ali-skills 0.1.4 → 0.1.5

package/node_modules/@ali/cli-skills/dist/cli.mjs

@@ -16,7 +16,7 @@ import { spawn } from "child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, unlinkSync, writeFileSync } from "fs";
 import { basename, dirname, join, normalize, relative, resolve, sep } from "path";
 import { homedir, platform as platform$1 } from "os";
-import { createHash } from "crypto";
+import { createHash, randomBytes, randomInt } from "crypto";
 import { URL as URL$1, fileURLToPath } from "url";
 import * as readline from "readline";
 import { Writable } from "stream";
@@ -1386,7 +1386,7 @@ var WellKnownProvider = class {
 	}
 };
 const wellKnownProvider = new WellKnownProvider();
-var version$1 = "2.1.5";
+var version$1 = "2.1.6";
 async function checkGithubVersions$1(requests, debugLog = () => {}) {
 	const results = [];
 	for (let offset = 0; offset < requests.length; offset += 100) results.push(...await checkGithubVersionBatch(requests.slice(offset, offset + 100), debugLog));
@@ -3834,6 +3834,56 @@ function listPlatforms() {
 		config
 	}));
 }
+function isTruthy(value) {
+	return value !== void 0 && [
+		"1",
+		"true",
+		"yes"
+	].includes(value.trim().toLowerCase());
+}
+function detectLoginEnvironment({ platform, env }) {
+	if (isTruthy(env.CI)) return {
+		mode: "manual",
+		reason: "检测到 CI 环境"
+	};
+	if (platform === "linux" && !env.DISPLAY && !env.WAYLAND_DISPLAY) return {
+		mode: "manual",
+		reason: "未检测到 Linux 图形桌面"
+	};
+	return { mode: "browser" };
+}
+function parseLoginCallbackUrl(rawValue, expectation) {
+	let url;
+	try {
+		url = new URL(rawValue.trim());
+	} catch {
+		throw new Error("回调地址格式无效，请粘贴浏览器地址栏中的完整 URL");
+	}
+	if (url.protocol !== "http:") throw new Error("回调地址协议无效");
+	if (url.hostname !== "localhost" && url.hostname !== "127.0.0.1") throw new Error("回调地址主机无效");
+	if (url.port !== String(expectation.port) || url.pathname !== "/callback") throw new Error("回调地址不属于本次登录");
+	if (url.searchParams.get("state") !== expectation.state) throw new Error("回调地址 state 校验失败，请使用本次登录生成的地址");
+	const empId = url.searchParams.get("emp_id") || "";
+	const account = url.searchParams.get("account") || "";
+	const name = url.searchParams.get("name") || "";
+	const email = url.searchParams.get("email") || "";
+	const privateToken = url.searchParams.get("private_token") || "";
+	const ssoRefreshToken = url.searchParams.get("sso_refresh_token") || "";
+	const expiresAtRaw = url.searchParams.get("expires_at") || "";
+	if (!empId || !privateToken) throw new Error("回调地址缺少必要的登录凭证");
+	const expiresAt = Number(expiresAtRaw);
+	const nowSeconds = expectation.nowSeconds ?? Math.floor(Date.now() / 1e3);
+	if (!Number.isSafeInteger(expiresAt) || expiresAt <= nowSeconds) throw new Error("回调地址中的登录凭证已过期或无效");
+	return {
+		empId,
+		account,
+		name,
+		email,
+		privateToken,
+		ssoRefreshToken,
+		expiresAt
+	};
+}
 const DIM$4 = "\x1B[38;5;102m";
 const TEXT$3 = "\x1B[38;5;145m";
 const RESET$4 = "\x1B[0m";
@@ -3863,34 +3913,34 @@ function displayWidth$1(str) {
 function printJson(payload, pretty = false) {
 	console.log(JSON.stringify(payload, null, pretty ? 2 : 0));
 }
-function startLocalServer() {
+function startLocalServer(state) {
 	return new Promise((resolve) => {
 		let resolveCallback;
 		const callbackPromise = new Promise((resolve) => {
 			resolveCallback = resolve;
 		});
 		const server = http.createServer((req, res) => {
-			const url = new URL$1(req.url || "/", `http://localhost`);
-			if (url.pathname === "/callback") {
-				const empId = url.searchParams.get("emp_id") || "";
-				const account = url.searchParams.get("account") || "";
-				const name = url.searchParams.get("name") || "";
-				const email = url.searchParams.get("email") || "";
-				const privateToken = url.searchParams.get("private_token") || "";
-				const ssoRefreshToken = url.searchParams.get("sso_refresh_token") || "";
-				const expiresAt = url.searchParams.get("expires_at") || "0";
-				if (!empId || !privateToken) {
+			if (new URL$1(req.url || "/", `http://localhost`).pathname === "/callback") {
+				let callbackData;
+				try {
+					const address = server.address();
+					callbackData = parseLoginCallbackUrl(`http://localhost:${address.port}${req.url || ""}`, {
+						port: address.port,
+						state
+					});
+				} catch (error) {
 					res.writeHead(400, { "Content-Type": "text/html" });
 					res.end(`
             <html>
               <body style="font-family: sans-serif; text-align: center; padding: 50px;">
                 <h1 style="color: #ff4d4f;">登录失败</h1>
-                <p>缺少必要的参数</p>
+                <p>${error instanceof Error ? error.message : "回调地址无效"}</p>
               </body>
             </html>
           `);
 					return;
 				}
+				const { empId, account, name } = callbackData;
 				res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
 				res.end(`
           <html>
@@ -4028,22 +4078,14 @@ function startLocalServer() {
             </body>
           </html>
         `);
-				resolveCallback({
-					empId,
-					account,
-					name,
-					email,
-					privateToken,
-					ssoRefreshToken,
-					expiresAt: parseInt(expiresAt, 10)
-				});
+				resolveCallback(callbackData);
 				setTimeout(() => server.close(), 1e3);
 			} else {
 				res.writeHead(404);
 				res.end("Not Found");
 			}
 		});
-		server.listen(0, "localhost", () => {
+		server.listen(0, "127.0.0.1", () => {
 			const port = server.address().port;
 			resolve({
 				port,
@@ -4053,13 +4095,106 @@ function startLocalServer() {
 		});
 	});
 }
-function openBrowser$2(url) {
-	const platform = process.platform;
-	spawn(platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open", [url], {
-		detached: true,
-		stdio: "ignore"
+function requestBrowserOpen(url) {
+	const command = process.platform === "darwin" ? {
+		cmd: "open",
+		args: [url]
+	} : process.platform === "win32" ? {
+		cmd: "cmd",
+		args: [
+			"/c",
+			"start",
+			"",
+			url
+		]
+	} : {
+		cmd: "xdg-open",
+		args: [url]
+	};
+	return new Promise((resolve, reject) => {
+		const child = spawn(command.cmd, command.args, { stdio: "ignore" });
+		let settled = false;
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			if (error) reject(error);
+			else resolve();
+		};
+		child.once("error", (error) => finish(error));
+		child.once("exit", (code) => {
+			if (code === 0) finish();
+			else finish(/* @__PURE__ */ new Error(`浏览器启动命令退出，code=${String(code)}`));
+		});
+		child.unref();
+		setTimeout(() => finish(), 1500).unref();
 	});
 }
+function startManualCallbackReader(expectation) {
+	let settled = false;
+	let resolveCallback;
+	const callbackPromise = new Promise((resolve) => {
+		resolveCallback = resolve;
+	});
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout,
+		terminal: Boolean(process.stdin.isTTY)
+	});
+	const writable = rl;
+	let maskedLength = 0;
+	let maskTruncated = false;
+	if (process.stdin.isTTY) writable._writeToOutput = (chunk) => {
+		const visible = chunk.replace(/\u001b\[[0-9;]*[A-Za-z]/g, "").replace(/[\u0000-\u001f\u007f]/g, "");
+		if (!visible) return;
+		const remaining = Math.max(0, 12 - maskedLength);
+		const nextCount = Math.min(remaining, visible.length);
+		if (nextCount > 0) {
+			process.stdout.write("*".repeat(nextCount));
+			maskedLength += nextCount;
+		}
+		if (visible.length > nextCount && !maskTruncated) {
+			process.stdout.write("…");
+			maskTruncated = true;
+		}
+	};
+	const resetMask = () => {
+		maskedLength = 0;
+		maskTruncated = false;
+	};
+	const showPrompt = () => {
+		process.stdout.write(`${TEXT$3}请粘贴浏览器地址栏中的完整 localhost 回调地址（仅显示掩码）:${RESET$4}\n> `);
+	};
+	rl.on("line", (line) => {
+		if (settled || !line.trim()) {
+			if (!settled) {
+				process.stdout.write("\n");
+				resetMask();
+				showPrompt();
+			}
+			return;
+		}
+		try {
+			const data = parseLoginCallbackUrl(line, expectation);
+			settled = true;
+			process.stdout.write("\n");
+			resolveCallback(data);
+		} catch (error) {
+			process.stdout.write("\n");
+			const message = error instanceof Error ? error.message : "回调地址无效";
+			console.error(`${YELLOW$3}⚠ ${message}${RESET$4}`);
+			resetMask();
+			showPrompt();
+		}
+	});
+	showPrompt();
+	return {
+		waitForCallback: () => callbackPromise,
+		close: () => {
+			settled = true;
+			rl.close();
+		}
+	};
+}
 async function revokeGatewaySessionIfPossible(auth) {
 	try {
 		const revokeUrl = `${auth.gatewayUrl || getGatewayUrl()}/api/gateway/revoke`;
@@ -4090,18 +4225,50 @@ async function login(options) {
 			return;
 		}
 	}
-	console.log(`${TEXT$3}正在启动本地服务...${RESET$4}`);
-	const { port, waitForCallback, close } = await startLocalServer();
-	const callbackUrl = `http://localhost:${port}/callback`;
+	console.log(`${TEXT$3}正在准备登录回调...${RESET$4}`);
+	const state = randomBytes(24).toString("hex");
+	const environment = detectLoginEnvironment({
+		platform: process.platform,
+		env: process.env
+	});
+	const localServer = environment.mode === "browser" ? await startLocalServer(state) : void 0;
+	const callbackPort = localServer?.port ?? randomInt(49152, 65536);
+	const callbackUrl = `http://127.0.0.1:${callbackPort}/callback?state=${state}`;
 	const gatewayUrl = getGatewayUrl();
 	const loginUrl = `${gatewayUrl}/api/gateway/login?callback_url=${encodeURIComponent(callbackUrl)}&type=cli`;
-	console.log(`${TEXT$3}正在打开浏览器进行 BUC 授权...${RESET$4}`);
-	console.log(`${DIM$4}如果浏览器没有自动打开，请手动访问:${RESET$4}`);
-	console.log(`${DIM$4}${loginUrl}${RESET$4}`);
-	openBrowser$2(loginUrl);
-	console.log(`${TEXT$3}等待授权完成...${RESET$4}`);
+	const expectation = {
+		port: callbackPort,
+		state
+	};
+	if (environment.mode === "manual") {
+		console.log(`${YELLOW$3}${environment.reason}，将使用手动浏览器授权。${RESET$4}`);
+		console.log(`${TEXT$3}请在本机浏览器访问以下地址:${RESET$4}`);
+		console.log();
+		console.log(`${DIM$4}  ${loginUrl}${RESET$4}`);
+		console.log();
+		console.log(`${DIM$4}授权后页面可能提示无法访问 localhost；请复制地址栏中的完整地址并粘贴到终端。${RESET$4}`);
+	} else {
+		console.log(`${TEXT$3}正在打开浏览器进行 BUC 授权...${RESET$4}`);
+		console.log(`${DIM$4}如果浏览器没有自动打开，请手动访问:${RESET$4}`);
+		console.log();
+		console.log(`${DIM$4}  ${loginUrl}${RESET$4}`);
+		console.log();
+		try {
+			await requestBrowserOpen(loginUrl);
+		} catch {
+			console.log(`${YELLOW$3}未能打开浏览器，请使用上方地址在任意本机浏览器完成授权。${RESET$4}`);
+		}
+	}
+	console.log(`${TEXT$3}${localServer ? "等待自动回调或手动粘贴" : "等待手动粘贴回调地址"}...${RESET$4}`);
+	const manualReader = startManualCallbackReader(expectation);
 	try {
-		const { empId, account, name, email, privateToken, ssoRefreshToken, expiresAt } = await waitForCallback();
+		const { empId, account, name, email, privateToken, ssoRefreshToken, expiresAt } = await Promise.race([
+			localServer?.waitForCallback(),
+			manualReader.waitForCallback(),
+			new Promise((_, reject) => {
+				setTimeout(() => reject(/* @__PURE__ */ new Error("登录授权等待超时，请重新执行 login")), 900 * 1e3).unref();
+			})
+		].filter((promise) => promise !== void 0));
 		saveAuth({
 			empId,
 			account,
@@ -4123,8 +4290,10 @@ async function login(options) {
 			console.log(`${DIM$4}可尝试：在网页端（https://ali-skills.alibaba-inc.com）退出平台登录后重新执行 login 命令。同时请将此问题反馈给本工具开发者处理，感谢！${RESET$4}`);
 		}
 	} catch (error) {
-		close();
 		throw error;
+	} finally {
+		manualReader.close();
+		localServer?.close();
 	}
 }
 async function logout(platformInput, yuqueGroup, clearAll) {

package/node_modules/@ali/cli-skills/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ali/cli-skills",
-  "version": "2.1.5",
+  "version": "2.1.6",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ali-skills",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "The open agent skills ecosystem",
   "type": "module",
   "bin": {
@@ -32,7 +32,7 @@
   "author": "",
   "license": "MIT",
   "dependencies": {
-    "@ali/cli-skills": "^2.1.5"
+    "@ali/cli-skills": "^2.1.6"
   },
   "bundleDependencies": [
     "@ali/cli-skills"