@sovovs/bycli 2.1.0 → 2.1.1

package/dist/src/download/wechat-article.js

@@ -0,0 +1,137 @@
+import { parse, serialize } from 'parse5';
+import { CommandExecutionError } from '../errors.js';
+export const MAX_WECHAT_HTML_BYTES = 10 * 1024 * 1024;
+export const MAX_WECHAT_NODES = 100_000;
+export const MAX_WECHAT_CODE_BLOCKS = 1_000;
+function isElement(node) {
+    return 'tagName' in node;
+}
+function attr(node, name) {
+    return node.attrs.find(item => item.name === name)?.value;
+}
+function hasClass(node, name) {
+    return (attr(node, 'class') || '').split(/\s+/).includes(name);
+}
+function safeUrl(value) {
+    const normalized = value.trim().startsWith('//') ? `https:${value.trim()}` : value.trim();
+    try {
+        const url = new URL(normalized);
+        return url.protocol === 'http:' || url.protocol === 'https:' ? url.href : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function textContent(node) {
+    if ('value' in node)
+        return node.value;
+    if (!('childNodes' in node))
+        return '';
+    return node.childNodes.map(textContent).join('');
+}
+export function extractWechatArticleHtml(html) {
+    if (Buffer.byteLength(html, 'utf8') > MAX_WECHAT_HTML_BYTES) {
+        throw new CommandExecutionError('WeChat article HTML exceeds the 10 MiB limit');
+    }
+    const document = parse(html);
+    let content;
+    let nodes = 0;
+    let codeBlocks = 0;
+    const stack = [document];
+    while (stack.length > 0) {
+        const node = stack.pop();
+        nodes += 1;
+        if (nodes > MAX_WECHAT_NODES)
+            throw new CommandExecutionError('WeChat article HTML exceeds the DOM node limit');
+        if (isElement(node)) {
+            if (attr(node, 'id') === 'js_content')
+                content = node;
+            if (node.tagName === 'pre') {
+                codeBlocks += 1;
+                if (codeBlocks > MAX_WECHAT_CODE_BLOCKS)
+                    throw new CommandExecutionError('WeChat article HTML exceeds the code block limit');
+            }
+        }
+        if ('childNodes' in node) {
+            for (let i = node.childNodes.length - 1; i >= 0; i -= 1)
+                stack.push(node.childNodes[i]);
+        }
+    }
+    if (!content)
+        throw new CommandExecutionError('WeChat article has no #js_content');
+    const parents = [content];
+    while (parents.length > 0) {
+        const parent = parents.pop();
+        parent.childNodes = parent.childNodes.filter(node => {
+            if (!isElement(node))
+                return true;
+            return !['script', 'style'].includes(node.tagName)
+                && !hasClass(node, 'qr_code_pc') && !hasClass(node, 'reward_area')
+                && !hasClass(node, 'code-snippet__line-index');
+        });
+        for (const node of parent.childNodes) {
+            if (isElement(node)) {
+                node.attrs = node.attrs.flatMap(item => {
+                    if (!['href', 'src', 'poster', 'data-src'].includes(item.name))
+                        return [item];
+                    const value = safeUrl(item.value);
+                    return value ? [{ ...item, value }] : [];
+                });
+                if (node.tagName === 'img') {
+                    const lazy = attr(node, 'data-src');
+                    if (lazy) {
+                        node.attrs = node.attrs.filter(item => !['src', 'data-src'].includes(item.name));
+                        node.attrs.push({ name: 'src', value: lazy });
+                    }
+                }
+                if (hasClass(node, 'code-snippet__fix')) {
+                    const descendants = [...node.childNodes].reverse();
+                    let pre;
+                    const lines = [];
+                    while (descendants.length > 0) {
+                        const descendant = descendants.pop();
+                        if (isElement(descendant)) {
+                            if (descendant.tagName === 'pre')
+                                pre = descendant;
+                            if (descendant.tagName === 'code') {
+                                const line = textContent(descendant);
+                                if (!/^[ce]?ounter\(line/.test(line))
+                                    lines.push(line);
+                                continue;
+                            }
+                        }
+                        if ('childNodes' in descendant) {
+                            for (let i = descendant.childNodes.length - 1; i >= 0; i -= 1)
+                                descendants.push(descendant.childNodes[i]);
+                        }
+                    }
+                    if (pre && lines.length > 0) {
+                        pre.childNodes = [{ nodeName: '#text', value: lines.join('\n'), parentNode: pre }];
+                    }
+                }
+                parents.push(node);
+            }
+        }
+    }
+    const imageUrls = [];
+    const seenImages = new Set();
+    const imageStack = [content];
+    while (imageStack.length > 0) {
+        const node = imageStack.pop();
+        if (isElement(node) && node.tagName === 'img') {
+            const src = attr(node, 'src');
+            if (src && !seenImages.has(src)) {
+                seenImages.add(src);
+                imageUrls.push(src);
+            }
+        }
+        if ('childNodes' in node) {
+            for (let i = node.childNodes.length - 1; i >= 0; i -= 1)
+                imageStack.push(node.childNodes[i]);
+        }
+    }
+    const fragment = {
+        nodeName: '#document-fragment', childNodes: content.childNodes,
+    };
+    return { contentHtml: serialize(fragment), imageUrls };
+}

package/dist/src/download/wechat-article.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/recorder/highlevel/verify.d.ts

@@ -29,6 +29,8 @@ export interface VerifyInput {
     trace?: 'off' | 'retain-on-failure' | 'always';
     /** N3:显式 adapter 路径 override —— verify 录制器 LLM 生成的临时草稿(不在 clis/),缺省按 name 派生。 */
     adapterPath?: string;
+    /** Optional lowercase SHA-256 expected for the exact adapter bytes the runner will execute. */
+    expectedSourceSha256?: string;
 }
 /** The runner boundary (08). M6 provides the real child-process implementation. */
 export interface RunnerPort {
@@ -42,6 +44,7 @@ export interface RunnerPort {
         trace: string;
         /** N3: explicit adapter path override (recorder draft verify); default = name→clis path. */
         adapterPath?: string;
+        expectedSourceSha256?: string;
     }): Promise<{
         requestId: string;
     }>;

package/dist/src/recorder/highlevel/verify.js

@@ -49,6 +49,9 @@ export async function verifyAdapter(input, sessionHmacKey, runner) {
         }
         adapterPath = abs;
     }
+    if (input.expectedSourceSha256 !== undefined && !/^[0-9a-f]{64}$/.test(input.expectedSourceSha256)) {
+        return { ok: false, errorCode: 'validation_failed', reason: 'expectedSourceSha256 must be 64 lowercase hex characters' };
+    }
     const port = runner ?? defaultRunnerPort();
     const rawSeedArgs = input.executionSeedArgs ?? {};
     const evidenceSeedArgs = deriveEvidenceSeedArgs(rawSeedArgs, sessionHmacKey);
@@ -61,6 +64,7 @@ export async function verifyAdapter(input, sessionHmacKey, runner) {
             fixture: input.fixture ?? 'ignore',
             trace: input.trace ?? 'retain-on-failure',
             adapterPath, // N3: validated draft path override (undefined → name→clis)
+            expectedSourceSha256: input.expectedSourceSha256,
         });
         return { ok: true, requestId };
     }

package/dist/src/recorder/highlevel/verify.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/recorder/runner/runner-port.js

@@ -252,6 +252,7 @@ export function createRunnerPort(opts = {}) {
                 requestId,
                 name: input.name,
                 adapterPath: input.adapterPath ?? resolveAdapterPath(input.name),
+                expectedSourceSha256: input.expectedSourceSha256,
                 executionSeedArgs: input.rawSeedArgs, // raw → input.json only
                 fixture: input.fixture,
                 trace: input.trace,

package/dist/src/recorder/runner/verify-runner-main.d.ts

@@ -23,6 +23,8 @@ export interface RunnerInput {
     name: string;
     /** Resolved adapter module file to import. */
     adapterPath: string;
+    /** Expected hash supplied by the caller; mismatch means the captured module is never loaded. */
+    expectedSourceSha256?: string;
     /** Browser profile contextId for browser adapters (M6b). Omitted → daemon default profile. */
     contextId?: string;
     /** Raw seed args — prepared before resolver/adapter calls and never echoed into events. */
@@ -47,7 +49,20 @@ export declare function installRunnerBackstops(maxRuntimeMs: number): void;
  * Load an adapter by importing its module (which registers via `cli()`), then look it up
  * in the registry by name. Mirrors execution.ts's lazy-import pattern (118-135).
  */
-export declare function loadAdapterByName(adapterPath: string, name: string): Promise<CliCommand | undefined>;
+export interface AdapterSourceSnapshot {
+    canonicalUrl: string;
+    source: ArrayBuffer;
+    sourceSha256: string;
+}
+/** Read the main module once. The same exact bytes are hashed and transferred to the ESM loader. */
+export declare function captureAdapterSource(adapterPath: string): AdapterSourceSnapshot;
+/** Import exactly the captured main-module bytes while preserving its canonical URL as import base. */
+export declare function loadAdapterSnapshot(snapshot: AdapterSourceSnapshot, name: string): Promise<CliCommand | undefined>;
+export interface VerifyRunnerDependencies {
+    capture?: (adapterPath: string) => AdapterSourceSnapshot | Promise<AdapterSourceSnapshot>;
+    load?: (snapshot: AdapterSourceSnapshot, name: string) => Promise<CliCommand | undefined>;
+    browserRunner?: BrowserAdapterRunner;
+}
 /**
  * The browser-adapter execution seam (M6b). A browser adapter's `func` needs an IPage; the
  * default implementation connects BACK to the running daemon for one. Injectable so unit
@@ -85,7 +100,7 @@ export declare function executeAdapterForVerify(command: CliCommand | undefined,
  * tests); `load` is injected so unit tests can supply an in-memory command. Never throws —
  * any failure becomes a terminal result so the parent always sees one and only one.
  */
-export declare function runVerifyRunner(input: RunnerInput, emit: (event: RunnerEvent) => void, load?: (adapterPath: string, name: string) => Promise<CliCommand | undefined>, browserRunner?: BrowserAdapterRunner): Promise<void>;
+export declare function runVerifyRunner(input: RunnerInput, emit: (event: RunnerEvent) => void, dependencies?: VerifyRunnerDependencies): Promise<void>;
 /**
  * Entry point for `bycli internal verify-runner --jsonl --request-id … --name … --input …`.
  * Writes JSONL events to the dedicated protocol fd (`--protocol-fd`, set by the parent RunnerPort

package/dist/src/recorder/runner/verify-runner-main.js

@@ -16,7 +16,8 @@
  * are echoed into the emitted result/started events.
  */
 import * as fs from 'node:fs';
-import { randomUUID } from 'node:crypto';
+import { createHash, randomUUID } from 'node:crypto';
+import { register } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import { getRegistry, } from '../../registry.js';
 import { prepareCommandArgsOrThrowArgumentError } from '../../execution.js';
@@ -78,14 +79,48 @@ function fieldCountOf(rows) {
     }
     return undefined;
 }
-/**
- * Load an adapter by importing its module (which registers via `cli()`), then look it up
- * in the registry by name. Mirrors execution.ts's lazy-import pattern (118-135).
- */
-export async function loadAdapterByName(adapterPath, name) {
-    const url = pathToFileURL(adapterPath).href; // runner-side; a bad path surfaces verbatim
+const SNAPSHOT_LOADER_URL = `data:text/javascript,${encodeURIComponent(`
+  let targetSpecifier = '';
+  let targetUrl = '';
+  let source = new ArrayBuffer(0);
+  export function initialize(data) {
+    targetSpecifier = data.targetSpecifier;
+    targetUrl = data.targetUrl;
+    source = data.source;
+  }
+  export async function resolve(specifier, context, nextResolve) {
+    if (specifier === targetSpecifier) {
+      return { url: targetUrl, shortCircuit: true };
+    }
+    return nextResolve(specifier, context);
+  }
+  export async function load(url, context, nextLoad) {
+    if (url === targetUrl) {
+      return { format: 'module', shortCircuit: true, source: new Uint8Array(source) };
+    }
+    return nextLoad(url, context);
+  }
+`)}`;
+/** Read the main module once. The same exact bytes are hashed and transferred to the ESM loader. */
+export function captureAdapterSource(adapterPath) {
+    const canonicalPath = fs.realpathSync(adapterPath);
+    const bytes = fs.readFileSync(canonicalPath);
+    const source = Uint8Array.from(bytes).buffer;
+    return {
+        canonicalUrl: pathToFileURL(canonicalPath).href,
+        source,
+        sourceSha256: createHash('sha256').update(new Uint8Array(source)).digest('hex'),
+    };
+}
+/** Import exactly the captured main-module bytes while preserving its canonical URL as import base. */
+export async function loadAdapterSnapshot(snapshot, name) {
     try {
-        await import(url);
+        const targetSpecifier = `bycli-verify-snapshot:${randomUUID()}`;
+        register(SNAPSHOT_LOADER_URL, import.meta.url, {
+            data: { targetSpecifier, targetUrl: snapshot.canonicalUrl, source: snapshot.source },
+            transferList: [snapshot.source],
+        });
+        await import(targetSpecifier);
     }
     catch (e) {
         // The adapter module's top-level code threw during evaluation (a SyntaxError, or a deliberate
@@ -189,29 +224,50 @@ export async function executeAdapterForVerify(command, opts) {
  * tests); `load` is injected so unit tests can supply an in-memory command. Never throws —
  * any failure becomes a terminal result so the parent always sees one and only one.
  */
-export async function runVerifyRunner(input, emit, load = loadAdapterByName, browserRunner) {
+export async function runVerifyRunner(input, emit, dependencies = {}) {
     emit({ type: 'started', requestId: input.requestId, pid: process.pid, stage: 'load' });
+    let sourceSha256;
     try {
-        const command = await load(input.adapterPath, input.name);
+        const capture = dependencies.capture ?? captureAdapterSource;
+        const load = dependencies.load ?? loadAdapterSnapshot;
+        const snapshot = await capture(input.adapterPath);
+        sourceSha256 = snapshot.sourceSha256;
+        if (input.expectedSourceSha256 !== undefined && input.expectedSourceSha256 !== sourceSha256) {
+            emit({
+                type: 'result', requestId: input.requestId, ok: false,
+                data: { stage: 'load', sourceSha256 },
+                error: { code: 'source_hash_mismatch', message: 'adapter source hash does not match expected source' },
+            });
+            return;
+        }
+        const command = await load(snapshot, input.name);
         const r = await executeAdapterForVerify(command, {
             name: input.name,
             fixture: input.fixture,
             trace: input.trace,
             seedArgs: input.executionSeedArgs ?? {},
             contextId: input.contextId,
-            browserRunner,
+            browserRunner: dependencies.browserRunner,
+        });
+        emit({
+            type: 'result', requestId: input.requestId, ok: r.ok,
+            data: { ...r.data, sourceSha256 },
+            error: r.ok ? null : r.error,
         });
-        emit({ type: 'result', requestId: input.requestId, ok: r.ok, data: r.data, error: r.ok ? null : r.error });
     }
     catch (e) {
-        // Load failure → single terminal result. An adapter-evaluation error (tagged by loadAdapterByName)
+        // Load failure → single terminal result. An adapter-evaluation error (tagged by loadAdapterSnapshot)
         // is adapter-controlled and may echo adapter-file contents, so its message is redacted; a
         // runner-side failure (bad path / resolve) is runner-generated and surfaces verbatim (Codex M7c).
         const adapterEval = e?.adapterEvaluation === true;
         const message = adapterEval ? REDACTED_ADAPTER_LOAD_MESSAGE : (e instanceof Error ? e.message : String(e));
         emit({
             type: 'result', requestId: input.requestId, ok: false,
-            data: { stage: 'load', trace: { policy: input.trace ?? 'retain-on-failure', retained: false, path: null } },
+            data: {
+                stage: 'load',
+                ...(sourceSha256 === undefined ? {} : { sourceSha256 }),
+                trace: { policy: input.trace ?? 'retain-on-failure', retained: false, path: null },
+            },
             error: { code: 'adapter_runtime_error', message, hint: 'adapter failed to load' },
         });
     }

package/dist/src/weixin-built-in-docs.test.d.ts

@@ -0,0 +1 @@
+export {};

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@sovovs/bycli",
-  "version": "2.1.0",
+  "version": "2.1.1",
   "publishConfig": {
     "access": "public"
   },
   "description": "Make any website or Electron App your CLI. AI-powered.",
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=20.6.0"
   },
   "type": "module",
   "workspaces": [
@@ -32,6 +32,7 @@
     "./download/article-download": "./dist/src/download/article-download.js",
     "./download/media-download": "./dist/src/download/media-download.js",
     "./download/progress": "./dist/src/download/progress.js",
+    "./download/wechat-article": "./dist/src/download/wechat-article.js",
     "./pipeline": "./dist/src/pipeline/index.js"
   },
   "files": [
@@ -66,6 +67,7 @@
     "advise:listing-id-pairing": "node scripts/check-listing-id-pairing.mjs",
     "check:silent-column-drop": "node scripts/check-silent-column-drop.mjs",
     "check:typed-error-lint": "node scripts/check-typed-error-lint.mjs",
+    "check:package-install": "node scripts/check-package-install.mjs",
     "docs:dev": "vitepress dev docs",
     "docs:build": "vitepress build docs",
     "docs:preview": "vitepress preview docs"
@@ -87,17 +89,19 @@
   },
   "dependencies": {
     "@mozilla/readability": "^0.6.0",
+    "@sovovs/bycli-recorder-core": "^0.1.0",
     "cli-table3": "^0.6.5",
     "commander": "^14.0.3",
     "js-yaml": "^4.1.0",
+    "parse5": "^7.3.0",
     "turndown": "^7.2.2",
     "turndown-plugin-gfm": "^1.0.2",
     "undici": "^6.25.0",
     "ws": "^8.18.0"
   },
   "devDependencies": {
-    "@types/jsdom": "^27.0.0",
     "@types/js-yaml": "^4.0.9",
+    "@types/jsdom": "^27.0.0",
     "@types/node": "^25.5.2",
     "@types/turndown": "^5.0.6",
     "@types/ws": "^8.5.13",

package/scripts/check-package-install.mjs

@@ -0,0 +1,71 @@
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { cpSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const temp = mkdtempSync(join(tmpdir(), 'bycli-package-install-'));
+const artifacts = join(temp, 'artifacts');
+const project = join(temp, 'project');
+const mainStage = join(temp, 'main-package');
+
+function run(command, args, cwd = root) {
+  return execFileSync(command, args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function pack(cwd) {
+  const result = JSON.parse(run('npm', [
+    'pack', '--json', '--ignore-scripts', '--pack-destination', artifacts,
+  ], cwd));
+  assert.equal(result.length, 1);
+  return {
+    tarball: join(artifacts, result[0].filename),
+    files: new Set(result[0].files.map(({ path }) => path)),
+  };
+}
+
+try {
+  mkdirSync(artifacts, { recursive: true });
+  mkdirSync(project, { recursive: true });
+  mkdirSync(mainStage, { recursive: true });
+  for (const path of [
+    'package.json', 'dist', 'clis', 'cli-manifest.json', 'scripts',
+    'README.md', 'README.zh-CN.md', 'LICENSE', 'NOTICE',
+  ]) {
+    cpSync(join(root, path), join(mainStage, path), { recursive: true });
+  }
+
+  const core = pack(join(root, 'packages/recorder-core'));
+  const main = pack(mainStage);
+
+  for (const file of ['dist/index.js', 'dist/index.d.ts', 'README.md', 'LICENSE']) {
+    assert(core.files.has(file), `recorder-core tarball is missing ${file}`);
+  }
+  assert(![...core.files].some((file) => file.startsWith('src/')), 'recorder-core tarball includes src/');
+
+  writeFileSync(join(project, 'package.json'), JSON.stringify({ private: true, type: 'module' }));
+  run('npm', [
+    'install', '--ignore-scripts', '--no-audit', '--no-fund', core.tarball, main.tarball,
+  ], project);
+
+  const mainManifest = JSON.parse(readFileSync(join(
+    project, 'node_modules/@sovovs/bycli/package.json',
+  ), 'utf8'));
+  assert.equal(mainManifest.dependencies?.['@sovovs/bycli-recorder-core'], '^0.1.0');
+
+  const coreDirectory = join(project, 'node_modules/@sovovs/bycli-recorder-core');
+  const recorderEntry = join(
+    project, 'node_modules/@sovovs/bycli/dist/src/browser/analyze.js',
+  );
+  await import(pathToFileURL(recorderEntry).href);
+  await import(pathToFileURL(join(coreDirectory, 'dist/index.js')).href);
+  console.log('package install smoke test passed');
+} finally {
+  rmSync(temp, { recursive: true, force: true });
+}