bdip-office-assistant-cli 0.0.0-stage → 1.0.0

package/dist/odoc.js

@@ -0,0 +1,199 @@
+/**
+ * BDIP5 公文（odoc）模块。
+ *
+ * 抓包+实跑确认的接口（测试环境）：
+ *   POST /api/odoc/odocCustomPage/getCustomPageList   公文待办/待阅列表入口（拿 dataKey，customListId/customTabId 定列表与 tab）
+ *   POST /api/ec/dev/table/datas                       取列+行（同待办 table 链路第 2 步）
+ *   POST /api/ec/dev/table/counts                      取总数（同待办 table 链路第 3 步）
+ *   POST /api/odoc/odocTodoList/getTodoCount           待办/待阅计数（发文/收文/签报，按 officalType 分）
+ *   POST /api/odoc/odocCenter/createOfficalList        发文/收文流程列表（officalType=1 发文拟稿 / 2 收文登记，结构同 create 列表）
+ *   POST /api/odoc/odocCenter/getCenterInfo            公文中心首页两个新建入口（发文拟稿/收文登记）
+ *   POST /api/odoc/odocCenter/getCountByOdocType       按公文种类计数
+ *   POST /api/odoc/odocCenter/getCountByTopicType      按主题分类计数
+ *
+ * 走当前 baseUrl（单一环境，所有功能同地址），aiAgentToken 鉴权（e9pc 不支持 token 时回退 cookie）。
+ */
+import { createApiFromProfile } from './client.js';
+import { pickByPaths, stripHtml, extractDataKey, extractColumns, extractRows, extractTotal } from './parse.js';
+const DATERANGE_EMPTY = '0,,'; // type=0(不过滤), from 空, to 空
+/**
+ * 公文待办/待阅列表。3 步 table 链路（POST，form-urlencoded），同待办/workplan-search：
+ *   1. /api/odoc/odocCustomPage/getCustomPageList（过滤项 + customListId/customTabId）→ dataKey（sessionkey 字段）
+ *   2. /api/ec/dev/table/datas（dataKey + current + sortParams=[]）→ columns + 行
+ *   3. /api/ec/dev/table/counts（dataKey）→ 总数（失败不阻断）
+ * 行字段：原值 + `<字段>span` 渲染值（去 HTML）。
+ */
+export async function listOdocTodo(cfg, opts = {}) {
+    const api = await createApiFromProfile(cfg);
+    const filters = {
+        btnType: opts.btnType ?? '1',
+        readstatus: opts.readStatus ?? '',
+        odocSubject: opts.odocSubject ?? '',
+        sendnode: '',
+        topictype: opts.topicType ?? '',
+        secretlevel: opts.secretLevel ?? '',
+        send_unit: opts.sendUnit ?? '',
+        issueduserid: opts.issuedUserid ?? '',
+        writtendateselect: opts.writtenDateSelect ?? DATERANGE_EMPTY,
+        ownerid: opts.ownerId ?? '',
+        createdateselect: opts.createDateSelect ?? DATERANGE_EMPTY,
+        lastmodifydateselect: opts.lastModifyDateSelect ?? DATERANGE_EMPTY,
+        dealinguserid: opts.dealingUserid ?? '',
+        undealeduserid: opts.undealedUserid ?? '',
+        docabstract: opts.docAbstract ?? '',
+        opendateselect: opts.openDateSelect ?? DATERANGE_EMPTY,
+        deadlineselect: opts.deadlineSelect ?? DATERANGE_EMPTY,
+        receivenum: opts.receiveNum ?? '',
+        receivedateselect: opts.receiveDateSelect ?? DATERANGE_EMPTY,
+        workflowid: opts.workflowId ?? '',
+        requestname: opts.requestName ?? '',
+        dispatchnum: opts.dispatchNum ?? '',
+        urgencydegree: opts.urgencyDegree ?? '',
+        receive_unit: opts.receiveUnit ?? '',
+        issueddateselect: opts.issuedDateSelect ?? DATERANGE_EMPTY,
+        departmentid: opts.departmentId ?? '',
+        odoctype: opts.odocType ?? '',
+        customListId: opts.customListId ?? '-12',
+        customTabId: opts.customTabId ?? '-24',
+    };
+    const r1 = await api.post('/api/odoc/odocCustomPage/getCustomPageList', filters);
+    const dataKey = extractDataKey(r1.json);
+    if (!dataKey) {
+        throw new Error(`odoc list 未拿到 dataKey，getCustomPageList 响应: ${(r1.text ?? '').slice(0, 200)}`);
+    }
+    const page = opts.page ?? 1;
+    const r2 = await api.post('/api/ec/dev/table/datas', {
+        dataKey,
+        current: String(page),
+        sortParams: '[]',
+        // table/datas 认 pageSize（同待办链路）：显式 10 条/页，避免服务端默认 30 条/页导致
+        // --page N 按 30 条跳页、本页第 11~30 条看不到的错位。
+        pageSize: opts.pageSize ?? '10',
+    });
+    const columns = extractColumns(r2.json);
+    const rows = extractRows(r2.json);
+    const items = rows.map((r) => normalizeOdocRow(r)).filter((it) => it.requestId || it.requestName);
+    const pageSize = pickByPaths(r2.json, ['pageSize', 'data.pageSize']);
+    let total = null;
+    let countsResp = null;
+    try {
+        const r3 = await api.post('/api/ec/dev/table/counts', { dataKey });
+        countsResp = r3.json;
+        total = extractTotal(r3.json);
+    }
+    catch {
+        // counts 失败不阻断
+    }
+    return {
+        dataKey,
+        page,
+        total,
+        pageSize: typeof pageSize === 'number' ? pageSize : null,
+        columns,
+        items,
+        raw: { getCustomPageList: r1.json, datas: r2.json, counts: countsResp },
+    };
+}
+/** 解析公文待办表行（原值 + span 渲染值）。 */
+export function normalizeOdocRow(row) {
+    if (!row || typeof row !== 'object')
+        return {};
+    const get = (keys) => pickByPaths(row, keys);
+    const spanOr = (dataIndex, extraKeys = []) => stripHtml(get([`${dataIndex}span`, dataIndex, ...extraKeys]));
+    return {
+        requestId: stringify(get(['requestid', 'randomField2'])),
+        requestName: stripHtml(get(['requestnamespan'])) || stringify(get(['requestname'])),
+        odocType: stringify(get(['odoctype'])),
+        odocTypeName: stripHtml(get(['odoctypespan'])),
+        issuedNum: stringify(get(['issued_num', 'issued_numspan'])),
+        receiveNum: stripHtml(get(['receivenumspan'])) || stringify(get(['receivenum'])),
+        topicType: stringify(get(['topictype'])),
+        urgencyDegree: stringify(get(['urgencydegree'])),
+        secretLevel: stripHtml(get(['secretlevelspan'])) || stringify(get(['secretlevel'])),
+        issuedUnit: stringify(get(['issued_unit'])),
+        receiveUnit: stripHtml(get(['receiveunitspan'])) || stringify(get(['receiveunit'])),
+        issuedUserid: stripHtml(get(['issued_useridspan'])) || stringify(get(['issued_userid'])),
+        writtenDate: stripHtml(get(['written_datespan'])) || stringify(get(['written_date'])),
+        issuedDate: stringify(get(['issued_date'])),
+        createrId: stripHtml(get(['createridspan'])) || stringify(get(['createrid', 'creater'])),
+        createDate: stringify(get(['createdate'])),
+        sendDepartment: stringify(get(['senddepartment'])),
+        lastOperateDate: stringify(get(['lastoperatedate'])),
+        // ⚠️ BDIP5 公文列表这两列的**字段名与内容是反的**（2026-10-14 实测 wf=552 发文）：
+        //   currentnodeidspan → "拟稿"（公文环节名，是标签不是 id）
+        //   currentnodespan   → "2868"（真正的**节点 id**，用 getNodeInfo 可解析出节点名「拟稿发起」）
+        // 故不再沿用误导性的原名，改为语义正确的 stageName / node；nodeName 由 nodemap 回填。
+        stageName: stripHtml(get(['currentnodeidspan'])) || stringify(get(['currentnodeid'])),
+        node: stripHtml(get(['currentnodespan'])) || stringify(get(['currentnode'])),
+        nodeName: undefined,
+        zbr: stringify(get(['zbr'])),
+        wbr: stringify(get(['wbr'])),
+        docAbstract: stripHtml(get(['docabstractspan'])) || stringify(get(['docabstract'])),
+        deadline: stripHtml(get(['deadlinespan'])) || stringify(get(['deadline'])),
+        openDate: stripHtml(get(['opendatespan'])) || stringify(get(['opendate'])),
+        receiveDate: stripHtml(get(['receivedatespan'])) || stringify(get(['receivedate'])),
+        operateDate: stripHtml(get(['operatedatespan'])) || stringify(get(['operatedate'])),
+        workflowId: stringify(get(['workflowid', 'randomField0'])),
+        raw: row,
+    };
+}
+/**
+ * 公文待办/待阅计数。POST /api/odoc/odocTodoList/getTodoCount。
+ * - view=false（默认）：待办计数（iscomplete=0）
+ * - view=true：待阅计数（isview=0）
+ * 返回 datalist：[{officalType, title, count}]（发文/收文/签报）。
+ */
+export async function getOdocTodoCount(cfg, opts = {}) {
+    const api = await createApiFromProfile(cfg);
+    const body = opts.view
+        ? { isview: '0', isNew: 'false' }
+        : { iscomplete: '0', isNew: 'false' };
+    const r = await api.post('/api/odoc/odocTodoList/getTodoCount', body);
+    const j = r.json || {};
+    const arr = pickByPaths(j, ['datalist', 'data.datalist']) ?? [];
+    const items = (Array.isArray(arr) ? arr : [])
+        .map((d) => ({
+        officalType: stringify(d?.officalType) ?? '',
+        title: stringify(d?.title) ?? '',
+        count: typeof d?.count === 'number' ? d.count : Number(d?.count ?? 0),
+    }))
+        .filter((it) => it.title);
+    return { view: !!opts.view, items, raw: j };
+}
+/**
+ * 发文/收文流程列表。POST /api/odoc/odocCenter/createOfficalList。
+ * - officalType=1（默认）：发文拟稿
+ * - officalType=2：收文登记
+ * 返回 datas[{typeName, id, wfCount, wfbeans[]}]，结构同 create 列表，
+ * 故"新建公文"可复用 create start（wfstart.ts）的发起链路。
+ */
+export async function listOdocCreate(cfg, opts = {}) {
+    const api = await createApiFromProfile(cfg);
+    const officalType = opts.officalType ?? '1';
+    const r = await api.post('/api/odoc/odocCenter/createOfficalList', { officalType });
+    const j = r.json || {};
+    const arr = pickByPaths(j, ['datas', 'data.datas']) ?? [];
+    const toplabel = stringify(pickByPaths(j, ['createwflabels.toplabel']));
+    const categories = (Array.isArray(arr) ? arr : [])
+        .map((d) => ({
+        id: stringify(d?.id),
+        name: stringify(d?.typeName),
+        wfCount: typeof d?.wfCount === 'number' ? d.wfCount : Number(d?.wfCount ?? 0),
+        workflows: (Array.isArray(d?.wfbeans) ? d.wfbeans : [])
+            .map((w) => ({
+            id: stringify(w?.id),
+            name: stringify(w?.name),
+            typeId: stringify(w?.typeId),
+            spell: stringify(w?.spell),
+            letter: stringify(w?.letter),
+        }))
+            .filter((w) => w.id || w.name),
+    }))
+        .filter((c) => c.workflows.length > 0);
+    return { officalType, toplabel, categories, raw: j };
+}
+function stringify(v) {
+    if (v === undefined || v === null || v === '')
+        return undefined;
+    return String(v);
+}

package/dist/office-tools.js

@@ -0,0 +1,138 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+import {pathToFileURL, fileURLToPath} from 'node:url';
+
+export async function accounts(api) {
+  const r = await api.get('/api/hrm/login/getAccountList', {__random__: Date.now()}, {forceCookie: true});
+  const rows = r.json?.data?.accountlist;
+  if (!Array.isArray(rows) || !rows.length) throw Error('未取得关联账号，请检查登录状态');
+  const items = rows.map(a => ({id: String(a.userid), name: a.username,
+    division: a.subcompanyname || '所属分部未返回（请核实）', department: a.deptname || '',
+    current: String(a.iscurrent) === '1'}));
+  if (items.filter(a => a.current).length !== 1) throw Error('未能确认当前账号');
+  return items;
+}
+
+export async function shift(api, id) {
+  const before = await accounts(api);
+  if (!before.some(a => a.id === id)) throw Error('目标不在关联账号列表中');
+  if (!before.find(a => a.id === id).current) {
+    await api.post('/api/hrm/login/identityShift', {shiftid: id}, {forceCookie: true});
+  }
+  const after = await accounts(api);
+  if (!after.find(a => a.id === id)?.current) throw Error('切换未验证成功，停止后续业务操作');
+  return after;
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const [command, ...args] = argv;
+  if (!command || command === 'help') {
+    console.log('accounts | after-login | switch <账号ID> | default-set <账号ID> | default-clear | draft-preview <流程ID> <值文件> <标题> <计划文件> [明细文件] | draft-save <计划文件> | draft-verify <计划文件> | draft-submit <计划文件> --confirm | draft-update-preview <流程ID> <值文件> <标题> <新计划文件> <明细文件或-> <原requestId> | browser-options <流程ID> <字段ID> [上下文文件] | adapter-register <流程ID> <脚本文件> <映射文件>');
+    return;
+  }
+  const dist = path.dirname(fileURLToPath(import.meta.url));
+  const load = name => import(pathToFileURL(path.join(dist, name + '.js')).href);
+  const {loadConfig} = await load('config');
+  const {createApiFromProfile} = await load('client');
+  const cfg = loadConfig(), api = await createApiFromProfile(cfg);
+  const list = await accounts(api);
+  const accountId = list.find(a => a.current).id;
+  // 独立偏好文件，避免工具写配置时丢失；按环境和关联账号组隔离。
+  const prefFile = path.join(path.dirname(cfg._configPath), 'office-project-defaults.json');
+  const scope = createHash('sha256').update(cfg.baseUrl + '\n' + list.map(a => a.id).sort().join(',')).digest('hex');
+  const prefs = fs.existsSync(prefFile) ? JSON.parse(fs.readFileSync(prefFile, 'utf8')) : {};
+  if (['accounts', 'after-login', 'switch', 'default-set', 'default-clear'].includes(command)) {
+    let result = list;
+    if (command === 'default-set') {
+      if (!list.some(a => a.id === args[0])) throw Error('默认账号必须属于当前关联账号列表');
+      prefs[scope] = args[0];
+      fs.writeFileSync(prefFile, JSON.stringify(prefs, null, 2));
+    }
+    if (command === 'default-clear') {
+      delete prefs[scope];
+      fs.writeFileSync(prefFile, JSON.stringify(prefs, null, 2));
+    }
+    if (command === 'switch') result = await shift(api, args[0]);
+    if (command === 'after-login' && prefs[scope]) result = await shift(api, prefs[scope]);
+    console.log(JSON.stringify({accounts: result, defaultAccountId: prefs[scope] || null,
+      prompt: prefs[scope] ? '已核验默认项目；是否需要切换其他项目？可以更改或取消默认项目。' : '是否切换项目（次账号）？可以设置默认项目，以后登录自动切换。'}, null, 2));
+    return;
+  }
+  const runtime = await load('workflow-runtime');
+  const preparation = await load('field-preparation');
+  const getForm = async (workflowId, requestId) => {
+    const r = await api.post('/api/workflow/reqform/loadForm', {workflowid:workflowId, iscreate:requestId?'0':'1', requestid:String(requestId??'-1')}, {forceCookie:true});
+    if(r.json?.params?.verifyRight!==true || String(r.json.params.currentUserid)!==accountId) throw Error('表单权限或账号不符');
+    return r.json;
+  };
+  if (command === 'browser-options') {
+    const [workflowId,fieldId,contextFile]=args;
+    const context=contextFile?JSON.parse(fs.readFileSync(contextFile,'utf8')):{};
+    const form=await getForm(workflowId,context.requestId);
+    const adapter=await runtime.loadAdapter(cfg,workflowId,form);
+    if(adapter?.browserContext) Object.assign(context,await adapter.browserContext({form,fieldId,context,mapping:adapter.mapping}));
+    console.log(JSON.stringify(await runtime.queryBrowser(api,form,fieldId,context),null,2));return;
+  }
+  if (command === 'adapter-register') {
+    const [workflowId,source,mappingFile]=args;
+    runtime.registerAdapter(cfg,workflowId,await getForm(workflowId),source,JSON.parse(fs.readFileSync(mappingFile,'utf8')));
+    console.log('已登记本机适配；不随升级包分发');return;
+  }
+  if (command === 'draft-preview' || command === 'draft-update-preview') {
+    const [workflowId, valuesFile, title, planFile, detailsFile, requestId] = args;
+    if(!planFile || !title || fs.existsSync(planFile)) throw Error('参数不全或计划已存在');
+    if(command==='draft-update-preview' && !requestId)throw Error('更新原稿必须提供requestId');
+    const form=await getForm(workflowId,requestId);
+    const plan={workflowId,requestName:title,values:JSON.parse(fs.readFileSync(valuesFile,'utf8')),details:detailsFile&&detailsFile!=='-'?JSON.parse(fs.readFileSync(detailsFile,'utf8')):[],baseUrl:cfg.baseUrl,accountId,requestId};
+    if(plan.values.values) { const input=plan.values; plan.values=input.values;plan.browserNames=input.browserNames??{};plan.detailBrowserNames=input.detailBrowserNames??{}; }
+    const prepared=await preparation.prepareFields(cfg,plan,{api,form});
+    plan.expected=prepared.expected;
+    plan.prepared={...prepared,body:Object.fromEntries(Object.entries(prepared.body).filter(([k])=>!/token|signature|UUID/i.test(k)))};
+    fs.writeFileSync(planFile,JSON.stringify(plan,null,2),{flag:'wx'});
+    console.log(JSON.stringify({state:'local-preview-only',...plan},null,2));return;
+  }
+  if(!['draft-save','draft-verify','draft-submit'].includes(command))throw Error('未知命令');
+  const planFile=args[0],receiptFile=planFile+'.receipt.json';
+  const plan=JSON.parse(fs.readFileSync(planFile,'utf8'));
+  if(plan.baseUrl!==cfg.baseUrl || plan.accountId!==accountId || !plan.expected)throw Error('计划环境/账号不符或旧版计划，请重新预览，不重复新建');
+  let receipt=fs.existsSync(receiptFile)?JSON.parse(fs.readFileSync(receiptFile,'utf8')):null;
+  const action=command==='draft-submit'?'submit':'save';
+  if(command==='draft-submit' && args[1]!=='--confirm')throw Error('正式提交需在完整预览后明确确认，使用 --confirm');
+  if(command==='draft-save'||command==='draft-submit') {
+    if(receipt)throw Error('已有保存回执，禁止重复执行，请先核验');
+    const form=await getForm(plan.workflowId,plan.requestId);
+    if(!plan.prepared)throw Error('旧计划缺少统一准备快照，请重新预览');
+    const prepared=plan.prepared;
+    await preparation.checkAdapter(cfg,plan,form);
+    const tables=await runtime.detailTables(api,form,plan.workflowId,plan.requestId);
+    preparation.checkBaseline(prepared,form,tables);
+    const body=preparation.actionBody(prepared,form,action);
+    const menu=await api.post('/api/workflow/reqform/rightMenu',{...form.params,...form.submitParams,isaffirmance:'0',isaffirmanceSrc:''},{forceCookie:true});
+    if(!menu.json?.rightMenus?.some(m=>m.systemMenuType===(action==='save'?'SAVE':'SUBMIT')))throw Error('没有保存权限');
+    receipt={state:'executing',action,requestId:plan.requestId};fs.writeFileSync(receiptFile,JSON.stringify(receipt),{flag:'wx'});
+    const saved=await api.post('/api/workflow/reqform/requestOperation',body,{forceCookie:true});
+    Object.assign(receipt,preparation.classifyWrite(saved,plan.requestId));
+    fs.writeFileSync(receiptFile,JSON.stringify(receipt,null,2));
+    if(receipt.state==='failed')throw Error('保存明确失败：'+JSON.stringify(receipt.messageInfo));
+    if(receipt.state==='uncertain')throw Error('保存结果不明，请核验，禁止重复新建');
+  }
+  if(!receipt?.requestId)throw Error('结果不明，禁止重复新建，请到我的请求核验');
+  const form=await getForm(plan.workflowId,receipt.requestId);
+  const tables=await runtime.detailTables(api,form,plan.workflowId,receipt.requestId);
+  if(receipt.state==='failed')throw Error('上次保存明确失败，不能将原稿回读冒充保存成功');
+  const problems=preparation.verifyAction(plan.expected,form,tables,receipt.action??'save');
+  const current=(await accounts(api)).find(a=>a.current);
+  if(current.id!==plan.accountId)problems.push('账号变化');
+  receipt.state=problems.length?'verification-required':receipt.action==='submit'?'submitted-verified':'draft-verified';receipt.problems=problems;
+  fs.writeFileSync(receiptFile,JSON.stringify(receipt,null,2));
+  const {buildRequestFormUrl}=await load('wfcreate');
+  // The business receipt is already durable; link issuance must never replay the write.
+  const {resolveBrowserLink} = await load('browser-links');
+  const link = await resolveBrowserLink(cfg, buildRequestFormUrl(cfg.baseUrl,receipt.requestId,plan.workflowId));
+  console.log(JSON.stringify({...receipt,...link},null,2));
+  if(problems.length)process.exitCode=1;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  main().catch(e => {console.error(e.message); process.exitCode = 1;});
+}

package/dist/pageopen.js

@@ -0,0 +1,29 @@
+import { endpointFor } from './config.js';
+
+const PAGE_MAP = {
+    center: '/wui/index.html#/main/workflow/index',
+    todo: '/wui/index.html#/main/workflow/doing',
+    done: '/wui/index.html#/main/workflow/done',
+    mine: '/wui/index.html#/main/workflow/mine',
+    draft: '/wui/index.html#/main/workflow/draft',
+    all: '/wui/index.html#/main/workflow/all',
+    newflow: '/spa/workflow/static4form/index.html#/main/workflow/req?iscreate=1',
+    monitor: '/wui/index.html#/main/workflow/monitor',
+};
+
+export function pageUrl(cfg, page, requestId) {
+    const base = endpointFor(cfg).baseUrl.replace(/\/+$/, '');
+    if (page === 'view') {
+        if (!requestId)
+            throw new Error('打开流程详情需要 --request-id <请求 ID>。');
+        return `${base}/spa/workflow/static4form/index.html#/main/workflow/req?iscreate=0&requestid=${encodeURIComponent(requestId)}`;
+    }
+    const path = PAGE_MAP[page];
+    if (!path)
+        throw new Error(`不支持的页面“${page}”。可选：${Object.keys(PAGE_MAP).join('、')}、view。`);
+    return base + path;
+}
+
+export function availablePages() {
+    return [...Object.keys(PAGE_MAP), 'view'];
+}

package/dist/parse.js

@@ -0,0 +1,177 @@
+/**
+ * BDIP5 ec/dev/table/datas 响应解析。
+ *
+ * 实跑确认的结构：
+ *   - splitPageKey 响应里 dataKey 在 `sessionkey` 字段（小写）。
+ *   - datas 响应顶层含 `columns`（列定义，dataIndex/title/dbField）和 `datas`（行数组，50 行/页）。
+ *   - 每行同时有原始字段（如 creater="1" 是 id）和 `<field>span` 渲染字段（含可读名称 / HTML）。
+ *     可读值优先取 span 字段并去 HTML 标签。
+ *   - counts 响应 `{"count":N,"status":true}`。
+ */
+/** 从一组候选路径里取第一个非空值，路径用点号分隔、支持下标。 */
+export function pickByPaths(obj, paths) {
+    if (obj == null)
+        return undefined;
+    for (const p of paths) {
+        const v = getPath(obj, p);
+        if (v !== undefined && v !== null && v !== '')
+            return v;
+    }
+    return undefined;
+}
+function getPath(obj, path) {
+    const tokens = path.replace(/\[(\d+)\]/g, '.$1').split('.').filter((t) => t.length > 0);
+    let cur = obj;
+    for (const t of tokens) {
+        if (cur == null)
+            return undefined;
+        cur = cur[t];
+    }
+    return cur;
+}
+/** 从 getWfListParams / splitPageKey 响应里提取 dataKey（sessionkey）。 */
+export function extractDataKey(resp) {
+    const v = pickByPaths(resp, [
+        'sessionkey',
+        'data.sessionkey',
+        'sessionKey',
+        'data.sessionKey',
+        'dataKey',
+        'data.dataKey',
+        'data',
+    ]);
+    if (typeof v === 'string' && v.trim())
+        return v.trim();
+    return scanForDataKey(resp);
+}
+function scanForDataKey(obj) {
+    if (obj == null)
+        return null;
+    if (typeof obj === 'string') {
+        if (/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}_[A-F0-9]{32}$/.test(obj)) {
+            return obj;
+        }
+        return null;
+    }
+    if (Array.isArray(obj)) {
+        for (const it of obj) {
+            const r = scanForDataKey(it);
+            if (r)
+                return r;
+        }
+        return null;
+    }
+    if (typeof obj === 'object') {
+        for (const v of Object.values(obj)) {
+            const r = scanForDataKey(v);
+            if (r)
+                return r;
+        }
+    }
+    return null;
+}
+/** 提取列定义（可用于把行字段映射到中文标题）。 */
+export function extractColumns(datasResp) {
+    const cols = pickByPaths(datasResp, ['columns', 'data.columns', 'result.columns']);
+    if (!Array.isArray(cols))
+        return [];
+    return cols.map((c) => ({ dataIndex: c?.dataIndex, title: c?.title, dbField: c?.dbField })).filter((c) => c.dataIndex);
+}
+/** 从 datas 响应里提取行数组。 */
+export function extractRows(datasResp) {
+    const arr = pickByPaths(datasResp, ['datas', 'data.datas', 'rows', 'data.rows', 'data', 'list']);
+    if (Array.isArray(arr))
+        return arr;
+    if (arr && typeof arr === 'object' && !Array.isArray(arr)) {
+        const vals = Object.values(arr).filter((v) => v && typeof v === 'object');
+        if (vals.length)
+            return vals;
+    }
+    return [];
+}
+/** 从 counts 或 datas 响应里提取总数。 */
+export function extractTotal(resp) {
+    const v = pickByPaths(resp, ['count', 'data.count', 'total', 'data.total', 'totalCount', 'data.totalCount', 'result.count']);
+    if (typeof v === 'number')
+        return v;
+    if (typeof v === 'string' && /^\d+$/.test(v))
+        return parseInt(v, 10);
+    return null;
+}
+/** 去掉 HTML 标签与常见实体，得到纯文本。 */
+export function stripHtml(s) {
+    if (s == null)
+        return '';
+    let str = String(s);
+    str = str.replace(/<[^>]*>/g, '');
+    str = str
+        .replace(/&nbsp;/g, ' ')
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&#39;/g, "'");
+    return str.trim();
+}
+/**
+ * 从 requestnamespan 提取可见标题。
+ * OA 把标题放进第一个 `<a>`（模板前缀如「[退回]」也在 `<a>` 内），把「我的关注」等状态标签
+ * 以独立 `<div class='wf_attention_div_btn'>` 追加在 `<a>` 之后——整体去标签会把标签文字并进标题
+ * （实测「我的关注」页签的标题被渲染成「采购审批4-... 我的关注」）。
+ * 故优先只取第一个 `<a>` 的文本；无 `<a>` 时回退整体去标签。
+ */
+function extractTitleFromNamespan(html) {
+    const s = String(html ?? '');
+    if (!s)
+        return '';
+    const m = s.match(/<a\b[^>]*>([\s\S]*?)<\/a>/i);
+    return stripHtml(m ? m[1] : s);
+}
+const LEVEL_LABEL = {
+    '0': '一般',
+    '1': '重要',
+    '2': '紧急',
+    '3': '紧急',
+};
+/**
+ * 把一行数据映射成标准待办项。
+ * 可读值优先取 `<field>span`（去 HTML），其次原始字段。
+ */
+export function normalizeRow(row, columns) {
+    if (!row || typeof row !== 'object')
+        return {};
+    void columns; // 列定义目前仅用于 extractColumns；字段名已稳定，直接按已知 dataIndex 取
+    const get = (keys) => pickByPaths(row, keys);
+    const spanOr = (dataIndex, extraKeys = []) => stripHtml(get([`${dataIndex}span`, dataIndex, ...extraKeys]));
+    // requestnamespan 是 OA 已按管理员模板渲染的可见标题；原始 requestname 仅作回退。
+    const rawTitle = stringify(get(['requestname', 'requestName']));
+    const title = extractTitleFromNamespan(get(['requestnamespan'])) || rawTitle;
+    const levelRaw = stringify(get(['requestlevel', 'level'])) ?? '';
+    const level = levelRaw ? (LEVEL_LABEL[levelRaw] ?? levelRaw) : undefined;
+    const creatorIdRaw = get(['createrid', 'creatorid', 'creatorId', 'creater']);
+    const creatorId = /^\d+$/.test(String(creatorIdRaw ?? '').trim()) ? String(creatorIdRaw).trim() : undefined;
+    return {
+        requestId: stringify(get(['requestid', 'requestId', 'id', 'randomField2', 'randomFieldId'])),
+        title,
+        rawTitle,
+        creator: spanOr('creater', ['createrName', 'creator', 'createName']),
+        creatorId,
+        createdate: spanOr('createdate', ['createdatespan', 'createDate']),
+        receivedate: spanOr('receivedate', ['receivedate', 'recieveDate']),
+        // 注意：服务端流程列表**只有节点 id**（currentnodeidspan 实测也是 id 本身，整行无节点名），
+        // 节点名由 nodemap.annotateNodeNames 按流程节点表回填到 nodeName。
+        node: stripHtml(get(['currentnodeidspan', 'currentnodespan'])) || stringify(get(['currentnodeid', 'nodeName', 'nodename'])),
+        nodeName: undefined,
+        workflowId: stringify(get(['workflowid', 'workflowId'])),
+        status: stripHtml(get(['statusspan'])) || stringify(get(['status'])),
+        level,
+        requestmark: stringify(get(['requestmark'])),
+        currentOperator: spanOr('unoperators', ['unoperatorspan', 'currentoperator', 'operator']),
+        raw: row,
+    };
+}
+function stringify(v) {
+    if (v === undefined || v === null || v === '')
+        return undefined;
+    return String(v);
+}

package/dist/password-input.js

@@ -0,0 +1,84 @@
+// Separate input boundary: never accept credentials in argv, files or configuration.
+import { StringDecoder } from 'node:string_decoder';
+export const PASSWORD_RISK_NOTICE = '临时兼容登录需要处理账号密码；通过聊天输入可能进入平台记录、模型上下文或日志。程序不保存密码，但不能消除平台侧风险。请单独征得用户明确同意，不要使用管理员账号。';
+function failure(code, message) { const error = new Error(message); error.code = code; return error; }
+export function assertNoCredentialArguments(args) {
+    const flags = args?.flags ?? {};
+    if (Object.keys(flags).some(key => /password|passwd|credentials|username|loginid|secret/i.test(key)
+        && !['allow-insecure-password-input', 'credentials-stdin'].includes(key))) {
+        throw failure('PASSWORD_ARGUMENT_FORBIDDEN', '不接受命令行、配置或文件传入的账号密码；请使用独立进程 stdin。');
+    }
+    if ((args?._?.length ?? 0) > 2) throw failure('PASSWORD_ARGUMENT_FORBIDDEN', '登录命令不接受附加位置参数。');
+}
+/** One JSON line from a distinct process stdin; no shell command interpolation. */
+export async function readPasswordCredentials(input = process.stdin, options = {}) {
+    return readInputLine(input, options, false);
+}
+export async function readCaptchaAnswer(input = process.stdin, options = {}) {
+    return readInputLine(input, { timeoutMs: 300000, maxBytes: 1024, ...options }, true);
+}
+async function readInputLine(input, { timeoutMs = 60000, maxBytes = 8192, signal } = {}, captcha) {
+    if (signal?.aborted) throw failure('PASSWORD_CANCELLED', '输入已取消。');
+    if (!input || input.isTTY === true || input.destroyed || input.readableEnded || typeof input.on !== 'function') {
+        throw failure('PASSWORD_INPUT_UNAVAILABLE', '当前工具没有可用的独立 stdin 输入；请勿把密码拼入命令或临时文件。');
+    }
+    return new Promise((resolve, reject) => {
+        let text = '', bytes = 0, settled = false, timer;
+        const decoder = new StringDecoder('utf8');
+        const cleanup = () => {
+            clearTimeout(timer);
+            input.removeListener('data', data);
+            input.removeListener('end', end);
+            input.removeListener('error', failed);
+            signal?.removeEventListener('abort', cancelled);
+            input.pause?.();
+            // An open tool pipe must remain reusable for captcha, but not keep a
+            // completed CLI alive. The next read has its own referenced timeout.
+            input.unref?.();
+            text = '';
+        };
+        const finish = error => {
+            if (settled) return;
+            settled = true;
+            if (error) { cleanup(); reject(error); return; }
+            try {
+                const value = JSON.parse(text);
+                if (captcha) {
+                    if (!value || typeof value !== 'object' || Array.isArray(value)
+                        || Object.keys(value).length !== 1 || typeof value.captcha !== 'string'
+                        || !/^[A-Za-z0-9]{1,16}$/.test(value.captcha)) throw new Error('invalid');
+                    const answer = value.captcha;
+                    cleanup(); resolve(answer); return;
+                }
+                if (!value || typeof value !== 'object' || Array.isArray(value)
+                    || Object.keys(value).some(k => !['username', 'password'].includes(k))
+                    || typeof value.username !== 'string' || !value.username.trim()
+                    || typeof value.password !== 'string' || !value.password
+                    || value.username.length > 256 || value.password.length > 1024
+                    || /[\u0000-\u001f\u007f]/.test(value.username + value.password)) {
+                    throw new Error('invalid');
+                }
+                const credentials = { username: value.username, password: value.password };
+                cleanup(); resolve(credentials);
+            } catch { cleanup(); reject(failure('PASSWORD_INPUT_INVALID', captcha ? '下一行必须是仅含 captcha 字符串的 JSON；未输出输入内容。' : 'stdin 必须是一行仅含 username 和 password 字符串的 JSON；未输出输入内容。')); }
+        };
+        const data = chunk => {
+            bytes += Buffer.isBuffer(chunk) ? chunk.length : Buffer.byteLength(String(chunk));
+            if (bytes > maxBytes) return finish(failure('PASSWORD_INPUT_INVALID', '凭据输入过长，已停止；未输出输入内容。'));
+            text += Buffer.isBuffer(chunk) ? decoder.write(chunk) : String(chunk);
+            if (text.includes('\n')) {
+                const [line, ...rest] = text.split('\n');
+                if (rest.join('\n').trim()) return finish(failure('PASSWORD_INPUT_INVALID', '只接受一行凭据 JSON。'));
+                text = line.replace(/\r$/, ''); finish();
+            }
+        };
+        const end = () => finish();
+        const failed = () => finish(failure('PASSWORD_INPUT_UNAVAILABLE', '凭据输入通道中断；未输出输入内容。'));
+        const cancelled = () => finish(failure('PASSWORD_CANCELLED', '输入已取消。'));
+        signal?.addEventListener('abort', cancelled, { once: true });
+        input.ref?.();
+        input.on('data', data); input.on('end', end); input.on('error', failed);
+        timer = setTimeout(() => finish(failure('PASSWORD_INPUT_UNAVAILABLE', '等待独立 stdin 输入超时；请勿改用聊天命令或临时文件拼接密码。')), timeoutMs);
+        input.resume?.();
+    });
+}