@yijiancaotang/cli 1.0.0 → 1.2.0

package/dist/project-binding-cli.js

@@ -0,0 +1,110 @@
+import { authStatus } from "./auth.js";
+import { asRecord, CliError } from "./errors.js";
+import { previewProjectBinding, confirmProjectBinding, readProjectBinding, unbindProjectBinding } from "./project-binding.js";
+export function isProjectBindingCommand(command) { return command[0] === "project" && ["bind", "binding", "unbind"].includes(command[1]); }
+function operation(command, flags) { return command[1] === "bind" ? flags.confirm === undefined ? "project_bind_preview" : "project_bind" : command[1] === "unbind" ? flags.confirm === undefined ? "project_unbind_preview" : "project_unbind" : "project_binding"; }
+export function projectBindingLocalScopeOutcome(command, flags) {
+    if (!isProjectBindingCommand(command) || flags["local-workspace"] === true || command[1] === "bind" && flags.confirm === undefined)
+        return;
+    return { result: { status: 200, body: { schema_version: 1, operation: operation(command, flags), status: "local_scope_required", reason: "independent_local_workspace_not_confirmed" } }, exitCode: 2 };
+}
+function serviceOrigin(value) {
+    try {
+        const url = new URL(value);
+        if (typeof value !== "string" || value.trim() !== value || url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname)))
+            throw Error();
+        return url.origin;
+    }
+    catch {
+        throw new CliError("project_binding_origin_unverified", "当前关联操作的服务地址未通过核对。", "保留当前账号和本机元数据，先核对实际服务；不要借环境标签使用另一服务的关联。", 7);
+    }
+}
+const identityError = () => new CliError("invalid_auth_response", "无法核对本次关联操作的账号身份。", "先核对当前连接，不读取旧关联或自动切换账号。", 7);
+const cancelled = (auth) => { if (auth.signal?.aborted)
+    throw new CliError("authorization_cancelled", "本次关联操作已取消。", "需要时重新查看本机预览，不自动确认或重写。", 130); };
+// The caller selects the credential once. Flags carry an already-obtained human
+// decision; neither a flag nor a digest is proof that the human consented.
+export async function createVerifiedProjectBindingConnection(auth, selectedToken, options) {
+    cancelled(auth);
+    const origin = serviceOrigin(auth.api.baseUrl);
+    if (auth.store.origin !== origin || options.expectedOrigin !== undefined && serviceOrigin(options.expectedOrigin) !== origin)
+        throw identityError();
+    const who = asRecord((await authStatus({ ...auth, tokenOverride: selectedToken })).body);
+    if (!who || who.status !== "authenticated" || typeof who.user_id !== "string" || !/^[A-Za-z0-9_-]{1,128}$/.test(who.user_id) || serviceOrigin(auth.api.baseUrl) !== origin || auth.store.origin !== origin)
+        throw identityError();
+    const owner = who.user_id;
+    let validation;
+    const context = {
+        homeDir: options.homeDir, cwd: options.cwd, apiBaseUrl: origin, serviceBase: "/api/v1/agent", verifiedOwnerId: owner, localScopeConfirmed: options.localScopeConfirmed === true,
+        async readProject(id) {
+            cancelled(auth);
+            if (serviceOrigin(auth.api.baseUrl) !== origin || auth.store.origin !== origin)
+                throw identityError();
+            let response;
+            try {
+                response = await auth.api.request(`/api/v1/agent/m1/projects/${encodeURIComponent(id)}`, { method: "GET", token: selectedToken, signal: auth.signal });
+            }
+            catch {
+                validation = { reason: auth.signal?.aborted ? "cancelled" : "transport_unavailable" };
+                throw new CliError("project_binding_target_unverified", "未核实关联目标。", "保留本机元数据，不自动确认或重试。", auth.signal?.aborted ? 130 : 7);
+            }
+            cancelled(auth);
+            if (response.status === 403 || response.status === 404) {
+                validation = { reason: response.status === 403 ? "permission_denied" : "not_found_or_unreadable", http_status: response.status };
+                return null;
+            }
+            if (response.status !== 200) {
+                validation = { reason: response.status === 401 ? "authorization_unverified" : response.status >= 500 ? "server_unavailable" : "project_response_unverified", http_status: response.status };
+                throw new CliError("project_binding_target_unverified", "未核实关联目标。", "保留本机元数据，不自动确认、重试或扩大读取。", response.status === 401 ? 3 : 7);
+            }
+            const body = asRecord(response.body), project = asRecord(body?.project);
+            // This existing endpoint reads the one necessary project context, not a
+            // zero-content metadata API. Binding never receives summary/updates/cards.
+            if (!body || Object.hasOwn(body, "code") || Object.hasOwn(body, "error") || !project || project.owner_id !== owner || typeof project.id !== "string" || project.id.toLowerCase() !== id.toLowerCase() || typeof project.title !== "string" || typeof project.status !== "string" || serviceOrigin(auth.api.baseUrl) !== origin || auth.store.origin !== origin) {
+                validation = { reason: "project_owner_or_metadata_unverified", http_status: 200 };
+                throw new CliError("project_binding_target_unverified", "未核实关联目标的归属或元数据。", "保留本机元数据，不根据旧项目名称猜测或确认。", 7);
+            }
+            return { id: project.id, title: project.title, status: project.status };
+        },
+    };
+    return { context, projectCheck: () => validation };
+}
+function outcomeExit(body, check) {
+    if (["bound", "unbound", "not_bound", "confirmation_required"].includes(body.status))
+        return 0;
+    if (check?.reason === "cancelled")
+        return 130;
+    if (check?.http_status === 401)
+        return 3;
+    if (check?.http_status === 403)
+        return 4;
+    if (body.status === "unknown")
+        return body.reason === "project_binding_update_unknown" || body.reason === "project_binding_busy" ? 6 : 7;
+    return 2;
+}
+export async function executeProjectBindingCLI(command, flags, options) {
+    const scope = projectBindingLocalScopeOutcome(command, flags);
+    if (scope)
+        return scope;
+    let connection;
+    try {
+        connection = await createVerifiedProjectBindingConnection(options.auth, options.token, options);
+    }
+    catch (error) {
+        const known = error instanceof CliError ? error : undefined;
+        const http = asRecord(known?.details)?.http_status;
+        return { result: { status: 200, body: { schema_version: 1, operation: operation(command, flags), status: "unknown", reason: "identity_validation_unavailable", identity_check: { reason: known?.code === "unauthorized" ? "authorization_unverified" : known?.code === "project_binding_origin_unverified" ? "service_origin_unverified" : known?.exitCode === 130 ? "cancelled" : "identity_unverified", ...(typeof http === "number" ? { http_status: http } : {}) } } }, exitCode: known?.exitCode === 130 ? 130 : known?.code === "unauthorized" ? 3 : known?.exitCode === 4 ? 4 : 7 };
+    }
+    cancelled(options.auth);
+    let body;
+    if (command[1] === "bind") {
+        const binding = { projectId: command[2], includeSubdirs: flags["include-subdirs"] === true };
+        body = flags.confirm === undefined ? await previewProjectBinding(connection.context, binding) : await confirmProjectBinding(connection.context, { ...binding, previewDigest: String(flags.confirm), localScopeConfirmed: true });
+    }
+    else if (command[1] === "binding")
+        body = await readProjectBinding(connection.context);
+    else
+        body = await unbindProjectBinding(connection.context, { ...(flags.confirm === undefined ? {} : { previewDigest: String(flags.confirm), localScopeConfirmed: true }) });
+    const check = connection.projectCheck();
+    return { result: { status: 200, body: { ...body, ...(check ? { project_check: check } : {}) } }, exitCode: outcomeExit(body, check) };
+}

package/dist/project-binding.js

@@ -0,0 +1,370 @@
+import { createHash, randomBytes } from "node:crypto";
+import { lstat, realpath } from "node:fs/promises";
+import { isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { asRecord, CliError } from "./errors.js";
+import { OwnedTree } from "./installation.js";
+import { acquireLocalLock } from "./local-lock.js";
+const serviceBase = "/api/v1/agent";
+const maxMapBytes = 256 * 1024;
+const maxEntries = 256;
+const hash = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const uuid = (value) => typeof value === "string" && /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value);
+const ownerID = (value) => typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
+const hex = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+const keys = (value, expected) => Object.keys(value).sort().join(",") === [...expected].sort().join(",");
+const safePath = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && isAbsolute(value) && resolve(value) === value && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(value);
+const within = (parent, child) => { const part = relative(parent, child); return part !== ".." && !part.startsWith(`..${sep}`) && !isAbsolute(part); };
+const sameIdentity = (a, b) => a.dev === b.dev && a.ino === b.ino && a.uid === b.uid;
+const sameFacts = (a, b) => a.canonical_path === b.canonical_path && sameIdentity(a, b) && a.mode === b.mode;
+class StateError extends Error {
+    reason;
+    constructor(reason) {
+        super("Local project binding metadata is unavailable or unsafe");
+        this.reason = reason;
+    }
+}
+function result(operation, status, reason) { return { schema_version: 1, operation, status, ...(reason ? { reason } : {}) }; }
+function changedPreview() { throw new CliError("project_binding_preview_changed", "本机项目关联的确认范围已变化，未写入。", "重新查看当前目录、账号、服务和项目的预览；摘要不能替代本人明确同意。", 2); }
+function projectOptions(options) {
+    if (!options || !uuid(options.projectId) || options.includeSubdirs !== undefined && typeof options.includeSubdirs !== "boolean")
+        throw new CliError("invalid_arguments", "项目关联参数无效。", "指定真实项目ID；子目录范围须单独预览确认，不扫描目录或猜测同名项目。", 2);
+    return { projectId: options.projectId.toLowerCase(), includeSubdirs: options.includeSubdirs === true };
+}
+function identity(ctx) {
+    if (!ownerID(ctx.verifiedOwnerId) || ctx.serviceBase !== serviceBase || typeof ctx.apiBaseUrl !== "string" || ctx.apiBaseUrl.trim() !== ctx.apiBaseUrl)
+        return;
+    try {
+        const url = new URL(ctx.apiBaseUrl);
+        if (url.username || url.password || url.search || url.hash || url.pathname !== "/" || (url.protocol !== "https:" && !(url.protocol === "http:" && ["127.0.0.1", "localhost", "[::1]"].includes(url.hostname))))
+            return;
+        return { origin: url.origin, owner: ctx.verifiedOwnerId };
+    }
+    catch {
+        return;
+    }
+}
+async function directoryFacts(path) {
+    if (!safePath(path) || typeof process.getuid !== "function")
+        throw new StateError("directory_unsafe");
+    const uid = process.getuid(), root = parse(path).root, ancestors = [];
+    let current = root;
+    for (const part of [null, ...relative(root, path).split(sep).filter(Boolean)]) {
+        if (part !== null)
+            current = join(current, part);
+        const info = await lstat(current, { bigint: true }), mode = Number(info.mode & 4095n), owner = Number(info.uid), final = current === path;
+        const stickySystemAncestor = !final && owner === 0 && (mode & 0o1000) !== 0;
+        if (!info.isDirectory() || (final ? owner !== uid : owner !== uid && owner !== 0) || (mode & 0o022) !== 0 && !stickySystemAncestor)
+            throw new StateError("directory_unsafe");
+        ancestors.push({ canonical_path: current, dev: info.dev.toString(), ino: info.ino.toString(), uid: owner, mode });
+    }
+    if (await realpath(path) !== path)
+        throw new StateError("directory_unsafe");
+    return { facts: ancestors.at(-1), ancestors };
+}
+async function base(ctx, operation, requireLocal) {
+    if (requireLocal && ctx.localScopeConfirmed !== true)
+        return result(operation, "local_scope_required", "independent_local_workspace_not_confirmed");
+    const who = identity(ctx);
+    if (!who || typeof ctx.readProject !== "function")
+        return result(operation, "unknown", "identity_or_service_unverified");
+    try {
+        const home = await directoryFacts(ctx.homeDir), directory = await directoryFacts(ctx.cwd), tree = new OwnedTree(ctx.homeDir);
+        await tree.directory(ctx.homeDir, false, async () => true);
+        return { tree, home: home.facts, directory: directory.facts, ancestors: directory.ancestors, uid: process.getuid(), ...who, root: join(ctx.homeDir, ".caotang", "project-bindings") };
+    }
+    catch {
+        return result(operation, "invalid", "directory_unsafe_or_changed");
+    }
+}
+function isBase(value) { return "tree" in value; }
+function metadata(b) { return { service: { origin: b.origin, service_base: serviceBase }, owner_id: b.owner }; }
+async function verifyBase(ctx, b) {
+    const who = identity(ctx);
+    if (ctx.localScopeConfirmed !== true || !who || who.origin !== b.origin || who.owner !== b.owner
+        || !sameFacts((await directoryFacts(ctx.homeDir)).facts, b.home) || !sameFacts((await directoryFacts(ctx.cwd)).facts, b.directory))
+        throw new StateError("scope_changed");
+}
+async function checkedProject(ctx, id, operation) {
+    let value;
+    try {
+        value = await ctx.readProject(id);
+    }
+    catch {
+        return result(operation, "unknown", "project_validation_unavailable");
+    }
+    if (!value)
+        return result(operation, "invalid", "project_not_accessible");
+    if (["hidden", "archived", "deleted"].includes(value.status))
+        return result(operation, "invalid", "project_not_eligible");
+    if (!uuid(value.id) || value.id.toLowerCase() !== id || !["active", "paused", "draft"].includes(value.status)
+        || typeof value.title !== "string" || !value.title.trim() || [...value.title].length > 80 || /[\p{Cc}\uD800-\uDFFF]/u.test(value.title))
+        return result(operation, "unknown", "project_metadata_unverified");
+    return { id, title: value.title, status: value.status };
+}
+function isProject(value) { return "id" in value; }
+function bindDigest(b, project, includeSubdirs) {
+    return hash(JSON.stringify({ schema_version: 1, operation: "bind", home: b.home, directory: b.directory, uid: b.uid, origin: b.origin, service_base: serviceBase, owner_id: b.owner, project, include_subdirs: includeSubdirs, scope: "independent_local_only" }));
+}
+async function bindingPreview(ctx, options) {
+    const wanted = projectOptions(options), operation = "project_bind_preview", b = await base(ctx, operation, false);
+    if (!isBase(b))
+        return b;
+    const project = await checkedProject(ctx, wanted.projectId, operation);
+    if (!isProject(project))
+        return project;
+    try {
+        if (!sameFacts((await directoryFacts(ctx.cwd)).facts, b.directory) || !sameFacts((await directoryFacts(ctx.homeDir)).facts, b.home))
+            return result(operation, "invalid", "directory_changed_during_preview");
+    }
+    catch {
+        return result(operation, "invalid", "directory_changed_during_preview");
+    }
+    return { b, project, includeSubdirs: wanted.includeSubdirs, preview: {
+            ...result(operation, "confirmation_required"), ...metadata(b), directory: { canonical_path: b.directory.canonical_path, include_subdirs: wanted.includeSubdirs }, project,
+            preview_digest: bindDigest(b, project, wanted.includeSubdirs), requires_local_scope_confirmation: true, local_write_only: true,
+        } };
+}
+export async function previewProjectBinding(ctx, options) {
+    const outcome = await bindingPreview(ctx, options);
+    return "preview" in outcome ? outcome.preview : outcome;
+}
+function storedFacts(value) {
+    const v = asRecord(value);
+    if (!v || !keys(v, ["canonical_path", "dev", "ino", "uid", "mode"]) || !safePath(v.canonical_path)
+        || typeof v.dev !== "string" || !/^\d{1,40}$/.test(v.dev) || typeof v.ino !== "string" || !/^\d{1,40}$/.test(v.ino)
+        || typeof v.uid !== "number" || !Number.isSafeInteger(v.uid) || v.uid < 0 || typeof v.mode !== "number" || !Number.isInteger(v.mode) || v.mode < 0 || v.mode > 0o7777)
+        throw new StateError("local_metadata_malformed");
+    return { canonical_path: v.canonical_path, dev: v.dev, ino: v.ino, uid: v.uid, mode: v.mode };
+}
+function json(bytes) {
+    try {
+        const raw = bytes.toString("utf8");
+        if (!Buffer.from(raw, "utf8").equals(bytes))
+            throw Error();
+        const value = asRecord(JSON.parse(raw));
+        if (!value)
+            throw Error();
+        return value;
+    }
+    catch {
+        throw new StateError("local_metadata_malformed");
+    }
+}
+async function localState(b, create) {
+    const path = join(b.root, "local-state.json");
+    let bytes = await b.tree.read(path, 16384, 0o600);
+    if (!bytes && create) {
+        const fresh = { schema_version: 1, scope: "user_confirmed_independent_local", local_state_id: randomBytes(32).toString("hex"), home: b.home };
+        try {
+            await b.tree.writeNew(path, Buffer.from(JSON.stringify(fresh)), 0o600);
+        }
+        catch (error) {
+            if (!(error instanceof CliError) || error.code !== "installation_conflict")
+                throw error;
+        }
+        bytes = await b.tree.read(path, 16384, 0o600);
+        if (!bytes)
+            throw new StateError("local_state_unconfirmed");
+    }
+    if (!bytes)
+        return null;
+    const value = json(bytes);
+    if (!keys(value, ["schema_version", "scope", "local_state_id", "home"]) || value.schema_version !== 1 || value.scope !== "user_confirmed_independent_local" || !hex(value.local_state_id))
+        throw new StateError("local_metadata_malformed");
+    const home = storedFacts(value.home);
+    if (!sameFacts(home, b.home))
+        throw new StateError("local_home_identity_changed");
+    return { schema_version: 1, scope: "user_confirmed_independent_local", local_state_id: value.local_state_id, home };
+}
+function namespace(b, state) {
+    return hash(JSON.stringify({ schema_version: 1, local_state_id: state.local_state_id, home: state.home, uid: b.uid, origin: b.origin, service_base: serviceBase, owner_id: b.owner }));
+}
+async function storedMap(b, state) {
+    const ns = namespace(b, state), directory = join(b.root, "namespaces", ns), path = join(directory, "bindings.json"), bytes = await b.tree.read(path, maxMapBytes, 0o600);
+    if (!bytes)
+        return { namespace: ns, path, directory, bytes: null, value: { schema_version: 1, namespace: ns, entries: [] } };
+    const value = json(bytes);
+    if (!keys(value, ["schema_version", "namespace", "entries"]) || value.schema_version !== 1 || value.namespace !== ns || !Array.isArray(value.entries) || value.entries.length > maxEntries)
+        throw new StateError("local_metadata_malformed");
+    const entries = value.entries.map((raw) => {
+        const item = asRecord(raw);
+        if (!item || !keys(item, ["directory", "project_id", "include_subdirs"]) || !uuid(item.project_id) || typeof item.include_subdirs !== "boolean")
+            throw new StateError("local_metadata_malformed");
+        const directory = storedFacts(item.directory);
+        if (directory.uid !== b.uid)
+            throw new StateError("local_metadata_malformed");
+        return { directory, project_id: item.project_id.toLowerCase(), include_subdirs: item.include_subdirs };
+    });
+    if (new Set(entries.map(entry => entry.directory.canonical_path)).size !== entries.length)
+        throw new StateError("local_metadata_malformed");
+    return { namespace: ns, path, directory, bytes, value: { schema_version: 1, namespace: ns, entries } };
+}
+function selection(b, entries) {
+    const candidates = entries.filter(entry => entry.directory.canonical_path === b.directory.canonical_path || entry.include_subdirs && within(entry.directory.canonical_path, b.directory.canonical_path))
+        .sort((a, z) => z.directory.canonical_path.length - a.directory.canonical_path.length);
+    if (candidates.length)
+        return { entry: candidates[0], inherited: candidates[0].directory.canonical_path !== b.directory.canonical_path };
+    const moved = entries.some(entry => sameIdentity(entry.directory, b.directory) || entry.include_subdirs && b.ancestors.some(ancestor => sameIdentity(entry.directory, ancestor)));
+    return { moved };
+}
+function stateFailure(operation, error) {
+    if (error instanceof StateError)
+        return result(operation, "invalid", error.reason);
+    if (error instanceof CliError && ["project_binding_busy", "project_binding_update_unknown"].includes(error.code))
+        return result(operation, "unknown", error.code);
+    return result(operation, "invalid", "local_state_unsafe_or_unavailable");
+}
+async function changeMap(b, map, entries) {
+    if (entries.length > maxEntries)
+        throw new StateError("local_binding_capacity_exceeded");
+    const value = { schema_version: 1, namespace: map.namespace, entries: [...entries].sort((a, z) => a.directory.canonical_path.localeCompare(z.directory.canonical_path)) };
+    const after = Buffer.from(JSON.stringify(value));
+    if (after.length > maxMapBytes)
+        throw new StateError("local_binding_capacity_exceeded");
+    if (map.bytes?.equals(after))
+        return false;
+    let writeAttempted = false;
+    try {
+        if (!map.bytes) {
+            writeAttempted = true;
+            await b.tree.writeNew(map.path, after, 0o600);
+        }
+        else {
+            const journal = Buffer.from(JSON.stringify({ schema_version: 1, before_sha256: hash(map.bytes), after_sha256: hash(after), before_base64: map.bytes.toString("base64"), after_base64: after.toString("base64") }));
+            await b.tree.writeNew(join(map.directory, "history", `${hash(map.bytes)}.${hash(after)}.json`), journal, 0o600);
+            const entry = { path: map.path, before: map.bytes, after, mode: 0o600, label: "project_bindings" };
+            writeAttempted = true;
+            try {
+                await b.tree.replaceManaged(entry);
+            }
+            catch {
+                try {
+                    await b.tree.replaceManaged(entry, true);
+                }
+                catch { /* Keep recovery bytes; never reset an unverified inode. */ }
+                throw new StateError("local_update_unconfirmed");
+            }
+        }
+        if (!(await b.tree.read(map.path, maxMapBytes, 0o600))?.equals(after))
+            throw new StateError("local_update_unconfirmed");
+    }
+    catch (error) {
+        if (!writeAttempted)
+            throw error;
+        throw new CliError("project_binding_update_unknown", "本机关联更新未完成最终核对。", "保留现有元数据和恢复记录，由本人核对；不要自动重写或影响草堂项目。", 6);
+    }
+    return true;
+}
+async function locked(b, state, action) {
+    const ns = namespace(b, state), directory = join(b.root, "namespaces", ns), lockPath = join(directory, ".binding.lock");
+    const release = await b.tree.directory(directory, true, async (parents) => acquireLocalLock(lockPath, parents.at(-1), {
+        unsafe: () => new StateError("local_lock_unsafe"),
+        busy: () => new CliError("project_binding_busy", "另一项本机项目关联操作未完成。", "先等待本机操作结束；状态未知时不要删锁或强制覆盖。", 6),
+    }));
+    if (!release)
+        throw new StateError("local_lock_unavailable");
+    try {
+        return await action(await storedMap(b, state));
+    }
+    finally {
+        release();
+    }
+}
+export async function confirmProjectBinding(ctx, options) {
+    const operation = "project_bind";
+    if (ctx.localScopeConfirmed !== true || options.localScopeConfirmed !== true)
+        return result(operation, "local_scope_required", "independent_local_workspace_not_confirmed");
+    const outcome = await bindingPreview(ctx, options);
+    if (!("preview" in outcome))
+        return { ...outcome, operation };
+    if (!hex(options.previewDigest) || options.previewDigest !== outcome.preview.preview_digest)
+        changedPreview();
+    const { b, project, includeSubdirs } = outcome;
+    try {
+        await verifyBase(ctx, b);
+        const state = await localState(b, true);
+        if (!state)
+            throw new StateError("local_state_unconfirmed");
+        const changed = await locked(b, state, async (map) => {
+            await verifyBase(ctx, b);
+            const entries = map.value.entries.filter(entry => entry.directory.canonical_path !== b.directory.canonical_path);
+            entries.push({ directory: b.directory, project_id: project.id, include_subdirs: includeSubdirs });
+            return changeMap(b, map, entries);
+        });
+        return { ...result(operation, "bound"), ...metadata(b), directory: { canonical_path: b.directory.canonical_path, include_subdirs: includeSubdirs }, project, inherited: false, changed, local_write_only: true };
+    }
+    catch (error) {
+        return stateFailure(operation, error);
+    }
+}
+export async function readProjectBinding(ctx) {
+    const operation = "project_binding", b = await base(ctx, operation, true);
+    if (!isBase(b))
+        return b;
+    try {
+        const state = await localState(b, false);
+        if (!state)
+            return result(operation, "not_bound", "no_local_state_in_current_scope");
+        const map = await storedMap(b, state), chosen = selection(b, map.value.entries);
+        if (!chosen.entry)
+            return result(operation, chosen.moved ? "invalid" : "not_bound", chosen.moved ? "directory_moved" : "no_binding_in_current_scope");
+        const entry = chosen.entry;
+        if (!sameFacts((await directoryFacts(entry.directory.canonical_path)).facts, entry.directory))
+            return result(operation, "invalid", "directory_identity_changed");
+        const project = await checkedProject(ctx, entry.project_id, operation);
+        if (!isProject(project))
+            return project;
+        await verifyBase(ctx, b);
+        // A different local operation may have changed the map while the project
+        // validation was awaiting the server. Never label that old selection current.
+        const currentState = await localState(b, false);
+        if (!currentState || currentState.local_state_id !== state.local_state_id || !map.bytes
+            || !(await b.tree.read(map.path, maxMapBytes, 0o600))?.equals(map.bytes))
+            return result(operation, "unknown", "binding_changed_during_validation");
+        return { ...result(operation, "bound"), ...metadata(b), directory: { canonical_path: entry.directory.canonical_path, include_subdirs: entry.include_subdirs }, project, inherited: chosen.inherited === true };
+    }
+    catch (error) {
+        return stateFailure(operation, error);
+    }
+}
+function unbindDigest(b, map, entry) {
+    return hash(JSON.stringify({ schema_version: 1, operation: "unbind_exact", home: b.home, directory: b.directory, origin: b.origin, service_base: serviceBase, owner_id: b.owner, namespace: map.namespace, map_sha256: hash(map.bytes), entry }));
+}
+export async function unbindProjectBinding(ctx, options = {}) {
+    const operation = options.previewDigest === undefined ? "project_unbind_preview" : "project_unbind", b = await base(ctx, operation, true);
+    if (!isBase(b))
+        return b;
+    if (options.previewDigest !== undefined && options.localScopeConfirmed !== true)
+        return result(operation, "local_scope_required", "independent_local_workspace_not_confirmed");
+    try {
+        const state = await localState(b, false);
+        if (!state)
+            return result(operation, "not_bound", "no_local_state_in_current_scope");
+        const map = await storedMap(b, state), exact = map.value.entries.find(entry => entry.directory.canonical_path === b.directory.canonical_path);
+        if (!exact) {
+            const inherited = selection(b, map.value.entries).entry;
+            return result(operation, inherited ? "inherited_binding_requires_root" : "not_bound", inherited ? "confirm_at_exact_binding_directory" : "no_binding_in_current_scope");
+        }
+        if (!map.bytes)
+            throw new StateError("local_metadata_malformed");
+        const digest = unbindDigest(b, map, exact);
+        if (options.previewDigest === undefined)
+            return { ...result(operation, "confirmation_required"), ...metadata(b), directory: { canonical_path: b.directory.canonical_path, include_subdirs: exact.include_subdirs }, preview_digest: digest, requires_local_scope_confirmation: true, local_write_only: true };
+        if (!hex(options.previewDigest) || options.previewDigest !== digest)
+            changedPreview();
+        await verifyBase(ctx, b);
+        const changed = await locked(b, state, async (current) => {
+            const row = current.value.entries.find(entry => entry.directory.canonical_path === b.directory.canonical_path);
+            if (!row || !current.bytes || unbindDigest(b, current, row) !== options.previewDigest)
+                changedPreview();
+            await verifyBase(ctx, b);
+            return changeMap(b, current, current.value.entries.filter(entry => entry.directory.canonical_path !== b.directory.canonical_path));
+        });
+        return { ...result(operation, "unbound"), ...metadata(b), directory: { canonical_path: b.directory.canonical_path, include_subdirs: exact.include_subdirs }, changed, local_write_only: true };
+    }
+    catch (error) {
+        if (error instanceof CliError && error.code === "project_binding_preview_changed")
+            throw error;
+        return stateFailure(operation, error);
+    }
+}

package/dist/query-search.js

@@ -30,10 +30,11 @@ export function expectSearchOK(result) {
     }
     const body = asRecord(result.body), code = body?.code ?? body?.error;
     if (result.status === 403 && code === "capability_disabled" && (body?.code === undefined || body.code === code) && (body?.error === undefined || body.error === code)) {
-        const expected = [{ section: "search_projects", required_capability: "read_projects", reason: "capability_disabled" }, { section: "search_knowledge", required_capability: "read_knowledge", reason: "capability_disabled" }];
         const rows = Array.isArray(body?.missing_sections) ? body.missing_sections : [];
+        const schedule = rows.some(row => { const item = asRecord(row); return item?.section === "search_schedule_items" || item?.required_capability === "read_workbench"; });
+        const expected = [{ section: "search_projects", required_capability: "read_projects", reason: "capability_disabled" }, { section: "search_knowledge", required_capability: "read_knowledge", reason: "capability_disabled" }, ...(schedule ? [{ section: "search_schedule_items", required_capability: "read_workbench", reason: "capability_disabled" }] : [])];
         if (!Object.hasOwn(body, "required_capability") && expected.every(want => rows.some(row => { const item = asRecord(row); return item?.section === want.section && item.required_capability === want.required_capability && item.reason === want.reason; }))) {
-            throw new CliError("capability_disabled", "“读取项目”和“读取知识”开关都未开启。", "请本人到网页的 Agent 管理核对并开启所需开关；不要重新授权、换入口或重试来绕过限制。", 4, { http_status: 403, missing_sections: expected });
+            throw new CliError("capability_disabled", schedule ? "“读取项目”、“读取知识”和“读取工作台”开关都未开启。" : "“读取项目”和“读取知识”开关都未开启。", "请本人到网页的 Agent 管理核对并开启所需开关；不要重新授权、换入口或重试来绕过限制。", 4, { http_status: 403, missing_sections: expected });
         }
     }
     const checked = expectQueryOK(result);