     """普通型 step2 login.do payload（user/logintype/password/apptoken/tenantid/accountId）。
 
-    logintype='2' + password 为 DeepSeekHarness 环境登录必需（对齐 cosmic-dev 旧版实现）。
+    本地补丁 #7：logintype='2' + password 为 DeepSeekHarness 环境登录必需（上游用 usertype='Mobile'）。
     """
     from kd_env_loader import get_locale
 

package/skills/cosmic-build/scripts/kd_env_loader.py

@@ -45,7 +45,7 @@ def get_ai_output_language() -> str:
 
 
 def _kd_config_path() -> Path:
-    """工作区 .dsh/cosmic/.kd/config.json 优先；缺失时从技能模板自动拷贝（幂等），
+    """本地补丁 #4：工作区 .dsh/cosmic/.kd/config.json 优先；缺失时从技能模板自动拷贝（幂等），
     拷贝失败则回退 ~/.kd/config.json。
 
     per-workspace 凭证：每个 DSH 工作区在 <cwd>/.dsh/cosmic/.kd/config.json 持有一份
@@ -193,9 +193,9 @@ def _build_section(
     """
     section = {
         "baseUrl": _pick_value(source, "url", "baseUrl", default=default_base_url).rstrip("/"),
-        "tenantId": _pick_value(source, "tenantId", "tenantid"),
+        "tenantId": _pick_value(source, "tenantId", "tenantid"),  # 本地补丁 #5：去掉 default="ierp"
         "user": _pick_secret(source, "user", "username"),
-        "password": _pick_secret(source, "password"),
+        "password": _pick_secret(source, "password"),  # 本地补丁 #5
         "loginUser": _pick_secret(source, "username", "user"),
         "userType": _pick_value(source, "usertype", "userType", "user_type", default="Mobile"),
         "appId": _pick_value(source, "client_id", "appId"),
@@ -212,6 +212,16 @@ def _build_section(
     return section
 
 
+def load_environment_identity() -> dict[str, str]:
+    """Read handoff identity without decrypting or retaining credentials."""
+    from test_environment import environment_identity
+    _name, source = _select_default_env(load_kd_config().get("env"))
+    return environment_identity({
+        "baseUrl": _pick_value(source, "url", "baseUrl"),
+        "accountId": _pick_value(source, "accountId"),
+    })
+
+
 @lru_cache(maxsize=1)
 def load_default_kd_env() -> dict[str, Any]:
     kd_config = load_kd_config()
@@ -238,7 +248,7 @@ def load_effective_skill_config(repo_root: Path | None = None) -> dict[str, Any]
         "baseUrl": server_env["baseUrl"],
         "tenantId": server_env["tenantId"],
         "user": server_env["user"],
-        "password": server_env.get("password", ""),
+        "password": server_env.get("password", ""),  # 本地补丁 #6：明文直写
         "loginUser": server_env.get("loginUser", ""),
         "userType": server_env.get("userType", "Mobile"),
         "appId": server_env["appId"],
@@ -291,7 +301,7 @@ def update_default_kd_env(updates: dict[str, Any]) -> list[str]:
         "account_id": "accountId",
         "app_id": "client_id",
         "login_user": "username",
-        "password": "password",
+        "password": "password",  # 本地补丁 #6：明文直写
         "normal_access_token": "normalAccessToken",
     }
     updated: list[str] = []
@@ -302,12 +312,11 @@ def update_default_kd_env(updates: dict[str, Any]) -> list[str]:
         env_entry[new_key] = str(value).strip()
         updated.append(old_key)
 
-    # 明文直写（本机工作区配置、不进 git；避免 Windows 沙箱下加密子进程需提权）
     if updates.get("app_secret") is not None:
-        env_entry["client_secret"] = str(updates["app_secret"]).strip()
+        env_entry["client_secret"] = _encrypt_client_secret(str(updates["app_secret"]).strip())
         updated.append("app_secret")
     if updates.get("acgw_identity") is not None:
-        env_entry["x-acgw-identity"] = str(updates["acgw_identity"]).strip()
+        env_entry["x-acgw-identity"] = _encrypt_secret(str(updates["acgw_identity"]).strip(), "x-acgw-identity")
         updated.append("acgw_identity")
 
     with _kd_config_path().open("w", encoding="utf-8") as handle:
@@ -390,6 +399,7 @@ def update_pdm_kd_config(updates: dict[str, Any]) -> list[str]:
         "account_id": "accountId",
         "app_id": "client_id",
         "login_user": "username",
+        "password": "password",  # 本地补丁 #6：明文直写
         "output": "outputDir",
     }
     updated: list[str] = []
@@ -400,9 +410,8 @@ def update_pdm_kd_config(updates: dict[str, Any]) -> list[str]:
         pdm[new_key] = str(value).strip()
         updated.append(old_key)
 
-    # 明文直写（本机工作区配置、不进 git；避免 Windows 沙箱下加密子进程需提权）
     if updates.get("app_secret") is not None:
-        pdm["client_secret"] = str(updates["app_secret"]).strip()
+        pdm["client_secret"] = _encrypt_client_secret(str(updates["app_secret"]).strip())
         updated.append("app_secret")
 
     with _kd_config_path().open("w", encoding="utf-8") as handle:

package/skills/cosmic-build/scripts/kd_token_cache.py

@@ -57,7 +57,7 @@ def _resolve_project_root() -> str:
 
 
 def _get_env_name() -> str:
-    """从工作区配置 .dsh/cosmic/.kd/config.json 读取 default=true 的环境名，失败返回 'default'。"""
+    """本地补丁 #8：从工作区配置 .dsh/cosmic/.kd/config.json 读取 default=true 的环境名，失败返回 'default'。"""
     try:
         config_path = Path(os.getcwd()) / ".dsh" / "cosmic" / ".kd" / "config.json"
         with open(config_path, "r", encoding="utf-8-sig") as f:
@@ -225,7 +225,7 @@ def put(
     response: dict | None = None,
     ttl_min: int = DEFAULT_TTL_MIN,
 ) -> None:
-    """写入 token（优先加密；加密不可用——如 Windows 沙箱禁子进程——时明文兜底，读取端两者皆可解）。"""
+    """写入 token（本地补丁 #10：优先加密；加密不可用——如 Windows 沙箱禁子进程——时明文兜底，读取端两者皆可解）。"""
     cache = _load_cache() or {"version": CACHE_VERSION, "tokens": {}}
     cache["version"] = CACHE_VERSION
     if response is not None: