bdip-office-assistant-cli 0.0.0-stage → 1.0.0

package/dist/password-login.js

@@ -0,0 +1,208 @@
+import { constants, createPublicKey, publicEncrypt } from 'node:crypto';
+
+// Intentionally independent of auth/config/token: no persistence, registration, or logging.
+const messages = {
+ PASSWORD_INVALID_INPUT: '密码登录输入或平台地址无效', PASSWORD_NETWORK_ERROR: '密码登录网络请求失败',
+ PASSWORD_INVALID_URL: '密码登录平台地址无效', PASSWORD_TLS_REQUIRED: '密码登录仅支持HTTP或HTTPS地址',
+ PASSWORD_HTTP_CONSENT_REQUIRED: '当前HTTP站点尚未启用密码登录兼容设置',
+ PASSWORD_INVALID_USERNAME: '密码登录用户名无效', PASSWORD_INVALID_PASSWORD: '密码登录密码输入无效', PASSWORD_INVALID_OPTIONS: '密码登录选项无效',
+ PASSWORD_CAPTCHA_REQUIRED: '平台要求图片验证码，请提供人工验证码处理', PASSWORD_CAPTCHA_REJECTED: '原生图片验证码未通过，未自动重试',
+ PASSWORD_INPUT_UNAVAILABLE: '无法取得人工验证输入', PASSWORD_INPUT_INVALID: '人工验证输入格式无效', PASSWORD_CAPTCHA_INVALID: '人工验证码输入无效',
+ PASSWORD_TIMEOUT: '密码登录请求超时', PASSWORD_CANCELLED: '密码登录已取消',
+ PASSWORD_REDIRECT_REJECTED: '密码登录不允许重定向', PASSWORD_RESPONSE_TOO_LARGE: '密码登录响应超过安全上限',
+ PASSWORD_RESPONSE_INVALID: '密码登录响应格式无效', PASSWORD_HTTP_ERROR: '密码登录服务器请求失败',
+ PASSWORD_REQUIREMENTS_UNKNOWN: '无法确认账号登录要求，已停止', PASSWORD_CHALLENGE_UNSUPPORTED: '账号要求额外验证，请使用原生登录处理',
+ PASSWORD_RSA_INVALID: '无法确认原生加密参数，已停止', PASSWORD_RSA_CAPACITY: '登录输入超过原生加密容量，已停止',
+ PASSWORD_LOGIN_REJECTED: '原生密码认证未通过，未自动重试', PASSWORD_COOKIE_UNVERIFIED: '未取得可验证的新登录会话',
+ PASSWORD_CHANGE_REQUIRED: '平台要求修改密码，请先在原生界面处理', PASSWORD_POLICY_UNKNOWN: '无法确认平台密码策略，已停止',
+ PASSWORD_POLICY_UNSUPPORTED: '平台已启用弱密码限制，当前安全接口不支持验证，请使用原生登录',
+ PASSWORD_IDENTITY_MISMATCH: '无法核实唯一当前登录身份，已停止', FORCED_OFFLINE: '当前会话已被强制下线',
+};
+function fail(code) { const e = new Error(messages[code]); e.code = code; throw e; }
+function object(v) { return v && typeof v === 'object' && !Array.isArray(v); }
+function off(v) { return v === false || v === 0 || v === '0'; }
+function on(v) { return v === true || v === 1 || v === '1'; }
+function bit(v) { return off(v) || on(v); }
+function pathMatches(path, scope) { return path === scope || path.startsWith(scope.endsWith('/') ? scope : scope + '/'); }
+class CookieJar {
+ constructor() { this.items = new Map(); }
+ receive(headers, url) {
+  const lines = typeof headers.getSetCookie === 'function' ? headers.getSetCookie() : (headers.get('set-cookie') || '').split(/,(?=\s*[^;,\s]+=)/);
+  for (const line of lines) {
+   if (!line || /[\r\n]/.test(line)) continue;
+   const [pair, ...rest] = line.split(';').map(s=>s.trim()); const eq=pair.indexOf('='); if(eq<1) continue;
+   const name=pair.slice(0,eq), value=pair.slice(eq+1);
+   if (!/^[!#$%&'*+.^_`|~\w-]+$/.test(name) || /[^\x21-\x7e]|[;,]/.test(value)) continue;
+   const attrs=Object.fromEntries(rest.map(s=>{const i=s.indexOf('='); return i<0?[s.toLowerCase(),true]:[s.slice(0,i).toLowerCase(),s.slice(i+1)];}));
+   const domain = typeof attrs.domain==='string'?attrs.domain.replace(/^\./,'').toLowerCase():url.hostname;
+   // Exact host only is deliberately stricter than browser domain matching. No public-suffix scope.
+   if (domain!==url.hostname || (attrs.secure && url.protocol!=='https:')) continue;
+   const path=typeof attrs.path==='string' && attrs.path.startsWith('/')?attrs.path:url.pathname.slice(0,url.pathname.lastIndexOf('/')+1).replace(/\/$/,'')||'/';
+   let expiry=Infinity;
+   if (attrs['max-age']!==undefined) { if(!/^-?\d+$/.test(String(attrs['max-age']))) continue; expiry=Date.now()+Number(attrs['max-age'])*1000; }
+   else if(attrs.expires!==undefined) {expiry=Date.parse(attrs.expires);if(!Number.isFinite(expiry))continue;}
+   if(name.startsWith('__Secure-') && (!attrs.secure || url.protocol!=='https:'))continue;
+   if(name.startsWith('__Host-') && (!attrs.secure || attrs.domain || path!=='/'))continue;
+   const key=`${domain}\n${path}\n${name}`;
+   if(expiry<=Date.now())this.items.delete(key);else this.items.set(key,{name,value,domain,path,secure:!!attrs.secure,expiry});
+  }
+ }
+ applicable(url) { return [...this.items.values()].filter(c=>c.expiry>Date.now() && c.domain===url.hostname && (!c.secure||url.protocol==='https:') && pathMatches(url.pathname,c.path)).sort((a,b)=>b.path.length-a.path.length); }
+ header(url) { return this.applicable(url).map(c=>`${c.name}=${c.value}`).join('; '); }
+ exported(base) {
+  const api=new URL(base+'/api/hrm/login/getAccountList'), business=new URL(base+'/wui/index.html');
+  return this.applicable(business).filter(c=>pathMatches(api.pathname,c.path)).map(c=>`${c.name}=${c.value}`).join('; ');
+ }
+}
+function requirements(data) {
+ const s=data?.loginSetting;
+ if(!object(s)||!bit(s.openRSA)||!bit(s.hasValidateCode)||!bit(s.showDynamicPwd)||!['0','1','2','3','4','5','6'].includes(String(s.userUsbType)))fail('PASSWORD_REQUIREMENTS_UNKNOWN');
+ if(!off(s.showDynamicPwd)||String(s.userUsbType)!=='0')fail('PASSWORD_CHALLENGE_UNSUPPORTED');
+ // These keys are the complete native GetLoginFromCmd contract. Unknown policy keys fail closed.
+ const known=new Set(['userUsbType','hasMultiLang','hasValidateCode','validateCodeKey','numValidateWrong','validateType','showDynamicPwd','needforgotpassword','openRSA']);
+ if(Object.keys(s).some(k=>!known.has(k)))fail('PASSWORD_REQUIREMENTS_UNKNOWN');
+ const names=data.formItems?.map?.(i=>object(i)?i.name:null);
+  if(!Array.isArray(names)||names.length<2||names.length>3||!names.includes('loginid')||!names.includes('userpassword')||names.some(n=>!['loginid','userpassword','validatecode'].includes(n))||new Set(names).size!==names.length||(!on(s.hasValidateCode)&&names.includes('validatecode')))fail('PASSWORD_CHALLENGE_UNSUPPORTED');
+ if(Object.keys(data).some(k=>!['loginSetting','formItems','qrcode','message','status'].includes(k)))fail('PASSWORD_CHALLENGE_UNSUPPORTED');
+ if(data.status!==undefined && String(data.status)!=='1')fail('PASSWORD_REQUIREMENTS_UNKNOWN');
+ return on(s.openRSA);
+}
+function encrypt(value,rsa) {
+ try {
+  if(!object(rsa)||typeof rsa.rsa_pub!=='string'||typeof rsa.rsa_code!=='string'||!rsa.rsa_code||rsa.rsa_code.length>256||typeof rsa.rsa_flag!=='string'||!rsa.rsa_flag||rsa.rsa_flag.length>128)fail('PASSWORD_RSA_INVALID');
+  const key=createPublicKey(rsa.rsa_pub.includes('BEGIN')?rsa.rsa_pub:`-----BEGIN PUBLIC KEY-----\n${rsa.rsa_pub}\n-----END PUBLIC KEY-----`);
+  const bits=key.asymmetricKeyDetails?.modulusLength;
+  if(key.asymmetricKeyType!=='rsa'||!bits||bits<1024||bits>8192)fail('PASSWORD_RSA_INVALID');
+  // Native scripts split at 240 JS chars. Never reproduce their unsafe multi-block ambiguity.
+  const bytes=Buffer.from(value+rsa.rsa_code,'utf8');
+  if(value.length>240 || bytes.length>Math.ceil(bits/8)-11)fail('PASSWORD_RSA_CAPACITY');
+  return publicEncrypt({key,padding:constants.RSA_PKCS1_PADDING},bytes).toString('base64')+rsa.rsa_flag;
+ } catch(e) {if(messages[e?.code])throw e;fail('PASSWORD_RSA_INVALID');}
+}
+
+/** Validate before collecting credentials; an HTTP grant is exact to scheme/host/port. */
+export function assertPasswordLoginTransport(cfg) {
+ try {
+  const u=new URL(cfg?.baseUrl);
+  if(!['http:','https:'].includes(u.protocol))fail('PASSWORD_TLS_REQUIRED');
+  if(u.username||u.password||u.search||u.hash||/%2f|%5c/i.test(u.pathname))fail('PASSWORD_INVALID_URL');
+  const loopback=u.hostname==='localhost'||u.hostname==='[::1]'||/^127(?:\.\d{1,3}){3}$/.test(u.hostname);
+  if(u.protocol==='http:'&&!loopback&&cfg?.httpPasswordLoginOrigin!==u.origin)fail('PASSWORD_HTTP_CONSENT_REQUIRED');
+  return u.href.replace(/\/+$/,'');
+ } catch(e) {if(messages[e?.code])throw e;fail('PASSWORD_INVALID_URL');}
+}
+
+/** Native HTTP authentication. No persistence, custom token registration, or logging.
+ * onCaptcha({image:Buffer,contentType,expiresAt?},{signal}) resolves to one human answer.
+ * The callback must honor signal to release input/file resources when cancelled.
+ * Only JPEG/PNG/GIF <=512KiB are delivered; no server expiry is invented.
+ * Callback wait is excluded from the network budget and bounded to 5 minutes.
+ * Network injection never changes origin consent, redirect or platform policy checks.
+ */
+export async function passwordLogin(cfg, options = {}) {
+ try { if(!object(options))fail('PASSWORD_INVALID_OPTIONS');return await login(cfg,options); }
+ catch(e) { const code=Object.hasOwn(messages,e?.code)?e.code:'PASSWORD_NETWORK_ERROR';const safe=new Error(messages[code]);safe.code=code;throw safe; }
+}
+async function login(cfg,{username,password,fetchImpl=globalThis.fetch,timeoutMs=8000,totalTimeoutMs=45000,maxResponseBytes=1024*1024,signal,onCaptcha}={}) {
+ // Error objects are reconstructed below so no raw server/network/crypto text escapes.
+ const base=assertPasswordLoginTransport(cfg);
+ if(typeof username!=='string'||!username.trim()||username!==username.trim()||username.length>1024||/[\x00-\x1f\x7f]/.test(username))fail('PASSWORD_INVALID_USERNAME');
+ if(typeof password!=='string'||!password||password.length>16384||/[\x00\r\n]/.test(password))fail('PASSWORD_INVALID_PASSWORD');
+ if(typeof fetchImpl!=='function'||(onCaptcha!==undefined&&typeof onCaptcha!=='function')||(signal!==undefined&&!(signal instanceof AbortSignal))||![timeoutMs,totalTimeoutMs,maxResponseBytes].every(v=>Number.isSafeInteger(v)&&v>0)||timeoutMs>30000||totalTimeoutMs>120000||maxResponseBytes>4*1024*1024)fail('PASSWORD_INVALID_OPTIONS');
+ const jar=new CookieJar();let deadline=Date.now()+totalTimeoutMs;
+ async function request(path,method='GET',params,cookieOverride,{image=false,allow405=false}={}) {
+  if(signal?.aborted)fail('PASSWORD_CANCELLED');
+  const remaining=Math.min(timeoutMs,deadline-Date.now());if(remaining<=0)fail('PASSWORD_TIMEOUT');
+  const controller=new AbortController();let timeout;let abort;
+  const stop=new Promise((_,reject)=>{const rejectCode=code=>{controller.abort(); const e=new Error(messages[code]);e.code=code;reject(e);};timeout=setTimeout(()=>rejectCode('PASSWORD_TIMEOUT'),remaining);abort=()=>rejectCode('PASSWORD_CANCELLED');signal?.addEventListener('abort',abort,{once:true});});
+  try {
+   return await Promise.race([stop,(async()=>{
+    const url=new URL(base+path); const res=await fetchImpl(url,{method,redirect:'manual',credentials:'omit',signal:controller.signal,headers:{Accept:'*/*','User-Agent':'BDIP-Office-Assistant','X-Requested-With':'XMLHttpRequest',Cookie:cookieOverride ?? jar.header(url),...(method==='POST'?{'Content-Type':'application/x-www-form-urlencoded; charset=utf-8'}:{})},...(method==='POST'?{body:new URLSearchParams(params).toString()}:{})});
+    if(controller.signal.aborted)fail(signal?.aborted?'PASSWORD_CANCELLED':'PASSWORD_TIMEOUT');
+    if(res.redirected || (res.status>=300&&res.status<400)){void res.body?.cancel().catch(()=>{});fail('PASSWORD_REDIRECT_REJECTED');}
+    if(allow405&&res.status===405){void res.body?.cancel().catch(()=>{});return null;}
+     const cap=image?Math.min(maxResponseBytes,512*1024):maxResponseBytes;
+     const length=res.headers.get('content-length'); if(length && Number(length)>cap){void res.body?.cancel().catch(()=>{});fail('PASSWORD_RESPONSE_TOO_LARGE');}
+    if(!res.body?.getReader)fail('PASSWORD_RESPONSE_INVALID');
+    const reader=res.body.getReader();const chunks=[];let count=0;
+    try { while(true){const {done,value}=await reader.read();if(done)break;count+=value.byteLength;if(count>cap){void reader.cancel().catch(()=>{});fail('PASSWORD_RESPONSE_TOO_LARGE');}chunks.push(Buffer.from(value));} } finally {reader.releaseLock();}
+    if(controller.signal.aborted)fail(signal?.aborted?'PASSWORD_CANCELLED':'PASSWORD_TIMEOUT');
+    if(image){
+      if(res.status!==200)fail('PASSWORD_HTTP_ERROR');
+      const bytes=Buffer.concat(chunks),type=(res.headers.get('content-type')||'').split(';')[0].trim().toLowerCase();
+      const valid=(type==='image/jpeg'&&bytes.length>=4&&bytes[0]===255&&bytes[1]===216&&bytes[2]===255&&bytes.at(-2)===255&&bytes.at(-1)===217)||(type==='image/png'&&bytes.length>=24&&bytes.subarray(0,8).equals(Buffer.from([137,80,78,71,13,10,26,10])))||(type==='image/gif'&&bytes.length>=13&&['GIF87a','GIF89a'].includes(bytes.subarray(0,6).toString('ascii')));
+      if(!valid)fail('PASSWORD_RESPONSE_INVALID');jar.receive(res.headers,url);return {image:bytes,contentType:type};
+     }
+     let data;try{data=JSON.parse(Buffer.concat(chunks).toString('utf8'));}catch{fail('PASSWORD_RESPONSE_INVALID');}if(!object(data))fail('PASSWORD_RESPONSE_INVALID');
+    if(['003','004','FORCED_OFFLINE'].some(c=>[data.code,data.errorCode,data.msgcode].some(v=>String(v)===c)))fail('FORCED_OFFLINE');
+    if(res.status!==200)fail('PASSWORD_HTTP_ERROR');
+    jar.receive(res.headers,url);return data;
+   })()]);
+  } finally {clearTimeout(timeout);signal?.removeEventListener('abort',abort);}
+ }
+ const bootstrap=await request('/api/hrm/login/getLoginForm','POST',{loginid:'',langid:'7'});
+ const rsaEnabled=requirements(bootstrap);
+ const rsaInfo=()=>request('/rsa/weaver.rsa.GetRsaInfo?ts='+Date.now());
+ let loginid=username;
+ if(rsaEnabled)loginid=encrypt(username,await rsaInfo());
+ const account=await request('/api/hrm/login/getLoginForm','POST',{loginid,langid:'7'});
+ if(requirements(account)!==rsaEnabled)fail('PASSWORD_REQUIREMENTS_UNKNOWN');
+ let validatecode='',validateCodeKey='';
+  if(on(account.loginSetting.hasValidateCode)){
+   if(!onCaptcha)fail('PASSWORD_CAPTCHA_REQUIRED');
+   validateCodeKey=account.loginSetting.validateCodeKey;
+   if(typeof validateCodeKey!=='string'||!validateCodeKey||validateCodeKey.length>256||/[\x00-\x20\x7f]/.test(validateCodeKey))fail('PASSWORD_REQUIREMENTS_UNKNOWN');
+   if(account.loginSetting.validateType!==undefined&&!off(account.loginSetting.validateType))fail('PASSWORD_CHALLENGE_UNSUPPORTED');
+   // Observed native public image request: seriesnum_ + validateCodeKey, never key.
+   const challenge=await request('/weaver/weaver.file.MakeValidateCode?'+new URLSearchParams({seriesnum_:String(Date.now()),validateCodeKey}), 'GET',undefined,undefined,{image:true});
+   const start=Date.now(),captchaController=new AbortController();let timer,abort;
+   try{
+    const stop=new Promise((_,reject)=>{const rejectCode=code=>{const e=new Error(messages[code]);e.code=code;reject(e);captchaController.abort();};timer=setTimeout(()=>rejectCode('PASSWORD_TIMEOUT'),300000);abort=()=>rejectCode('PASSWORD_CANCELLED');signal?.addEventListener('abort',abort,{once:true});if(signal?.aborted)abort();});
+    validatecode=await Promise.race([stop,Promise.resolve().then(()=>onCaptcha(challenge,{signal:captchaController.signal}))]);
+   }catch(e){if(['PASSWORD_CANCELLED','PASSWORD_TIMEOUT','PASSWORD_INPUT_UNAVAILABLE','PASSWORD_INPUT_INVALID','PASSWORD_CAPTCHA_INVALID'].includes(e?.code))throw e;fail('PASSWORD_INPUT_UNAVAILABLE');}
+   finally{clearTimeout(timer);signal?.removeEventListener('abort',abort);captchaController.abort();deadline+=Date.now()-start;}
+   if(typeof validatecode!=='string'||!validatecode.trim()||validatecode!==validatecode.trim()||validatecode.length>128||/[\x00-\x20\x7f]/.test(validatecode))fail('PASSWORD_CAPTCHA_INVALID');
+  }
+  let userpassword=password;
+ if(rsaEnabled){const rsa=await rsaInfo();loginid=encrypt(username,rsa);userpassword=encrypt(password,rsa);}
+ const before=jar.exported(base);
+ const result=await request('/api/hrm/login/checkLogin','POST',{loginid,userpassword,islanguid:'7',logintype:'1',validatecode,validateCodeKey,dynamicPassword:'',tokenAuthKey:'',messages:'',isie:'false'});
+ if(String(result.msgcode)==='52')fail('PASSWORD_CAPTCHA_REJECTED');
+  const uid=String(result.userid??'');
+ if(String(result.loginstatus)!=='true'||String(result.msgcode)!=='0'||! /^[1-9]\d*$/.test(uid))fail('PASSWORD_LOGIN_REJECTED');
+ if((result.authUrl!==undefined&&result.authUrl!=='')||(result.qysflag!==undefined&&String(result.qysflag)!=='0')||(result.isRemoveSession!==undefined&&!off(result.isRemoveSession)))fail('PASSWORD_CHALLENGE_UNSUPPORTED');
+  const fresh=jar.exported(base);if(!fresh||fresh===before)fail('PASSWORD_COOKIE_UNVERIFIED');
+ const policy=await request('/api/hrm/login/remindLogin','POST',{logintype:'1'});
+ if(String(policy.status)!=='1'||(policy.isUpPswd!==undefined&&!['true','false'].includes(String(policy.isUpPswd))))fail('PASSWORD_POLICY_UNKNOWN');
+ if(String(policy.isUpPswd)==='true')fail('PASSWORD_CHANGE_REQUIRED');
+ if(policy.passwdReminder!==undefined&&!bit(policy.passwdReminder))fail('PASSWORD_POLICY_UNKNOWN');
+ if(on(policy.passwdReminder)){if(!bit(policy.canpass))fail('PASSWORD_POLICY_UNKNOWN');if(!on(policy.canpass))fail('PASSWORD_CHANGE_REQUIRED');}
+ // Native online script uses POST {password:C}; legacy backend may be GET only. Metadata
+ // GET fallback is metadata only: no secret or password-strength proof.
+ // Never put plaintext/ciphertext in a URL. On fallback only explicitly
+ // disabled prohibition can proceed; enabled/unknown policy requires native UI.
+ let weak=await request('/api/hrm/password/isWeakPassword','POST',{password:userpassword},undefined,{allow405:true});
+ const metadataOnly=weak===null;
+ if(metadataOnly)weak=await request('/api/hrm/password/isWeakPassword');
+ if((weak.status!==undefined&&String(weak.status)!=='1')||!bit(weak.weakPasswordDisable)||(!metadataOnly&&typeof weak.isWeakPassword!=='boolean'))fail('PASSWORD_POLICY_UNKNOWN');
+ if(on(weak.weakPasswordDisable)&&(metadataOnly||weak.isWeakPassword))fail('PASSWORD_POLICY_UNSUPPORTED');
+ const identity=await request('/api/hrm/login/getAccountList');
+ const rows=identity?.data?.accountlist;
+ const current=Array.isArray(rows)?rows.filter(r=>object(r)&&String(r.iscurrent)==='1'):[];
+ if(identity.status!==undefined&&String(identity.status)!=='1')fail('PASSWORD_IDENTITY_MISMATCH');
+ if(current.length!==1||String(current[0].userid)!==uid)fail('PASSWORD_IDENTITY_MISMATCH');
+ const cookie=jar.exported(base);if(!cookie)fail('PASSWORD_COOKIE_UNVERIFIED');
+ // Prove the exact portable candidate, not a richer API-path jar header that
+ // might contain the only authenticating cookie. One final read; never loop.
+ const finalIdentity=await request('/api/hrm/login/getAccountList','GET',undefined,cookie);
+ const finalRows=finalIdentity?.data?.accountlist;
+ const finalCurrent=Array.isArray(finalRows)?finalRows.filter(r=>object(r)&&String(r.iscurrent)==='1'):[];
+ if((finalIdentity.status!==undefined&&String(finalIdentity.status)!=='1')||finalCurrent.length!==1||String(finalCurrent[0].userid)!==uid)fail('PASSWORD_IDENTITY_MISMATCH');
+ // Even benign rotation changes the candidate and needs a new proof. Stop
+ // conservatively rather than return credentials that were not actually sent.
+ if(jar.exported(base)!==cookie)fail('PASSWORD_COOKIE_UNVERIFIED');
+ // Native GetAccountListCmd returns userid/username/iscurrent, not canonical loginid.
+ // UID is bound to the single fresh password-authenticated session above. Do not
+ // mislabel a display name or user-supplied alias as a verified canonical login ID.
+ return {cookie,userId:uid,loginId:null,mode:'password-http'};
+}

package/dist/querystate.js

@@ -0,0 +1,38 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const stateDir = () => path.resolve(process.cwd(), 'state');
+const queryDir = () => path.join(stateDir(), 'query_contexts');
+
+export function saveCandidateQuery({ workflow, candidates, options }) {
+    fs.mkdirSync(queryDir(), { recursive: true });
+    const id = randomUUID();
+    fs.writeFileSync(path.join(queryDir(), `${id}.json`), JSON.stringify({ id, workflow, candidates, options, createdAt: new Date().toISOString() }, null, 2), 'utf8');
+    return id;
+}
+export function loadCandidateQuery(id) {
+    if (!/^[a-zA-Z0-9-]+$/.test(String(id)))
+        throw new Error('resume-query 格式无效。');
+    const file = path.join(queryDir(), `${id}.json`);
+    if (!fs.existsSync(file))
+        throw new Error('查询上下文不存在或已被清理，请重新搜索流程名称。');
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+export function persistSearchResult(result, title = '待办查询') {
+    const json = JSON.stringify(result, null, 2);
+    if (Buffer.byteLength(json, 'utf8') <= 8192)
+        return null;
+    fs.mkdirSync(stateDir(), { recursive: true });
+    const jsonPath = path.join(stateDir(), 'last_search.json');
+    const mdPath = path.join(stateDir(), 'last_search.md');
+    fs.writeFileSync(jsonPath, json, 'utf8');
+    const items = Array.isArray(result.items)
+        ? result.items
+        : (Array.isArray(result.groups) ? result.groups.flatMap((group) => group.items ?? []) : []);
+    const lines = [`# ${title}`, '', `共 ${result.total ?? items.length} 条，以下为前 10 条：`, ''];
+    for (const item of items.slice(0, 10))
+        lines.push(`- ${item.title ?? '(无标题)'}（${item.requestId ?? ''}）`);
+    fs.writeFileSync(mdPath, lines.join('\n'), 'utf8');
+    return { jsonPath, mdPath };
+}

package/dist/render.js

@@ -0,0 +1,21 @@
+/**
+ * 人类可读输出渲染：框线表格、分隔线。
+ * 集中框线宽度，避免散落的字面量重复。
+ */
+export const BOX_TOP = '═'.repeat(50); // 上下封口
+export const DIVIDER = '─'.repeat(53); // 区内分隔
+/**
+ * 打印一个标题框：顶线 + title + 可选正文行 + 底线。
+ * title/lines 已含前导空格等格式，由调用方决定对齐。
+ */
+export function box(title, lines = []) {
+    console.log(BOX_TOP);
+    if (title)
+        console.log(title);
+    for (const l of lines)
+        console.log(l);
+    console.log(BOX_TOP);
+}
+export function divider() {
+    console.log(DIVIDER);
+}

package/dist/report.js

@@ -0,0 +1,50 @@
+import { endpointFor } from './config.js';
+import { getWfList } from './workflow.js';
+import { getMyCalendar } from './workplan.js';
+import { getEmailList } from './email.js';
+import { getButtons } from './kq.js';
+import { getMyBlogList, isBlogRecalled } from './blog.js';
+
+function source(module, id, time, data) {
+    return { module, id: String(id ?? ''), time: String(time ?? ''), data };
+}
+function onDate(value, date) {
+    return String(value ?? '').slice(0, 10) === date;
+}
+
+/** 只汇总当前 BDIP5 环境可回溯且状态可确认的数据；不把聊天内容、浏览行为或撤回微博当作事实。 */
+export async function collectQueryableBusiness(cfg, date) {
+    const results = await Promise.allSettled([
+        getWfList(cfg, { category: 'done', page: 1, operateTime: date }),
+        getWfList(cfg, { category: 'mine', page: 1, createTime: date }),
+        getMyCalendar(cfg, { selectDate: date }),
+        getEmailList(cfg, { folder: 'inbox', current: 1, startdate: date, enddate: date }),
+        getEmailList(cfg, { folder: 'sent', current: 1, startdate: date, enddate: date }),
+        getButtons(cfg),
+        getMyBlogList(cfg, date, 1),
+    ]);
+    const value = (index, fallback) => results[index].status === 'fulfilled' ? results[index].value : fallback;
+    const failed = results.map((result, index) => result.status === 'rejected' ? ({ index, message: String(result.reason?.message ?? result.reason) }) : null).filter(Boolean);
+    const done = value(0, { items: [] }).items.filter((item) => onDate(item.operatedate ?? item.operateTime, date)).map((item) => source('已办流程', item.requestId, item.operatedate ?? item.operateTime, { title: item.title }));
+    const mine = value(1, { items: [] }).items.filter((item) => onDate(item.createdate ?? item.createTime, date)).map((item) => source('我发起的流程', item.requestId, item.createdate ?? item.createTime, { title: item.title }));
+    const calendar = value(2, { items: [] }).items.filter((item) => onDate(item.beginDateTime, date)).map((item) => source('日程', item.id, item.beginDateTime, { name: item.name, status: item.status }));
+    const inbox = value(3, { items: [] }).items.filter((item) => onDate(item.date, date)).map((item) => source('收件箱', item.id, item.date, { subject: item.subject, from: item.from }));
+    const sent = value(4, { items: [] }).items.filter((item) => onDate(item.date, date)).map((item) => source('已发送邮件', item.id, item.date, { subject: item.subject, to: item.to }));
+    const attendance = value(5, { timeline: [] }).timeline.map((item) => source('考勤', `${item.date}:${item.type}`, item.signTime, { type: item.type, signTime: item.signTime, status: item.kqstatus }));
+    // 微博：列表接口返回 isReCalled（已抓包验证，0=正常发布，1/2=已撤回）。
+    // 仅纳入正常发布（isReCalled=0）的微博，已撤回微博剔除并记入 notes。
+    const blogToday = value(6, { items: [] }).items.filter((it) => onDate(it.workdate, date) || onDate(it.createdate, date));
+    const recalledBlogs = blogToday.filter((it) => isBlogRecalled(it));
+    const blogs = blogToday.filter((it) => !isBlogRecalled(it)).map((item) => source('微博', item.id, item.workdate, { content: item.content?.slice(0, 60) }));
+    const notes = [];
+    if (recalledBlogs.length > 0)
+        notes.push(`微博：${recalledBlogs.length} 条已撤回（isReCalled≠0）未纳入汇总`);
+    return {
+        scope: '当前 BDIP5 环境可查询业务数据汇总（不含操作审计、页面浏览及其他不可查询行为）',
+        baseUrl: endpointFor(cfg).baseUrl,
+        date,
+        sources: { done, mine, calendar, inbox, sent, attendance, blogs },
+        notes,
+        failures: failed,
+    };
+}

package/dist/session-worker.js

@@ -0,0 +1,54 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { loadConfig } from './config.js';
+import { SessionHeartbeat } from './session.js';
+import { keepalivePaths } from './keepalive.js';
+
+async function run() {
+    const [configPath, statePath, leaseId] = process.argv.slice(2);
+    const cfg = loadConfig(configPath);
+    const paths = keepalivePaths(cfg);
+    if (path.resolve(statePath ?? '') !== paths.state || !/^[a-f0-9]{48}$/.test(leaseId ?? '')) throw new Error('Invalid lease');
+    const read = () => { try { return JSON.parse(fs.readFileSync(paths.state, 'utf8')); } catch { return null; } };
+    const initial = read();
+    if (initial?.leaseId !== leaseId || initial.status !== 'starting' || initial.expiresAt <= Date.now()) return;
+    let finished = false, watch, heartbeat, failures = 0;
+    const write = patch => {
+        const current = read();
+        if (current?.leaseId !== leaseId) return false;
+        fs.writeFileSync(paths.state, JSON.stringify({ ...current, ...patch, pid: process.pid }), { mode: 0o600 });
+        return true;
+    };
+    const finish = (status, message) => {
+        if (finished) return;
+        finished = true;
+        if (watch) clearInterval(watch);
+        heartbeat?.stop();
+        write({ status, message, active: false, lastSeen: Date.now(), endedAt: Date.now() });
+        process.off('SIGINT', interrupt); process.off('SIGTERM', interrupt);
+    };
+    const interrupt = () => finish('stopped', '已停止保活');
+    heartbeat = new SessionHeartbeat(cfg, { unref: false, onState: state => {
+        if (finished) return;
+        failures = state.authenticated ? 0 : failures + 1;
+        if (state.authenticated) {
+            write({ status: 'running', lastSeen: Date.now(), userId: state.userId, loginId: state.loginId,
+                mode: state.mode, idleTimeoutSeconds: state.idleTimeoutSeconds, message: state.message ?? null, failures: 0 });
+        } else {
+            write({ lastSeen: Date.now(), failures, message: state.message, code: state.code });
+            if (['FORCED_OFFLINE', 'SESSION_EXPIRED', 'NO_COOKIE', 'PROFILE_CHANGED'].includes(state.code) || failures >= 3) finish('failed', state.message);
+        }
+    } });
+    process.once('SIGINT', interrupt); process.once('SIGTERM', interrupt);
+    // Observe cancellation even while the first network check is still pending.
+    watch = setInterval(() => {
+        const current = read();
+        if (current?.leaseId !== leaseId) finish('stopped', '保活租约已被替换');
+        else if (current.stopRequested) finish('stopped', '已按请求停止保活');
+        else if (Date.now() >= initial.expiresAt) finish('expired', '保活已达到设定截止时间');
+    }, 250);
+    await heartbeat.start();
+    if (finished) heartbeat.stop();
+    else if (!heartbeat.state?.authenticated) finish('failed', heartbeat.state?.message ?? '当前用户检查失败');
+}
+run().catch(() => { process.exitCode = 1; });