@super-coding/cli 0.0.0-stage → 0.2.0

package/dist/pingcode/launcher.js

@@ -0,0 +1,60 @@
+// 令牌注入：给会话目录生成一个 `pc` 包装器，令牌只在 exec 时从 0600 文件读入。
+//
+// 为什么不直接往子进程环境里塞 PC_TOKEN？
+// 上游 `pc` 用 clap 的 `env = "PC_TOKEN"` 声明参数，**帮助输出会把环境变量值当默认值
+// 打印出来**（`pc --help` → `[env: PC_TOKEN=真实令牌]`）。agent 一旦执行 --help，
+// 令牌就进了模型上下文，还可能顺着 run 日志回流到平台。
+// 包装器把令牌放在命令行参数里由脚本内部展开，子进程环境里没有 PC_TOKEN，
+// --help 自然打不出任何凭据。（argv 在 `ps` 里可见，单用户开发机可接受。）
+import { chmodSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { manageDir } from "../daemon/paths.js";
+/** 相对会话目录的 bin 目录（会被 prepend 到 PATH） */
+const BIN_DIR_REL = join(".super-coding", "bin");
+const TOKEN_FILE_REL = join("pingcode", "token");
+/** POSIX 单引号转义：' -> '\'' */
+function shQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+/** 令牌文件位置（0600）；disconnect 时也要清掉，别把有效令牌留在盘上 */
+export function pingcodeTokenFile() {
+    return join(manageDir(), TOKEN_FILE_REL);
+}
+export function clearPingcodeToken() {
+    const path = pingcodeTokenFile();
+    try {
+        rmSync(path, { force: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function writePingcodeLauncher(opts) {
+    if (process.platform === "win32") {
+        throw new Error("writePingcodeLauncher 只支持 POSIX；Windows 走环境变量注入");
+    }
+    const tokenDir = join(manageDir(), "pingcode");
+    mkdirSync(tokenDir, { recursive: true, mode: 0o700 });
+    const tokenFile = pingcodeTokenFile();
+    // 每次运行重写：client 凭据换来的令牌会轮换，旧值不能留在盘上。
+    writeFileSync(tokenFile, `${opts.token}\n`, { mode: 0o600 });
+    chmodSync(tokenFile, 0o600);
+    const binDir = join(opts.workdir, BIN_DIR_REL);
+    mkdirSync(binDir, { recursive: true, mode: 0o700 });
+    const scriptPath = join(binDir, "pc");
+    const script = [
+        "#!/bin/sh",
+        "# 由 scode daemon 生成，请勿修改。",
+        "# 令牌只在 exec 时从 0600 文件读取，不进环境变量，避免 `pc --help` 把凭据当默认值打印。",
+        `tok=$(cat ${shQuote(tokenFile)} 2>/dev/null) || {`,
+        '  echo "pc: 缺少 PingCode 令牌文件，请重新运行 scode pingcode connect" >&2',
+        "  exit 2",
+        "}",
+        `exec ${shQuote(opts.binary)} --token "$tok" --base-url ${shQuote(opts.baseUrl)} "$@"`,
+        "",
+    ].join("\n");
+    writeFileSync(scriptPath, script, { mode: 0o700 });
+    chmodSync(scriptPath, 0o700);
+    return { binDir, scriptPath, tokenFile };
+}

package/dist/pingcode/runtime.js

@@ -0,0 +1,167 @@
+// PingCode 集成的运行时装配：探测 → 凭据 → 令牌注入方式 → 内置 skill。
+//
+// 设计原则：**有则增强，无则静默降级**。任何一步不满足就标记 reason 并返回不可用，
+// 由调用方（orchestrator / CLI status）自行决定提示什么，绝不让 daemon 启动或会话失败。
+import { delimiter } from "node:path";
+import { DEFAULT_BASE_URL, inspectPingcodeConfig } from "./config.js";
+import { detectPingcodeBinary } from "./detect.js";
+import { writePingcodeLauncher } from "./launcher.js";
+import { loadPingcodeSkill } from "./skill.js";
+import { resolveToken, resetTokenCache } from "./token.js";
+/** 配置文件的凭据优先；其次认用户 shell 里已导出的 PC_TOKEN（显式选择，不读 client 凭据对）。 */
+function resolveCredentials(env) {
+    const inspected = inspectPingcodeConfig();
+    if (inspected.state === "ok") {
+        const config = inspected.config;
+        return { creds: { config, credential: config.token ? "user_token" : "client_credentials" } };
+    }
+    // 配置文件坏了但环境里有显式 PC_TOKEN：仍然可用，不必因为一个坏文件把功能关掉
+    const envToken = env["PC_TOKEN"]?.trim();
+    if (!envToken) {
+        return inspected.state === "invalid"
+            ? { creds: null, invalid: { path: inspected.path, error: inspected.error } }
+            : { creds: null };
+    }
+    const baseUrl = (env["PC_OPEN_API_BASE_URL"]?.trim() || DEFAULT_BASE_URL).replace(/\/+$/, "");
+    return { creds: { config: { base_url: /^https?:\/\//i.test(baseUrl) ? baseUrl : DEFAULT_BASE_URL, token: envToken }, credential: "env_token" } };
+}
+export class PingcodeBridge {
+    opts;
+    state;
+    injection;
+    constructor(opts, state, injection) {
+        this.opts = opts;
+        this.state = state;
+        this.injection = injection;
+    }
+    static async create(options = {}) {
+        const env = options.env ?? process.env;
+        const injection = process.platform === "win32" ? "env" : "launcher";
+        const opts = { env, token: options.token ?? {} };
+        if (env["SC_PINGCODE"] === "off") {
+            return new PingcodeBridge(opts, { reason: "disabled", detail: "SC_PINGCODE=off" }, injection);
+        }
+        // 先探二进制：它决定 status 能报出多少信息，且与凭据是否就绪无关
+        const binary = await detectPingcodeBinary(env);
+        if (!binary) {
+            return new PingcodeBridge(opts, { reason: "binary_missing" }, injection);
+        }
+        const { creds, invalid } = resolveCredentials(env);
+        if (!creds) {
+            return new PingcodeBridge(opts, invalid
+                ? { binary, reason: "config_invalid", detail: `${invalid.path}：${invalid.error}` }
+                : { binary, reason: "no_credentials" }, injection);
+        }
+        const skill = loadPingcodeSkill();
+        if (!skill) {
+            return new PingcodeBridge(opts, { binary, config: creds.config, credential: creds.credential, reason: "skill_missing" }, injection);
+        }
+        return new PingcodeBridge(opts, { binary, config: creds.config, credential: creds.credential, skill }, injection);
+    }
+    get available() {
+        return this.state.reason === undefined && this.state.config !== undefined;
+    }
+    /** 内置 skill（不可用时为 null） */
+    skill() {
+        return this.state.skill ?? null;
+    }
+    /**
+     * 按需重探：配置常常是 daemon 起来之后才写入/改写的（`scode pingcode connect`），
+     * 不重探就得让用户重启 daemon 才生效。探测有缓存，代价只是一次小文件读。
+     */
+    async refresh() {
+        if (this.state.reason === "disabled")
+            return;
+        const binary = this.state.binary ?? (await detectPingcodeBinary(this.opts.env));
+        const { creds, invalid } = resolveCredentials(this.opts.env);
+        const skill = this.state.skill ?? loadPingcodeSkill();
+        // 凭据可能在运行期被 connect 改写（含从 access token 切到 client 凭据）
+        const changed = JSON.stringify(creds?.config ?? null) !== JSON.stringify(this.state.config ?? null);
+        if (binary)
+            this.state.binary = binary;
+        if (creds) {
+            this.state.config = creds.config;
+            this.state.credential = creds.credential;
+        }
+        else {
+            delete this.state.config;
+            delete this.state.credential;
+        }
+        if (skill)
+            this.state.skill = skill;
+        if (changed)
+            resetTokenCache();
+        if (!binary) {
+            this.state.reason = "binary_missing";
+            delete this.state.detail;
+        }
+        else if (!creds) {
+            this.state.reason = invalid ? "config_invalid" : "no_credentials";
+            if (invalid)
+                this.state.detail = `${invalid.path}：${invalid.error}`;
+            else
+                delete this.state.detail;
+            return;
+        }
+        else if (!skill) {
+            this.state.reason = "skill_missing";
+            delete this.state.detail;
+        }
+        else {
+            delete this.state.reason;
+            delete this.state.detail;
+        }
+    }
+    /**
+     * 一次运行所需的全部注入物。不可用返回 null。
+     * 令牌换取失败会抛错，由调用方降级（不影响会话本身）。
+     */
+    async prepareRun(workdir) {
+        await this.refresh();
+        const config = this.state.config;
+        const binary = this.state.binary;
+        const skill = this.state.skill;
+        if (!config || !binary || !skill)
+            return null;
+        const token = await resolveToken(config, this.opts.token);
+        const base = config.base_url;
+        // 中和继承来的凭据：子进程环境里绝不允许出现真实凭据（`pc --help` 会回显环境变量值）
+        const neutral = {
+            PC_TOKEN: "",
+            PC_CLIENT_ID: "",
+            PC_CLIENT_SECRET: "",
+            PC_OPEN_API_BASE_URL: base,
+        };
+        if (this.injection === "launcher") {
+            const { binDir } = writePingcodeLauncher({
+                workdir,
+                binary: binary.path,
+                baseUrl: base,
+                token: token.token,
+            });
+            const parentPath = this.opts.env["PATH"] ?? "";
+            return {
+                env: { ...neutral, PATH: parentPath ? `${binDir}${delimiter}${parentPath}` : binDir },
+                skill,
+            };
+        }
+        // Windows 兜底：没有可靠的 sh 包装器。已知取舍——`pc --help` 会把 PC_TOKEN 打出来，
+        // skill 里已明令禁止执行 --help。
+        return { env: { ...neutral, PC_TOKEN: token.token }, skill };
+    }
+    status() {
+        return {
+            available: this.available,
+            ...(this.state.reason ? { reason: this.state.reason } : {}),
+            ...(this.state.detail ? { detail: this.state.detail } : {}),
+            ...(this.state.binary ? { binary: this.state.binary } : {}),
+            ...(this.state.config ? { base_url: this.state.config.base_url } : {}),
+            ...(this.state.credential ? { credential: this.state.credential } : {}),
+            injection: this.injection,
+            ...(this.state.skill ? { skill: this.state.skill.name } : {}),
+        };
+    }
+}
+export async function createPingcodeBridge(options = {}) {
+    return PingcodeBridge.create(options);
+}

package/dist/pingcode/skill.js

@@ -0,0 +1,51 @@
+// 内置 PingCode skill：随 CLI 包分发，物化进会话的 skills 目录。
+// 读不到文件时返回 null（daemon 降级为「不注入 pc」），而不是让会话失败。
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+/** dist 与 src 同构：builtin/ 与 skill.js 同目录（构建期由 copy-assets 拷贝） */
+const SKILL_PATH = fileURLToPath(new URL("./builtin/SKILL.md", import.meta.url));
+const REFERENCE_PATH = fileURLToPath(new URL("./builtin/reference.md", import.meta.url));
+/** 正文过短视为打包缺失/截断，宁可不注入 */
+const MIN_SKILL_CHARS = 200;
+export const PINGCODE_SKILL_NAME = "use-pingcode-cli";
+const SKILL_ID = "builtin:use-pingcode-cli";
+let cached;
+function stripBom(text) {
+    return text.replace(/^\uFEFF/, "");
+}
+function frontmatterDescription(content) {
+    const block = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+    const value = block?.[1]?.match(/^description:\s*(.+)$/m)?.[1]?.trim();
+    return value ? value.replace(/^["']|["']$/g, "") : undefined;
+}
+export function loadPingcodeSkill() {
+    if (cached !== undefined)
+        return cached;
+    try {
+        const content = stripBom(readFileSync(SKILL_PATH, "utf8"));
+        const reference = stripBom(readFileSync(REFERENCE_PATH, "utf8"));
+        if (!/^---\r?\n/.test(content))
+            throw new Error("SKILL.md 缺少 frontmatter");
+        if (content.trim().length < MIN_SKILL_CHARS)
+            throw new Error(`SKILL.md 正文过短（<${MIN_SKILL_CHARS} 字符），疑似打包缺失`);
+        if (reference.trim().length < MIN_SKILL_CHARS)
+            throw new Error("reference.md 内容过短，疑似打包缺失");
+        cached = {
+            id: SKILL_ID,
+            name: PINGCODE_SKILL_NAME,
+            ...(frontmatterDescription(content) ? { description: frontmatterDescription(content) } : {}),
+            content,
+            files: [{ path: "reference.md", content: reference }],
+        };
+    }
+    catch (err) {
+        console.error(`[daemon] 内置 PingCode skill 不可用（${SKILL_PATH}）：${err.message}`);
+        cached = null;
+    }
+    return cached;
+}
+/** 测试用：清空缓存 */
+export function resetPingcodeSkillCache() {
+    cached = undefined;
+}
+export const pingcodeSkillPaths = { SKILL_PATH, REFERENCE_PATH };

package/dist/pingcode/token.js

@@ -0,0 +1,81 @@
+const DEFAULT_TIMEOUT_MS = 5_000;
+const DEFAULT_TTL_SECONDS = 3_600;
+/** 提前 60 秒过期，避免边界上拿着刚失效的令牌去发业务请求 */
+const EXPIRY_MARGIN_MS = 60_000;
+let cache;
+export function resetTokenCache() {
+    cache = undefined;
+}
+function cacheKey(config) {
+    return `${config.base_url}|${config.client_id ?? config.token ?? ""}`;
+}
+export async function resolveToken(config, opts = {}) {
+    if (config.token)
+        return { token: config.token, source: "config" };
+    const now = opts.now ?? Date.now;
+    const key = cacheKey(config);
+    if (cache && cache.key === key && cache.expires_at > now()) {
+        return { token: cache.token, source: "client_credentials", expires_at: cache.expires_at };
+    }
+    const clientId = config.client_id;
+    const clientSecret = config.client_secret;
+    if (!clientId || !clientSecret) {
+        throw new Error("PingCode 令牌换取失败：缺少 client_id / client_secret");
+    }
+    const query = new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: clientId,
+        client_secret: clientSecret,
+    });
+    const url = `${config.base_url}/v1/auth/token?${query.toString()}`;
+    const fetcher = opts.fetcher ?? fetch;
+    let res;
+    try {
+        res = await fetcher(url, { method: "GET", signal: AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS) });
+    }
+    catch (err) {
+        // 不拼原始错误消息：它可能包含带 client_secret 的完整 URL。
+        const name = err?.name ?? "Error";
+        throw new Error(`PingCode 令牌换取失败：${name === "TimeoutError" ? "请求超时" : name}`);
+    }
+    const body = await res.text();
+    if (!res.ok) {
+        throw new Error(`PingCode 令牌换取失败：HTTP ${res.status}${body ? `（${truncate(body)}）` : ""}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        throw new Error("PingCode 令牌换取失败：响应不是 JSON");
+    }
+    if (typeof parsed.access_token !== "string" || !parsed.access_token) {
+        throw new Error("PingCode 令牌换取失败：响应缺少 access_token");
+    }
+    const expiresAt = expiryOf(parsed.expires_in, now());
+    cache = { key, token: parsed.access_token, expires_at: expiresAt };
+    return { token: parsed.access_token, source: "client_credentials", expires_at: expiresAt };
+}
+/**
+ * `expires_in` 的语义在服务端并不统一：公有云返回 TTL 秒数，而 RC 环境实测返回的是
+ * **绝对过期时间戳**（epoch 秒，如 1795060115 = 2026-11-19）。
+ * 若一律当 TTL，会缓存成 56 年，令牌真过期后一直拿旧值去请求、只在业务接口上收到 401，
+ * 且永远不会触发刷新。这里按量级区分：超过 10 年的一律视为时间戳。
+ */
+const MAX_PLAUSIBLE_TTL_SECONDS = 10 * 365 * 24 * 3_600;
+function expiryOf(raw, nowMs) {
+    const at = (base) => Math.max(base - EXPIRY_MARGIN_MS, nowMs + 30_000);
+    if (typeof raw !== "number" || !Number.isFinite(raw) || raw <= 0) {
+        return at(nowMs + DEFAULT_TTL_SECONDS * 1_000);
+    }
+    if (raw > MAX_PLAUSIBLE_TTL_SECONDS) {
+        const absolute = raw * 1_000;
+        // 已经是过去的时刻（时钟偏差/服务端异常）就退回保守 TTL，避免无限复用一个死令牌
+        return absolute > nowMs ? at(absolute) : at(nowMs + DEFAULT_TTL_SECONDS * 1_000);
+    }
+    return at(nowMs + raw * 1_000);
+}
+function truncate(text) {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length > 200 ? `${flat.slice(0, 200)}…` : flat;
+}

package/package.json

@@ -1,6 +1,48 @@
 {
   "name": "@super-coding/cli",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.2.0",
+  "description": "Super Coding CLI：把本机 Claude Code / Cursor 接入远程控制台（scode 命令与后台 daemon）",
+  "license": "UNLICENSED",
+  "type": "module",
+  "bin": {
+    "scode": "dist/cli.js"
+  },
+  "main": "dist/cli.js",
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=24"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "super-coding",
+    "agent",
+    "daemon",
+    "claude-code",
+    "cursor",
+    "remote"
+  ],
+  "devDependencies": {
+    "@types/node": "^24.10.1",
+    "@types/ws": "^8.18.1",
+    "tsx": "^4.21.0",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.7"
+  },
+  "dependencies": {
+    "commander": "^14.0.2",
+    "ws": "^8.21.3",
+    "@super-coding/protocol": "0.1.0"
+  },
+  "scripts": {
+    "dev": "tsx watch src/cli.ts",
+    "build": "pnpm --filter @super-coding/protocol build && rm -rf dist && tsc -p tsconfig.build.json && node scripts/copy-assets.mjs",
+    "link:local": "node scripts/link-local.mjs",
+    "start": "node dist/cli.js daemon run",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
 }