@yijiancaotang/cli 1.1.0 → 1.2.1

package/dist/setup-guidance.js

@@ -0,0 +1,40 @@
+import { productionOrigin } from "./config.js";
+import { getAgentOperations } from "./generated/agent-operations.js";
+// Match the existing closed config origins, not an arbitrary apiFactory URL.
+// This reads public metadata only; it never loads a credential or probes an API.
+function currentOrigin(input) {
+    const expected = input.environment === "production" ? productionOrigin : input.environment === "test" ? "https://test.gtcai.cn" : undefined;
+    if (!expected || typeof input.baseUrl !== "string" || input.credentialOrigin !== expected || input.baseUrl.trim() !== input.baseUrl)
+        return undefined;
+    try {
+        const url = new URL(input.baseUrl);
+        if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash || url.pathname !== "/" || url.origin !== expected)
+            return undefined;
+        return url.origin;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function setupGuidance(input) {
+    const operations = getAgentOperations(), origin = currentOrigin(input);
+    const verified = input.connectionVerified === true && origin !== undefined;
+    const name = typeof input.agentName === "string" && input.agentName.trim() === input.agentName && [...input.agentName].length >= 1 && [...input.agentName].length <= 80
+        && !/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(input.agentName) ? input.agentName : undefined;
+    const scope = verified && (input.scope === "read_only" || input.scope === "read_write") ? input.scope : "unknown";
+    return {
+        schema_version: 1,
+        user_experience: { state: "unknown", basis: "not_recorded" },
+        agent_preparation: {
+            status: "required",
+            body_obtained: "unknown",
+            evidence: "not_observable_by_cli",
+            operations: { version: operations.version, sha256: operations.sha256, source: "package_generated", command: "caotang guide", manual_path: operations.manual_path },
+        },
+        presentation_reason: input.ready === true && verified ? "requested" : "not_ready",
+        identity: { verified, ...(verified && name !== undefined ? { agent_name: name } : {}), ...(origin ? { environment: input.environment, origin } : {}) },
+        permissions: { scope, account_capabilities: "unknown", effective_capabilities: "unknown" },
+        entry: { transport: "cli", skill_support: "unknown" },
+        ...(origin ? { manual_url: new URL(operations.manual_path, origin).href } : {}),
+    };
+}

package/dist/skills-export.js

@@ -0,0 +1,206 @@
+import { createHash, randomUUID } from "node:crypto";
+import { constants, closeSync, fstatSync, fsyncSync, linkSync, lstatSync, openSync, readSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, parse, relative, resolve, sep } from "node:path";
+import { asRecord, CliError } from "./errors.js";
+import { getAgentOperations } from "./generated/agent-operations.js";
+import { loadSkillAssets } from "./skill-assets.js";
+const unsafe = () => new CliError("skills_export_path_unsafe", "导出位置未通过安全检查。", "请明确指定一个新ZIP文件，父目录须已存在、属于本人且不是符号链接；不会自动创建目录、改权限或覆盖文件。", 2);
+const exists = () => new CliError("skills_export_exists", "导出目标已存在，未覆盖。", "保留原文件；请本人明确选择一个新的ZIP文件路径。", 2);
+const same = (a, b) => a.dev === b.dev && a.ino === b.ino;
+const missing = (error) => asRecord(error)?.code === "ENOENT";
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const crcTable = Uint32Array.from({ length: 256 }, (_, index) => {
+    let value = index;
+    for (let bit = 0; bit < 8; bit++)
+        value = value & 1 ? 0xedb88320 ^ (value >>> 1) : value >>> 1;
+    return value >>> 0;
+});
+function crc32(bytes) {
+    let crc = 0xffffffff;
+    for (const byte of bytes)
+        crc = crcTable[(crc ^ byte) & 0xff] ^ (crc >>> 8);
+    return (crc ^ 0xffffffff) >>> 0;
+}
+function zip(entries) {
+    if (entries.length > 32 || entries.reduce((total, entry) => total + entry.content.length, 0) > 1048576)
+        throw unsafe();
+    const local = [], central = [];
+    let offset = 0;
+    for (const entry of [...entries].sort((a, b) => a.name.localeCompare(b.name, "en"))) {
+        if (!/^(?:[a-zA-Z0-9_-]+\/)*[a-zA-Z0-9_.-]+$/.test(entry.name) || entry.name.split("/").some(part => part === "." || part === ".."))
+            throw unsafe();
+        const name = Buffer.from(entry.name, "utf8"), crc = crc32(entry.content);
+        const header = Buffer.alloc(30);
+        header.writeUInt32LE(0x04034b50);
+        header.writeUInt16LE(20, 4);
+        header.writeUInt16LE(0x0800, 6);
+        header.writeUInt16LE(0x0021, 12); // Fixed DOS 1980-01-01; no local identity/time metadata.
+        header.writeUInt32LE(crc, 14);
+        header.writeUInt32LE(entry.content.length, 18);
+        header.writeUInt32LE(entry.content.length, 22);
+        header.writeUInt16LE(name.length, 26);
+        const directory = Buffer.alloc(46);
+        directory.writeUInt32LE(0x02014b50);
+        directory.writeUInt16LE(0x0314, 4);
+        directory.writeUInt16LE(20, 6);
+        directory.writeUInt16LE(0x0800, 8);
+        directory.writeUInt16LE(0x0021, 14);
+        directory.writeUInt32LE(crc, 16);
+        directory.writeUInt32LE(entry.content.length, 20);
+        directory.writeUInt32LE(entry.content.length, 24);
+        directory.writeUInt16LE(name.length, 28);
+        directory.writeUInt32LE((0o100600 << 16) >>> 0, 38);
+        directory.writeUInt32LE(offset, 42);
+        local.push(header, name, entry.content);
+        central.push(directory, name);
+        offset += header.length + name.length + entry.content.length;
+    }
+    const directory = Buffer.concat(central), end = Buffer.alloc(22);
+    end.writeUInt32LE(0x06054b50);
+    end.writeUInt16LE(entries.length, 8);
+    end.writeUInt16LE(entries.length, 10);
+    end.writeUInt32LE(directory.length, 12);
+    end.writeUInt32LE(offset, 16);
+    return Buffer.concat([...local, directory, end]);
+}
+function outputPath(value) {
+    if (typeof value !== "string" || !value.trim() || value.length > 4096 || /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/u.test(value))
+        throw unsafe();
+    const target = resolve(value);
+    if (!isAbsolute(target) || target === parse(target).root || !basename(target).toLowerCase().endsWith(".zip"))
+        throw unsafe();
+    return target;
+}
+// Public ZIP output is not restricted to HOME. All existing ancestors must be
+// real directories; only trusted root/sticky system ancestors may precede the
+// user's private final parent. No directory contents are scanned or modified.
+function checkedParent(path) {
+    if (typeof process.getuid !== "function")
+        throw unsafe();
+    const uid = process.getuid(), parent = dirname(path), root = parse(parent).root;
+    let current = root, result;
+    for (const part of [null, ...relative(root, parent).split(sep).filter(Boolean)]) {
+        if (part !== null)
+            current = join(current, part);
+        const info = lstatSync(current), final = current === parent;
+        const stickyRootAncestor = !final && info.uid === 0 && (info.mode & 0o1000) !== 0;
+        if (!info.isDirectory() || (final ? info.uid !== uid : info.uid !== uid && info.uid !== 0)
+            || (info.mode & 0o022) !== 0 && !stickyRootAncestor)
+            throw unsafe();
+        result = info;
+    }
+    if (!result || realpathSync(parent) !== parent)
+        throw unsafe();
+    return result;
+}
+function readDescriptor(fd, length) {
+    const bytes = Buffer.alloc(length);
+    let offset = 0;
+    while (offset < length) {
+        const count = readSync(fd, bytes, offset, length - offset, offset);
+        if (!count)
+            break;
+        offset += count;
+    }
+    return bytes.subarray(0, offset);
+}
+function publish(path, bytes) {
+    const parent = dirname(path), identity = checkedParent(path), original = process.cwd();
+    let fd, stagedIdentity, temporary, published = false;
+    try {
+        // Keep all operations synchronous while pinned to the verified parent inode.
+        process.chdir(parent);
+        const current = lstatSync(".");
+        if (!same(current, identity) || current.uid !== identity.uid || current.mode !== identity.mode)
+            throw unsafe();
+        const name = basename(path);
+        try {
+            lstatSync(name);
+            throw exists();
+        }
+        catch (error) {
+            if (!missing(error))
+                throw error;
+        }
+        temporary = `.caotang-skills-export-${randomUUID()}.tmp`;
+        fd = openSync(temporary, constants.O_RDWR | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);
+        stagedIdentity = fstatSync(fd);
+        const valid = (info, links) => info.isFile() && info.uid === identity.uid && info.nlink === links && (info.mode & 0o7777) === 0o600 && same(info, stagedIdentity);
+        if (!valid(stagedIdentity, 1) || stagedIdentity.size !== 0)
+            throw unsafe();
+        writeFileSync(fd, bytes);
+        fsyncSync(fd);
+        const written = fstatSync(fd);
+        if (!valid(written, 1) || written.size !== bytes.length || !same(written, lstatSync(temporary)) || !readDescriptor(fd, bytes.length).equals(bytes))
+            throw unsafe();
+        try {
+            linkSync(temporary, name);
+            published = true;
+        }
+        catch (error) {
+            if (asRecord(error)?.code === "EEXIST")
+                throw exists();
+            throw error;
+        }
+        if (!valid(lstatSync(name), 2) || !same(lstatSync(temporary), stagedIdentity))
+            throw unsafe();
+        unlinkSync(temporary);
+        temporary = undefined;
+        const final = lstatSync(name);
+        if (!valid(final, 1) || final.size !== bytes.length || !readDescriptor(fd, bytes.length).equals(bytes))
+            throw unsafe();
+        const after = lstatSync(".");
+        if (!same(after, identity) || after.uid !== identity.uid || after.mode !== identity.mode)
+            throw unsafe();
+        // cwd remains the old inode after a concurrent rename. Also verify the
+        // absolute location promised to the caller, including its safe ancestry.
+        const promisedParent = checkedParent(path), promisedTarget = lstatSync(path);
+        if (!same(promisedParent, identity) || promisedParent.uid !== identity.uid || promisedParent.mode !== identity.mode
+            || !valid(promisedTarget, 1) || promisedTarget.size !== bytes.length || !same(promisedTarget, final)
+            || !readDescriptor(fd, bytes.length).equals(bytes))
+            throw unsafe();
+    }
+    catch (error) {
+        if (published)
+            throw new CliError("skills_export_unconfirmed", "已创建导出目标，但最终核对未完成。", "保留现有ZIP并由本人核对文件；不要自动删除、覆盖或重新导出到同一路径。", 6);
+        if (error instanceof CliError)
+            throw error;
+        throw unsafe();
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+        if (temporary && stagedIdentity) {
+            try {
+                if (same(lstatSync(temporary), stagedIdentity))
+                    unlinkSync(temporary);
+            }
+            catch { /* Preserve an unverified pathname; never remove another inode. */ }
+        }
+        process.chdir(original);
+    }
+}
+export async function exportSkillsBundle(options) {
+    const path = outputPath(options.outputPath);
+    const assets = await loadSkillAssets(options.packageRoot);
+    if (assets.some(asset => asset.content.includes("本技能使用的 AI 名字是")))
+        throw new CliError("skills_export_source_invalid", "本包技能含绑定身份，未导出。", "只使用官方未绑定个人身份的技能包，不从已安装个人目录导出。", 7);
+    const operations = getAgentOperations();
+    const manifest = { formatVersion: 1, skills: assets.map(({ name, description }) => ({ name, description })) };
+    const entries = [
+        { name: "skills/manifest.json", content: Buffer.from(JSON.stringify(manifest, null, 2) + "\n") },
+        ...assets.map(asset => ({ name: `skills/${asset.name}/SKILL.md`, content: Buffer.from(asset.content) })),
+        { name: "operations.md", content: Buffer.from(operations.content) },
+        { name: "README.md", content: Buffer.from(`# 一间草堂官方公共技能包\n\n七项技能来自本CLI包内官方资源，未绑定个人身份；不含账号、令牌、同意或个人配置。\n公共短合同版本：${operations.version}；正文SHA256：${operations.sha256}。\n人用手册：当前服务的 ${operations.manual_path}。\n\n导出不等于安装、授权、当前会话加载或行为通过。请按目标宿主实际支持的导入方式使用，核对共享范围；不会自动上传共享库、启动Agent或改个人配置。\n能执行CLI但无Skill的入口仍可按公共说明使用完整业务能力；纯网页无外部工具的AI尚未接通。\n`) },
+    ];
+    const bytes = zip(entries);
+    try {
+        publish(path, bytes);
+    }
+    catch (error) {
+        if (error instanceof CliError)
+            throw error;
+        throw unsafe();
+    }
+    return { status: 200, body: { operation: "skills_export", output_path: path, format: "zip", compression: "store", size_bytes: bytes.length, sha256: digest(bytes), entry_count: entries.length, skill_count: assets.length, uploaded: false } };
+}

package/dist/work-context-human.js

@@ -0,0 +1,67 @@
+import { verifiedWorkContext } from "./work-context-wire.js";
+const row = (v) => v !== null && typeof v === "object" && !Array.isArray(v) ? v : undefined;
+const clean = (v, limit = 60) => {
+    if (typeof v !== "string")
+        return "";
+    const chars = [...v.replace(/[\p{Cc}\u2028\u2029\u202a-\u202e\u2066-\u2069]/gu, " ").replace(/\s+/gu, " ").trim()];
+    return chars.length > limit ? chars.slice(0, limit).join("") + "…" : chars.join("");
+};
+function unavailable(section) {
+    if (section?.status === "disabled")
+        return "未读取（没有权限）";
+    if (section?.status === "read_failed")
+        return "本次读取未完成";
+    if (section?.status === "deferred")
+        return section.reason === "budget_limited" ? "部分内容延后展示" : "本次尚未提供";
+    if (section?.status === "not_recorded")
+        return "尚未记录";
+    if (section?.status === "not_applicable")
+        return "本次不适用";
+    return "未核实";
+}
+function total(section) {
+    return (section?.status === "available" || section?.status === "empty") && typeof section.total === "number" ? String(section.total) : unavailable(section);
+}
+// Human display only. Agents retain the default complete JSON for rules and scope.
+export function workContextHuman(value) {
+    try {
+        const source = row(value), sourceContext = row(source?.context), selection = row(row(sourceContext?.current_project)?.data);
+        const selected = typeof selection?.project_id === "string" ? selection.project_id : undefined;
+        const verified = verifiedWorkContext(value, selected);
+        if (!verified)
+            return undefined;
+        const context = verified.context, overview = row(context.project_overview), projects = row(context.projects), current = row(context.current_project), counts = row(overview?.data);
+        const at = new Intl.DateTimeFormat("zh-CN", { timeZone: "Asia/Shanghai", month: "2-digit", day: "2-digit", hour: "2-digit", minute: "2-digit", hourCycle: "h23" }).format(new Date(verified.as_of));
+        const header = counts ? `可读项目 ${counts.total}，进行中 ${counts.active}，核心 ${counts.core}${counts.draft === null ? "（草稿未计入）" : ""}` : `项目：${unavailable(overview)}`;
+        const lines = [`草堂摘要 · ${at} · ${header}`];
+        const list = Array.isArray(projects?.data) ? projects.data : [];
+        if (current?.status === "available" && list.length) {
+            const project = list[0], next = row(project.next_step), step = row(next?.data);
+            lines.push(`本次：${clean(project.title)}；上次留下的下一步：${step ? clean(step.summary, 100) : "未留下明确记录"}`);
+        }
+        else if (list.length) {
+            lines.push(`核心/近期：${list.slice(0, 2).map(p => clean(p.title)).join("、")}${list.length > 2 ? `；另有 ${list.length - 2} 个候选` : ""}。`);
+        }
+        else
+            lines.push(`项目详情：${projects?.status === "empty" ? "当前可读范围内暂无项目" : unavailable(projects)}`);
+        const schedule = row(context.schedule_items), data = row(schedule?.data);
+        if (schedule?.status === "available" && data) {
+            const overdue = row(data.overdue), today = row(data.today), undated = row(data.undated);
+            const urgent = [...overdue.items, ...today.items].slice(0, 3).map(p => clean(p.title, 40));
+            lines.push(`待办：今日 ${today.total}，逾期 ${overdue.total}，未定日期 ${undated.total}${urgent.length ? `；优先：${urgent.join("、")}` : ""}`);
+        }
+        else
+            lines.push(`待办：${unavailable(schedule)}`);
+        const rules = row(context.rules), pending = row(context.pending), notices = row(context.official_notices), noticeData = row(notices?.data);
+        lines.push(`待确认：${total(pending)}${typeof pending?.total === "number" ? " 项（网页核对）" : ""}；规矩：${total(rules)}${typeof rules?.total === "number" ? " 条（原文见 JSON）" : ""}；通知：${noticeData ? noticeData.unread_count : unavailable(notices)}`);
+        const connections = row(context.recent_connections), reminders = row(context.conditional_reminders);
+        const connectionText = connections?.status === "available" || connections?.status === "empty" ? `${connections.total} 条近期记录` : unavailable(connections);
+        const reminderData = row(reminders?.data);
+        const reminderText = reminderData ? `项目 ${total(row(reminderData.projects))}，知识 ${total(row(reminderData.knowledge))}` : unavailable(reminders);
+        lines.push(`协作：${connectionText}；整理提示：${reminderText}。完整内容可去掉 --human 查看。`);
+        return lines.join("\n");
+    }
+    catch {
+        return undefined;
+    }
+}