@whyshu/argent 0.1.27 → 0.2.0

package/mcp/billing-upload.mjs

@@ -0,0 +1,77 @@
+/**
+ * billing-upload.mjs —— 计费事件的**上报骨架**（v0.9.0，默认关闭）
+ *
+ * 为什么要上报：本地台账只在客户机上，服务端要能对账就必须收到**签名批次**；
+ * 但上报必须先做到"可断网、可重试、不重复计费"，否则宁可不上报（本地台账永远是权威副本）。
+ *
+ * 规则：
+ *   · 只有 `signPending()` 签过名的批次才上报（未签名 = 未定稿，不传）；
+ *   · 每个批次附带它覆盖的事件（**只含 action/points/tenant/user/at/seq**，⛔ 无参数/无结果/无真名）；
+ *   · `batchId` 幂等：收到 2xx 才写入 `billing-upload.json`，重复调用不会重传；
+ *   · 失败（网络/5xx）保留在待传队列，下次继续；4xx 视为**永久失败**，跳过并记入 `failed[]`。
+ *
+ * 默认关闭：`url` 未配置 ⇒ 只返回 `{ok:false, reason:'not_configured'}`，绝不偷偷发。
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, openSync, closeSync, writeSync, chmodSync } from 'node:fs'
+import { join } from 'node:path'
+
+const MAX_BATCHES = 20
+
+function dirOf(dataDir) {
+  const d = join(dataDir, 'gateway')
+  mkdirSync(d, { recursive: true })
+  return d
+}
+
+function readJson(file, fallback) {
+  try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return fallback }
+}
+
+function writeJson600(file, obj) {
+  const fd = openSync(file, 'w', 0o600)
+  writeSync(fd, JSON.stringify(obj, null, 2) + '\n')
+  closeSync(fd)
+  try { chmodSync(file, 0o600) } catch { /* noop */ }
+}
+
+function readLines(file) {
+  if (!existsSync(file)) return []
+  return readFileSync(file, 'utf8').split('\n').filter(Boolean).map((l) => { try { return JSON.parse(l) } catch { return null } }).filter(Boolean)
+}
+
+/**
+ * @returns {{ok:boolean, reason?:string, sent:number, skipped:number, failed:number}}
+ */
+export async function uploadPending({ dataDir, url, token = '', fetchImpl = fetch, maxBatches = MAX_BATCHES } = {}) {
+  if (!url) return { ok: false, reason: 'not_configured', sent: 0, skipped: 0, failed: 0 }
+  const dir = dirOf(dataDir)
+  const stateFile = join(dir, 'billing-upload.json')
+  const state = readJson(stateFile, { uploadedBatches: [], failed: [] })
+  const uploaded = new Set(state.uploadedBatches || [])
+  const failedSet = new Set(state.failed || [])
+
+  const batches = readLines(join(dir, 'events.signed.jsonl'))
+  const events = readLines(join(dir, 'events.jsonl'))
+  let sent = 0, skipped = 0, failed = 0
+
+  for (const batch of batches.slice(0, maxBatches)) {
+    if (uploaded.has(batch.batchId) || failedSet.has(batch.batchId)) { skipped++; continue }
+    const slice = events.filter((e) => e.seq >= batch.fromSeq && e.seq <= batch.toSeq)
+    let r
+    try {
+      r = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', ...(token ? { authorization: `Bearer ${token}` } : {}) },
+        body: JSON.stringify({ batch, events: slice }),
+      })
+    } catch {
+      failed++; continue                      // 网络问题：留在队列，下次重试
+    }
+    if (r.ok) { uploaded.add(batch.batchId); sent++ }
+    else if (r.status >= 400 && r.status < 500) { failedSet.add(batch.batchId); failed++ }  // 永久失败
+    else failed++                            // 5xx：下次重试
+  }
+
+  writeJson600(stateFile, { uploadedBatches: [...uploaded], failed: [...failedSet], updatedAt: new Date().toISOString() })
+  return { ok: true, sent, skipped, failed, pending: batches.length - uploaded.size - failedSet.size }
+}

package/mcp/erp-server.mjs

@@ -0,0 +1,296 @@
+#!/usr/bin/env node
+/**
+ * erp-server.mjs —— ERP 的 MCP 服务端（v0.9.0 · 只读第一版）
+ *
+ * 定位：把 whyshu-svr 现有的 HTTP 只读接口包成 MCP 工具，给 dsh 会话/侧栏面板用。
+ * ⛔ 不改 ERP 逻辑、不直连数据库、不写 whyshu-svr；只做「协议形状适配 + 轻量脱敏」。
+ *
+ * 鉴权：复用问述账号 token（`WHYSHU_API_KEY`，与 LLM 代理同一把 JWT，
+ *       服务端 `authenticate` 同时接受 x-api-key 与 Bearer）。
+ * 租户：`ARGENT_TENANT`（默认 ly-0001）。
+ *
+ * 传输：stdio（每行一个 JSON-RPC 2.0）。协议子集：initialize / notifications/initialized /
+ *       tools/list / tools/call / ping —— 与 core/mcp/server.mjs 同款，零第三方依赖。
+ *
+ * 红线：
+ *   · 只读：本版不支持任何写操作（`prepare_action` 需要服务端新路由，等 whyshu-svr 侧提供）；
+ *   · 脱敏：手机号打码、附件 token/URL 不返回、客户名可选代号（v2 接 vault）；
+ *   · 不落日志正文：只记 tool/耗时/ok。
+ */
+
+const API_BASE = (process.env.ARGENT_API_BASE || 'https://whyshu.com').replace(/\/+$/, '')
+const TENANT = String(process.env.ARGENT_TENANT || 'ly-0001').trim()
+import { resolveAccountToken } from './vendor/account-token.mjs'
+const TOKEN = resolveAccountToken().token
+const TIMEOUT_MS = Number(process.env.ARGENT_ERP_TIMEOUT_MS || 20000)
+/** 写路径总开关（默认关）：ERP 上线 prepare 路由后设 ARGENT_ERP_WRITE=1 即可，无需改代码 */
+const WRITE_ENABLED = process.env.ARGENT_ERP_WRITE === '1'
+export const SERVER_INFO = { name: 'argent-erp', version: '0.9.0' }
+
+import { redactDeep } from './vendor/redact.mjs'
+
+async function apiPost(path, body = {}) {
+  if (!WRITE_ENABLED) throw Object.assign(new Error('写路径未启用（ARGENT_ERP_WRITE=1 才开）'), { code: 'write_disabled' })
+  if (!TOKEN) throw Object.assign(new Error('缺少账号 token（WHYSHU_API_KEY）'), { code: 'no_token' })
+  let r
+  try {
+    r = await fetch(`${API_BASE}/api/argent/v1${path}`, {
+      method: 'POST',
+      headers: { 'x-api-key': TOKEN, 'content-type': 'application/json', accept: 'application/json' },
+      body: JSON.stringify(body),
+      signal: AbortSignal.timeout(TIMEOUT_MS),
+    })
+  } catch (e) {
+    throw Object.assign(new Error(`ERP 不可达：${String(e.message).slice(0, 120)}`), { code: 'network' })
+  }
+  const text = await r.text()
+  let j = null
+  try { j = JSON.parse(text) } catch { j = { raw: text.slice(0, 200) } }
+  if (r.status === 401) throw Object.assign(new Error('账号 token 失效（401）'), { code: 'unauthorized', status: 401 })
+  if (!r.ok) throw Object.assign(new Error((j && j.error && j.error.message) || `ERP HTTP ${r.status}`), { code: 'http', status: r.status })
+  return j
+}
+
+async function apiGet(path, query = {}) {
+  if (!TOKEN) throw Object.assign(new Error('缺少账号 token（WHYSHU_API_KEY）'), { code: 'no_token' })
+  const url = new URL(`${API_BASE}/api/argent/v1${path}`)
+  for (const [k, v] of Object.entries(query)) {
+    if (v !== undefined && v !== null && v !== '') url.searchParams.set(k, String(v))
+  }
+  const ctl = AbortSignal.timeout(TIMEOUT_MS)
+  const r = await fetch(url, { headers: { 'x-api-key': TOKEN, accept: 'application/json' }, signal: ctl })
+  const text = await r.text()
+  let body = null
+  try { body = JSON.parse(text) } catch { body = { raw: text.slice(0, 300) } }
+  if (!r.ok) {
+    const err = new Error(`ERP HTTP ${r.status}: ${(body && body.error && body.error.message) || ''}`.trim())
+    err.code = r.status === 401 ? 'unauthorized' : r.status === 403 ? 'forbidden' : 'http_error'
+    err.status = r.status
+    throw err
+  }
+  return body
+}
+
+const tenantPath = (suffix) => `/tenants/${encodeURIComponent(TENANT)}${suffix}`
+
+/**
+ * 列表投影（2026-11-04）：ERP 的 `/shipments` 每条内嵌 progress/groups/fileRefs，
+ * 单条 ~5KB；一次 limit=20 能把模型上下文顶爆。列表只回"看得懂的一行"，重数据走 _detail。
+ */
+const F = ['sourceRecordId', 'shipmentNo', 'shop', 'sku', 'status', 'fullStatus', 'currentStep', 'invoiceStatus', 'invoiceReady', 'boxCount', 'ready', 'updatedAt']
+/** 发票列表投影：fileRefs（每条 4 组附件）→ 只留数量与状态 */
+export function pickInvoice(it = {}) {
+  const fr = it.fileRefs || {}
+  const out = {
+    sourceRecordId: it.sourceRecordId, shipmentNo: it.shipmentNo,
+    invoiceStatus: it.invoiceStatus, invoiceReady: it.invoiceReady,
+    invoiceError: it.invoiceError || '',
+    files: { invoice: (fr.invoiceFile || []).length, bulkLabel: (fr.bulkLabel || []).length, fullLabel: (fr.fullLabelFile || []).length, fullCarton: (fr.fullCartonFile || []).length },
+    updatedAt: it.updatedAt,
+  }
+  return out
+}
+
+/** 任务列表投影：payload 里只取面板/模型要用的几项 */
+export function pickTask(it = {}) {
+  const pl = it.payload || {}
+  return {
+    id: it._id, type: it.type, title: it.title, status: it.status,
+    shipmentNo: pl.shipmentNo || '', shop: pl.shop || '', stageLabel: pl.stageLabel || '',
+    nextAction: pl.nextAction || '', updatedAt: it.updatedAt,
+  }
+}
+
+export function pickShipment(it = {}) {
+  const out = {}
+  for (const k of F) if (it[k] !== undefined) out[k] = it[k]
+  const pg = it.progress || {}
+  if (pg.percent !== undefined) out.progress = { percent: pg.percent, doneCount: pg.doneCount, totalCount: pg.totalCount, currentLabel: pg.currentLabel }
+  return out
+}
+
+/** 工具表：**只读**，参数尽量贴近 ERP 现有 query（不发明新语义） */
+export const TOOLS = {
+  erp_tenant_info: {
+    description: '当前账号与所属租户（/me + /me/tenants）',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    handler: async () => ({ me: await apiGet('/me'), tenants: await apiGet('/me/tenants') }),
+  },
+  erp_shipment_search: {
+    description: '查货件（GET /shipments）：q / status / fullStatus / ready / stage / group / page / limit',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        q: { type: 'string' }, status: { type: 'string' }, fullStatus: { type: 'string' },
+        ready: { type: 'boolean' }, stage: { type: 'string' }, group: { type: 'string' },
+        page: { type: 'integer' }, limit: { type: 'integer', maximum: 50 },
+      },
+      additionalProperties: false,
+    },
+    handler: async (a) => {
+      const r = await apiGet(tenantPath('/shipments'), a)
+      const d = r.data || {}
+      return { total: d.total, page: d.page, limit: d.limit, items: (d.items || []).map(pickShipment) }
+    },
+  },
+  erp_shipment_detail: {
+    description: '货件详情（GET /shipments/:sourceRecordId）',
+    inputSchema: { type: 'object', properties: { sourceRecordId: { type: 'string' } }, required: ['sourceRecordId'], additionalProperties: false },
+    handler: async ({ sourceRecordId }) => apiGet(tenantPath(`/shipments/${encodeURIComponent(sourceRecordId)}`)),
+  },
+  erp_invoice_list: {
+    description: '查发票（GET /invoices）：q / invoiceStatus / invoiceReady / page / limit',
+    inputSchema: {
+      type: 'object',
+      properties: { q: { type: 'string' }, invoiceStatus: { type: 'string' }, invoiceReady: { type: 'boolean' }, page: { type: 'integer' }, limit: { type: 'integer', maximum: 50 } },
+      additionalProperties: false,
+    },
+    handler: async (a) => {
+      const r = await apiGet(tenantPath('/invoices'), a)
+      const d = r.data || {}
+      return { total: d.total, page: d.page, limit: d.limit, items: (d.items || []).map(pickInvoice) }
+    },
+  },
+  erp_task_list: {
+    description: '任务列表（GET /tasks）：status / type / limit',
+    inputSchema: { type: 'object', properties: { status: { type: 'string' }, type: { type: 'string' }, limit: { type: 'integer', maximum: 100 } }, additionalProperties: false },
+    handler: async (a) => {
+      const r = await apiGet(tenantPath('/tasks'), a)
+      const d = r.data || {}
+      const items = Array.isArray(d.items) ? d.items : []
+      return { items: items.map(pickTask) }
+    },
+  },
+  erp_run_list: {
+    description: '运行记录（GET /runs）：cardId / limit',
+    inputSchema: { type: 'object', properties: { cardId: { type: 'string' }, limit: { type: 'integer', maximum: 200 } }, additionalProperties: false },
+    handler: async (a) => apiGet(tenantPath('/runs'), a),
+  },
+  erp_ledger_list: {
+    description: '台账（GET /ledger）：flow / ticket / kind / days / limit',
+    inputSchema: {
+      type: 'object',
+      properties: { flow: { type: 'string' }, ticket: { type: 'string' }, kind: { type: 'string' }, days: { type: 'integer' }, limit: { type: 'integer' } },
+      additionalProperties: false,
+    },
+    handler: async (a) => apiGet(tenantPath('/ledger'), a),
+  },
+  erp_member_list: {
+    description: '成员（GET /members；手机号自动打码）',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    handler: async () => apiGet(tenantPath('/members')),
+  },
+  erp_office_snapshot: {
+    description: '办公室现场快照（GET /office：KPI/在岗员工/任务流/动态）',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    handler: async () => apiGet(tenantPath('/office')),
+  },
+  erp_dashboard: {
+    description: '仪表盘聚合（GET /dashboard）',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    handler: async () => apiGet(tenantPath('/dashboard')),
+  },
+  erp_shipment_stats: {
+    description: '货件聚合统计（取 GET /dashboard：总数/完成率/byStage/byGroup；**适配层派生**，非 ERP 专用 stats 路由）',
+    inputSchema: { type: 'object', properties: {}, additionalProperties: false },
+    handler: async () => {
+      const d = (await apiGet(tenantPath('/dashboard'))).data || {}
+      return { total: d.total || 0, completed: d.completed || 0, completionRate: d.completionRate || 0, byStage: d.byStage || {}, byGroup: d.byGroup || {} }
+    },
+  },
+  erp_shipment_timeline: {
+    description: '货件节点时间线（取 GET /shipments/:id 的 progress.nodes；**适配层派生**）',
+    inputSchema: { type: 'object', properties: { sourceRecordId: { type: 'string' } }, required: ['sourceRecordId'], additionalProperties: false },
+    handler: async ({ sourceRecordId }) => {
+      const d = (await apiGet(tenantPath(`/shipments/${encodeURIComponent(sourceRecordId)}`))).data || {}
+      const nodes = ((d.progress && d.progress.nodes) || []).map((n) => ({ key: n.key, label: n.label, status: n.status, completedAt: n.completedAt || null, ownerName: n.ownerName || '' }))
+      return { nodes }
+    },
+  },
+  erp_invoice_detail: {
+    description: '发票详情（复用 GET /shipments/:sourceRecordId 的 invoice/progress 段；不含附件下载地址）',
+    inputSchema: { type: 'object', properties: { sourceRecordId: { type: 'string' } }, required: ['sourceRecordId'], additionalProperties: false },
+    handler: async ({ sourceRecordId }) => {
+      const r = await apiGet(tenantPath(`/shipments/${encodeURIComponent(sourceRecordId)}`))
+      const d = r.data || {}
+      return { invoice: d.invoice || null, progress: d.progress || null }
+    },
+  },
+  erp_activity_list: {
+    description: '办公室动态（取 GET /office 的 activity 段）：limit 默认 20',
+    inputSchema: { type: 'object', properties: { limit: { type: 'integer', maximum: 50 } }, additionalProperties: false },
+    handler: async ({ limit = 20 } = {}) => {
+      const r = await apiGet(tenantPath('/office'))
+      const items = (r.data && r.data.activity) || []
+      return { items: items.slice(0, Math.min(Number(limit) || 20, 50)), total: items.length }
+    },
+  },
+  erp_prepare_action: {
+    description: '生成写操作提议（POST /office/actions/prepare；需 ARGENT_ERP_WRITE=1 且 ERP 已提供该路由）。只生成提议、不执行、不计费。',
+    inputSchema: { type: 'object', properties: { action: { type: 'string' }, payload: { type: 'object' } }, required: ['action'], additionalProperties: false },
+    handler: async ({ action, payload = {} }) => {
+      if (!WRITE_ENABLED) return { ok: false, code: 'write_disabled', message: '写路径未启用：ARGENT_ERP_WRITE=1 才开放（需 ERP 先提供 prepare 路由）' }
+      const r = await apiPost(tenantPath('/office/actions/prepare'), { action, payload })
+      return { ok: true, proposal: r.data || r }
+    },
+  },
+  erp_execute_action: {
+    description: '执行已确认的提议（POST /office/actions/:proposalId/execute；需 ARGENT_ERP_WRITE=1）。⛔ 仅在用户明确确认后调用；成功才计费。',
+    inputSchema: { type: 'object', properties: { proposalId: { type: 'string' }, idempotencyKey: { type: 'string' } }, required: ['proposalId'], additionalProperties: false },
+    handler: async ({ proposalId }) => {
+      if (!WRITE_ENABLED) return { ok: false, code: 'write_disabled', message: '写路径未启用：ARGENT_ERP_WRITE=1 才开放' }
+      const r = await apiPost(tenantPath(`/office/actions/${encodeURIComponent(proposalId)}/execute`), {})
+      return { ok: true, result: r.data || r }
+    },
+  },
+}
+
+export const TOOL_NAMES = Object.freeze(Object.keys(TOOLS))
+
+/* ── stdio JSON-RPC（与 core/mcp/server.mjs 同款协议子集） ───────────────── */
+const send = (msg) => process.stdout.write(`${JSON.stringify(msg)}\n`)
+
+export async function handle(msg) {
+  const { id, method, params } = msg || {}
+  if (method === 'initialize') {
+    return { jsonrpc: '2.0', id, result: { protocolVersion: '2024-11-05', capabilities: { tools: {} }, serverInfo: SERVER_INFO } }
+  }
+  if (method === 'notifications/initialized') return null
+  if (method === 'ping') return { jsonrpc: '2.0', id, result: {} }
+  if (method === 'tools/list') {
+    return {
+      jsonrpc: '2.0', id,
+      result: { tools: TOOL_NAMES.map((n) => ({ name: n, description: TOOLS[n].description, inputSchema: TOOLS[n].inputSchema, annotations: { readOnlyHint: !/prepare_action|execute_action/.test(n) } })) },
+    }
+  }
+  if (method === 'tools/call') {
+    const name = params && params.name
+    const args = (params && params.arguments) || {}
+    const tool = TOOLS[name]
+    if (!tool) return { jsonrpc: '2.0', id, result: { isError: true, content: [{ type: 'text', text: `unknown tool: ${name}` }] } }
+    try {
+      const out = await tool.handler(args)
+      return { jsonrpc: '2.0', id, result: { content: [{ type: 'text', text: JSON.stringify(redactDeep(out)) }] } }
+    } catch (e) {
+      return { jsonrpc: '2.0', id, result: { isError: true, content: [{ type: 'text', text: JSON.stringify({ ok: false, code: e.code || 'error', message: String(e.message || e).slice(0, 300), tenant: TENANT }) }] } }
+    }
+  }
+  return { jsonrpc: '2.0', id, error: { code: -32601, message: `method not found: ${method}` } }
+}
+
+if (process.argv[1] && /erp-server\.mjs$/.test(process.argv[1])) {
+  process.stdin.setEncoding('utf8')
+  let buf = ''
+  process.stdin.on('data', async (chunk) => {
+    buf += chunk
+    let i
+    while ((i = buf.indexOf('\n')) >= 0) {
+      const line = buf.slice(0, i).trim(); buf = buf.slice(i + 1)
+      if (!line) continue
+      let msg; try { msg = JSON.parse(line) } catch { continue }
+      const out = await handle(msg)
+      if (out) send(out)
+    }
+  })
+  if (!TOKEN) console.error('[argent-erp] ⚠️ 未设置 WHYSHU_API_KEY：工具会返回 no_token')
+}