@yijiancaotang/cli 0.0.0-stage → 1.0.0

package/dist/auth.js

@@ -0,0 +1,337 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { dirname, isAbsolute, join, normalize } from "node:path";
+import { CliError, expectOK, apiError, asRecord, validToken, legalConsentRequiredError } from "./errors.js";
+import { approvalMessage, connectionCopy } from "./connection-copy.js";
+import { productionOrigin } from "./config.js";
+const prefix = "/api/v1/agent";
+const recovery = "请先到网页的 Agent 管理核对是否已生成连接，并用 caotang auth status 核对本机。若网页已有但本机未保存，请由本人确认吊销该连接后再决定是否重新接入；不要自动重试领取令牌或补签。";
+const deliveryUnknown = () => new CliError("authorization_delivery_unknown", "暂时无法确认是否已接好，连接可能已经生成。", recovery, 6, { user_message: connectionCopy.uncertain });
+export function credentialTarget(ctx, failure) {
+    const path = ctx.store.path;
+    if (typeof path !== "string" || path.length > 4096 || !isAbsolute(path) || normalize(path) !== path || /[\x00-\x1f\x7f]/.test(path))
+        return {};
+    const current = dirname(path), legacy = join(dirname(current), ".caotang");
+    const reported = asRecord(asRecord(failure)?.details)?.target_directory;
+    return { target_directory: reported === current || reported === legacy ? reported : current };
+}
+function authorizationCode(value) {
+    const body = asRecord(value);
+    if (body?.code !== undefined && body.error !== undefined && body.code !== body.error)
+        throw deliveryUnknown();
+    return body?.code ?? body?.error;
+}
+function hasAuthorizationErrorStatus(value) {
+    const body = asRecord(value);
+    return body !== null && (Object.hasOwn(body, "code") || Object.hasOwn(body, "error"));
+}
+const invalid = () => new CliError("invalid_auth_response", "无法确认授权响应。", recovery, 7);
+const cancelled = () => new CliError("authorization_cancelled", "授权操作已取消。", "请先在网页核对实际状态，再决定是否重新授权。", 130);
+const expired = () => new CliError("expired_token", "确认码已过期，这次没有完成接入。", "需要接入时，请由本人重新运行 setup 或 auth login，取得新确认码后批准。", 2, { user_message: connectionCopy.expired });
+const id = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
+const scope = (value) => value === "read_only" || value === "read_write";
+const date = (value) => typeof value === "string" && /^\d{4}-\d\d-\d\dT/.test(value) && Number.isFinite(Date.parse(value));
+const label = (value) => typeof value === "string" && value.trim() === value && [...value].length >= 1 && [...value].length <= 80 && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\t\n\r]/u.test(value) && !/[^\S ]/u.test(value);
+const checkAbort = (ctx) => { if (ctx.signal?.aborted)
+    throw cancelled(); };
+function origin(ctx) {
+    let url;
+    try {
+        url = new URL(ctx.api.baseUrl);
+    }
+    catch {
+        throw invalid();
+    }
+    if (url.username || url.password || url.search || url.hash || !["https:", "http:"].includes(url.protocol) || ctx.store.origin !== url.origin)
+        throw invalid();
+    return url.origin;
+}
+async function request(ctx, path, options) {
+    checkAbort(ctx);
+    try {
+        return await ctx.api.request(path, { ...options, signal: ctx.signal });
+    }
+    catch (error) {
+        checkAbort(ctx);
+        if (error instanceof CliError)
+            throw error;
+        throw new CliError("network_error", "无法确认授权请求的结果。", "请先在网页核对实际状态，不要直接重复授权。", 6);
+    }
+}
+export async function resolveCredential(ctx) {
+    checkAbort(ctx);
+    origin(ctx);
+    if (ctx.tokenOverride !== undefined) {
+        if (!validToken(ctx.tokenOverride))
+            throw new CliError("invalid_token", "环境中的授权令牌格式无效。", "请检查或取消当前环境的令牌覆盖；覆盖无效时不会回退读取文件。", 3);
+        return { token: ctx.tokenOverride, source: "environment" };
+    }
+    const record = await ctx.store.load();
+    if (!record)
+        throw new CliError("unauthorized", "当前环境尚未授权。", "请用你自己的名字运行 setup --agent <你的名字>，再由本人在网页批准。", 3);
+    return { token: record.token, source: "file" };
+}
+function identity(value, secrets = []) {
+    const body = asRecord(value);
+    if (!body || !id(body.user_id) || !id(body.token_id) || !scope(body.scope) || (body.kind !== "device" && body.kind !== "manual"))
+        throw invalid();
+    const forbidden = [...secrets, body.access_token, body.device_code].filter((item) => typeof item === "string" && item.length > 0);
+    if ([body.user_id, body.token_id].some((value) => forbidden.some((secret) => value.includes(secret))))
+        throw invalid();
+    const display = body.account_display_name;
+    const safeDisplay = typeof display === "string" && label(display) && [...display].length <= 40
+        && /^[\p{L}\p{N}\p{M} ._-]+$/u.test(display) && !forbidden.some(secret => display.includes(secret)) ? display : undefined;
+    return { user_id: body.user_id, token_id: body.token_id, kind: body.kind, scope: body.scope, ...(safeDisplay ? { account_display_name: safeDisplay } : {}) };
+}
+async function validate(ctx, credential, allowPendingConsent = false) {
+    const response = await request(ctx, `${prefix}/mcp-token/validate`, { method: "POST", token: credential.token });
+    if (response.status === 401)
+        throw new CliError("unauthorized", "这个 AI 的连接已断开，请重新接入。", "请带同一个 --agent <你的名字> 运行 setup，由本人批准；其它 AI 的连接不受影响，不要输出凭据。", 3, { http_status: 401, user_message: connectionCopy.disconnected });
+    const result = expectOK(response);
+    if (result.status !== 200 || hasAuthorizationErrorStatus(result.body))
+        throw invalid();
+    const who = identity(result.body, [credential.token]);
+    const pending = asRecord(result.body)?.legal_consent_required;
+    if (pending !== undefined && typeof pending !== "boolean")
+        throw invalid();
+    if (pending === true && !allowPendingConsent)
+        throw legalConsentRequiredError(result.status);
+    return who;
+}
+function authenticated(who, credential) {
+    return { status: 200, body: { status: "authenticated", source: credential.source, ...who, user_message: connectionCopy.connected } };
+}
+export async function authStatus(ctx) {
+    const credential = await resolveCredential(ctx);
+    const result = authenticated(await validate(ctx, credential), credential);
+    return { ...result, body: { ...asRecord(result.body), environment: ctx.environment ?? (ctx.api.baseUrl === "https://test.gtcai.cn" ? "test" : ctx.api.baseUrl === productionOrigin ? "production" : "unknown") } };
+}
+async function wait(ctx, ms) {
+    checkAbort(ctx);
+    if (!ctx.sleep) {
+        try {
+            await delay(ms, undefined, { signal: ctx.signal });
+        }
+        catch {
+            throw cancelled();
+        }
+    }
+    else {
+        let listener;
+        try {
+            await Promise.race([
+                ctx.sleep(ms),
+                new Promise((_, reject) => {
+                    listener = () => reject(cancelled());
+                    ctx.signal?.addEventListener("abort", listener, { once: true });
+                    if (ctx.signal?.aborted)
+                        listener();
+                }),
+            ]);
+        }
+        finally {
+            if (listener)
+                ctx.signal?.removeEventListener("abort", listener);
+        }
+    }
+    checkAbort(ctx);
+}
+function challenge(value, apiOrigin) {
+    const body = asRecord(value);
+    if (!body || typeof body.device_code !== "string" || !/^[A-Za-z0-9_-]{43}$/.test(body.device_code)
+        || Buffer.from(body.device_code, "base64url").length !== 32 || Buffer.from(body.device_code, "base64url").toString("base64url") !== body.device_code
+        || typeof body.user_code !== "string" || !/^[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{4}-[ABCDEFGHJKLMNPQRSTUVWXYZ23456789]{4}$/.test(body.user_code)
+        || body.verification_url !== `${apiOrigin}/app/device-auth`
+        || !Number.isInteger(body.expires_in) || Number(body.expires_in) < 1 || Number(body.expires_in) > 600
+        || !Number.isInteger(body.interval) || Number(body.interval) < 5 || Number(body.interval) > 600)
+        throw invalid();
+    return { deviceCode: body.device_code, interval: Number(body.interval), public: { status: "authorization_pending", user_code: body.user_code, verification_url: body.verification_url, expires_in: Number(body.expires_in), browser_opened: false } };
+}
+function delivered(value, deviceName, clientName, deviceCode) {
+    const body = asRecord(value), metadata = asRecord(body?.token);
+    if (!body || !validToken(body.access_token) || body.token_type !== "Bearer" || !scope(body.scope)
+        || !metadata || !id(metadata.id) || !id(metadata.user_id) || metadata.kind !== "device" || metadata.scope !== body.scope
+        || !date(metadata.created_at) || !label(metadata.device_name) || !label(metadata.client_name)
+        || metadata.device_name !== deviceName || metadata.client_name !== clientName
+        || (metadata.revoked_at !== undefined && metadata.revoked_at !== "")
+        || (metadata.last_used_at !== undefined && !date(metadata.last_used_at)))
+        throw invalid();
+    return { token: body.access_token, who: identity({ user_id: metadata.user_id, token_id: metadata.id, kind: "device", scope: body.scope }, [body.access_token, deviceCode]) };
+}
+function retryAfter(...values) {
+    const present = values.filter((value) => value !== undefined);
+    if (present.some((value) => typeof value !== "number" || !Number.isFinite(value) || value < 0))
+        throw invalid();
+    return Math.max(0, ...present);
+}
+export async function authLogin(ctx, options = {}) {
+    const apiOrigin = origin(ctx);
+    checkAbort(ctx);
+    if (ctx.tokenOverride === undefined)
+        await ctx.store.migrate?.();
+    let existing;
+    try {
+        existing = await resolveCredential(ctx);
+    }
+    catch (error) {
+        if (!(error instanceof CliError) || error.code !== "unauthorized")
+            throw error;
+    }
+    if (existing) {
+        try {
+            const result = authenticated(await validate(ctx, existing), existing);
+            return { ...result, body: { ...asRecord(result.body), authorization_attempted: false, new_authorization_confirmed: false, user_message: connectionCopy.repeated } };
+        }
+        catch (error) {
+            if (!(error instanceof CliError) || error.exitCode !== 3 || asRecord(error.details)?.http_status !== 401 || existing.source === "environment")
+                throw error;
+            await ctx.store.remove(existing.token);
+        }
+    }
+    const deviceName = options.device_name?.trim() ?? ctx.agent?.name ?? "这台电脑";
+    const clientName = options.client_name?.trim() ?? ctx.agent?.name ?? "caotang";
+    if (!label(deviceName) || !label(clientName))
+        throw new CliError("invalid_device_name", "设备名和请求方名称须为1至80个可显示字符。", "请使用简短名称，不要填入密码或令牌。");
+    const now = ctx.now ?? Date.now;
+    const started = now();
+    if (!Number.isFinite(started))
+        throw invalid();
+    const startResponse = await request(ctx, `${prefix}/device-auth/start`, { method: "POST", body: { device_name: deviceName, client_name: clientName } });
+    const startCode = authorizationCode(startResponse.body);
+    if (startResponse.status === 403 && startCode === "access_denied")
+        throw new CliError("access_denied", "这次接入已取消，没有建立新连接。", "只有本人需要时才重新发起接入。", 4, { user_message: connectionCopy.denied });
+    const response = expectOK(startResponse);
+    if (response.status !== 200)
+        throw invalid();
+    if (hasAuthorizationErrorStatus(response.body))
+        throw deliveryUnknown();
+    const grant = challenge(response.body, apiOrigin);
+    const expiresMs = grant.public.expires_in * 1000;
+    let waited = 0, interval = grant.interval, nextWait = Math.max(interval, retryAfter(response.retryAfterSeconds));
+    let consecutiveNetworkFailures = 0, uncertainDelivery = false;
+    const elapsed = () => Math.max(waited, now() - started);
+    if (!options.noOpen && ctx.openBrowser) {
+        checkAbort(ctx);
+        try {
+            grant.public.browser_opened = await ctx.openBrowser(grant.public.verification_url) === true;
+        }
+        catch {
+            grant.public.browser_opened = false;
+        }
+    }
+    checkAbort(ctx);
+    ctx.emitChallenge({ ...grant.public, user_message: approvalMessage(grant.public.verification_url, grant.public.user_code) });
+    while (true) {
+        const remaining = expiresMs - elapsed();
+        if (!Number.isFinite(remaining))
+            throw invalid();
+        if (remaining <= 0)
+            throw uncertainDelivery ? deliveryUnknown() : expired();
+        const pause = Math.min(nextWait * 1000, remaining);
+        await wait(ctx, pause);
+        waited += pause;
+        if (elapsed() >= expiresMs)
+            throw uncertainDelivery ? deliveryUnknown() : expired();
+        let result;
+        try {
+            result = await request(ctx, `${prefix}/device-auth/poll`, { method: "POST", body: { device_code: grant.deviceCode } });
+        }
+        catch (error) {
+            checkAbort(ctx);
+            uncertainDelivery = true;
+            // Re-query the same one-time grant only. A consumed response remains
+            // terminal, and an unknown result never starts or replaces a grant.
+            if (!(error instanceof CliError) || error.code !== "network_error" || ++consecutiveNetworkFailures >= 3)
+                throw deliveryUnknown();
+            nextWait = Math.max(nextWait, interval * consecutiveNetworkFailures);
+            continue;
+        }
+        if (result.status >= 500 && result.status <= 599) {
+            uncertainDelivery = true;
+            if (++consecutiveNetworkFailures >= 3)
+                throw deliveryUnknown();
+            nextWait = Math.max(nextWait, interval * consecutiveNetworkFailures, retryAfter(result.retryAfterSeconds));
+            continue;
+        }
+        const code = authorizationCode(result.body);
+        if (result.status === 200) {
+            if (hasAuthorizationErrorStatus(result.body))
+                throw deliveryUnknown();
+            const token = delivered(result.body, deviceName, clientName, grant.deviceCode);
+            try {
+                await ctx.store.save({ token: token.token, tokenId: token.who.token_id, scope: token.who.scope, kind: "device", origin: apiOrigin, savedAt: new Date(now()).toISOString() });
+            }
+            catch (error) {
+                if (error instanceof CliError && error.code === "installation_permission_denied") {
+                    throw new CliError("installation_permission_denied", "设备令牌已交付，但没有权限保存到本地凭据目录。", recovery, 4, { ...credentialTarget(ctx, error), credential_delivery_confirmed: true });
+                }
+                const links = error instanceof CliError && error.code === "credential_unsafe" && asRecord(error.details)?.reason === "multiple_links";
+                throw new CliError("credential_save_failed", links ? "设备令牌已交付，但凭据文件的链接数不是 1，未能安全保存。" : "设备令牌已交付，但未能安全保存。", recovery, 2, links ? { cause: "credential_unsafe", reason: "multiple_links" } : undefined);
+            }
+            const confirmed = authenticated(token.who, { source: "file" });
+            return { ...confirmed, body: { ...asRecord(confirmed.body), authorization_attempted: true, new_authorization_confirmed: true } };
+        }
+        const body = asRecord(result.body);
+        if ((result.status === 202 && code === "authorization_pending") || (result.status === 429 && (code === "slow_down" || code === "device_auth_rate_limited"))) {
+            if (body?.interval !== undefined && (!Number.isInteger(body.interval) || Number(body.interval) < 5 || Number(body.interval) > 600))
+                throw invalid();
+            interval = Math.max(interval + (code === "slow_down" ? 5 : 0), Number(body?.interval ?? 5));
+            nextWait = Math.max(interval, retryAfter(result.retryAfterSeconds, body?.retry_after_seconds));
+            consecutiveNetworkFailures = 0;
+            if (code === "authorization_pending")
+                uncertainDelivery = false;
+            continue;
+        }
+        if (result.status >= 200 && result.status < 300)
+            throw invalid();
+        if (result.status === 403 && code === "access_denied")
+            throw new CliError("access_denied", "这次接入已取消，没有建立新连接。", "只有本人需要时才重新发起接入。", 4, { user_message: connectionCopy.denied });
+        if (result.status === 410 && code === "expired_token")
+            throw expired();
+        throw apiError(result);
+    }
+}
+export async function authLogout(ctx) {
+    const credential = await resolveCredential(ctx);
+    const removeMatching = async () => { if (credential.source === "file")
+        await ctx.store.remove(credential.token); };
+    const cleanupUnauthorized = async (error) => {
+        try {
+            await removeMatching();
+            return error;
+        }
+        catch (cleanupError) {
+            if (cleanupError instanceof CliError && cleanupError.code === "installation_permission_denied") {
+                return new CliError("installation_permission_denied", "授权已失效，但没有权限清理本地凭据。", "请勿继续使用；先核对目标目录的清空或删除限制，不要重复吊销、自动重新授权或输出凭据。", 4, { ...credentialTarget(ctx, cleanupError), http_status: 401, credential_cleanup_pending: true });
+            }
+            return new CliError("unauthorized", "授权已失效，本地凭证尚未清理完成。", "请勿继续使用；先检查本地文件安全，再处理已失效的凭证，不要输出其内容。", 3, { http_status: 401, credential_cleanup_pending: true });
+        }
+    };
+    let who;
+    try {
+        who = await validate(ctx, credential, true);
+    }
+    catch (error) {
+        if (error instanceof CliError && asRecord(error.details)?.http_status === 401)
+            throw await cleanupUnauthorized(error);
+        throw error;
+    }
+    if (who.kind !== "device")
+        throw new CliError("device_token_required", "此命令只能吊销当前设备令牌。", "手动令牌请在网页管理；本地凭证未被删除。", 4);
+    const result = await request(ctx, `${prefix}/device-token`, { method: "DELETE", token: credential.token });
+    if (result.status === 401)
+        throw await cleanupUnauthorized(apiError(result));
+    expectOK(result);
+    const body = asRecord(result.body), token = asRecord(body?.token);
+    if (result.status !== 200 || body?.status !== "revoked" || !token || token.id !== who.token_id || token.user_id !== who.user_id || token.kind !== "device" || token.scope !== who.scope || !date(token.revoked_at))
+        throw invalid();
+    try {
+        await removeMatching();
+    }
+    catch (error) {
+        if (error instanceof CliError && error.code === "installation_permission_denied") {
+            throw new CliError("installation_permission_denied", "当前设备已吊销，但没有权限清除本地凭据。", "请核对本地凭据目录的清空或删除限制；不要重复吊销、自动重新授权或声称断开完成。", 4, { ...credentialTarget(ctx, error), credential_cleanup_pending: true });
+        }
+        throw new CliError("credential_cleanup_failed", "当前设备已吊销，但本地凭证尚未清理完成。", "请检查本地凭证文件安全；不要重复吊销或自动重新授权。");
+    }
+    return { status: 200, body: { status: "revoked", source: credential.source, ...who, user_message: connectionCopy.disconnected } };
+}

package/dist/capability-result.js

@@ -0,0 +1,80 @@
+import { apiError, asRecord, CliError, expectOK, singleSwitchMetadata, unverifiedSwitchError } from "./errors.js";
+const capabilityActions = {
+    read_notifications: "请在网页检查“读取通知”开关及这台设备的权限。",
+    read_drafts: "请在网页检查“读取草稿”开关及这台设备的权限。",
+    delete_or_archive: "请在网页检查“删除或归档申请”开关及这台设备的读写权限；申请仍需本人在网页确认。",
+};
+export function expectCapabilityResult(result, capability, requestKind) {
+    if (result.status === 403) {
+        const error = apiError(result, requestKind), body = asRecord(result.body);
+        if (error.code === "legal_consent_required" || error.code === "token_scope_insufficient" || error.code === "second_confirmation_required")
+            throw error;
+        if (body && !singleSwitchMetadata(body))
+            throw unverifiedSwitchError();
+        if (body && (Object.hasOwn(body, "required_capability") || (body.code !== undefined && body.error !== undefined && body.code !== body.error))) {
+            if (error.details.required_capability !== undefined && error.details.required_capability !== capability)
+                throw unverifiedSwitchError();
+            throw error;
+        }
+        // Older servers returned bare 403. Offer the known operation's check as
+        // guidance, not a claim that this particular switch was observed closed.
+        const nextAction = capabilityActions[capability];
+        throw new CliError(error.code, "当前操作权限不足。", nextAction, error.exitCode, { ...error.details, required_capability: capability });
+    }
+    return expectOK(result, requestKind);
+}
+// A known switch name is still not evidence if unrelated to this operation.
+export function commandAcceptsSwitch(args, capability) {
+    const [name, op] = args;
+    let eligible;
+    switch (name) {
+        case "knowledge":
+            eligible = op === "add" ? ["write_knowledge", "write_knowledge_sources"] : op === "update" ? ["write_knowledge"] : ["read_knowledge", "read_drafts"];
+            break;
+        case "projects":
+            eligible = ["read_projects", "read_drafts"];
+            break;
+        case "project":
+            eligible = op === "create" || op === "update" ? ["write_project"] : ["read_projects", "read_drafts"];
+            break;
+        case "search":
+        case "activity":
+            eligible = ["read_projects", "read_knowledge"];
+            break;
+        case "progress":
+            eligible = op === "add" ? ["write_project_update"] : ["read_projects"];
+            break;
+        case "checkins":
+            eligible = ["read_projects"];
+            break;
+        case "source":
+        case "upload":
+            eligible = ["write_knowledge_sources"];
+            break;
+        case "link":
+        case "unlink":
+            eligible = ["write_knowledge"];
+            break;
+        case "advance":
+            eligible = ["write_knowledge_stage", "write_project_update"];
+            break;
+        case "cognition":
+            eligible = ["write_project_cognition"];
+            break;
+        case "stage":
+            eligible = ["write_project"];
+            break;
+        case "notifications":
+        case "pending":
+            eligible = ["read_notifications"];
+            break;
+        case "drafts":
+            eligible = ["read_drafts"];
+            break;
+        case "request":
+            eligible = ["delete_or_archive"];
+            break;
+        default: eligible = [];
+    }
+    return typeof capability === "string" && eligible.includes(capability);
+}