bfi-cli 0.1.110 → 0.1.111

package/dist/_chunks/package-plugin.mjs

@@ -7,8 +7,8 @@ import { randomUUID } from "node:crypto";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { lstat, mkdir, open, readFile, readdir, realpath, rename, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
-import { z } from "zod";
 import { execFile } from "node:child_process";
+import { z } from "zod";
 const nativeManifestFormats = {
 	"claude-code": ["CLAUDE"],
 	codex: [

package/dist/cli.mjs

@@ -30,6 +30,7 @@ import { promisify } from "util";
 import { execFile, spawn, spawnSync } from "child_process";
 import { access as access$1, chmod, cp as cp$1, lstat as lstat$1, mkdir as mkdir$1, mkdtemp, readFile as readFile$1, readdir as readdir$1, readlink, realpath as realpath$1, rename as rename$1, rm as rm$1, stat, symlink, writeFile as writeFile$1 } from "fs/promises";
 import { determineAgent } from "@vercel/detect-agent";
+import { spawn as spawn$1 } from "node:child_process";
 import { applyEdits, getNodeValue, modify, parseTree } from "jsonc-parser";
 import { parse as parse$1, stringify } from "smol-toml";
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
@@ -5899,9 +5900,68 @@ function fail(message) {
 	process.exit(1);
 }
 var UseCommandError = class extends Error {};
+function openBrowser(url) {
+	const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+	const args = process.platform === "win32" ? [
+		"/c",
+		"start",
+		"",
+		url
+	] : [url];
+	try {
+		const child = spawn$1(cmd, args, {
+			detached: true,
+			stdio: "ignore"
+		});
+		child.on("error", () => {});
+		child.unref();
+	} catch {}
+}
+var DeviceFlowUnavailableError = class extends Error {};
+var DeviceFlowDeniedError = class extends Error {};
+function dataOf(body) {
+	if (body && typeof body === "object") {
+		const data = body.data;
+		if (data && typeof data === "object") return data;
+	}
+	return {};
+}
+async function requestDeviceCode(client) {
+	const resp = await client.request("POST", "/auth/device/code");
+	const data = dataOf(resp.body);
+	const deviceCode = String(data.deviceCode || "");
+	const userCode = String(data.userCode || "");
+	const verificationUri = String(data.verificationUri || "");
+	if (resp.status !== 200 || !deviceCode || !userCode || !verificationUri) throw new DeviceFlowUnavailableError(`设备授权接口不可用（HTTP ${resp.status}）`);
+	return {
+		deviceCode,
+		userCode,
+		verificationUri,
+		expiresIn: Number(data.expiresIn) > 0 ? Number(data.expiresIn) : 900,
+		interval: Number(data.interval) > 0 ? Number(data.interval) : 5
+	};
+}
+async function pollDeviceToken(client, deviceCode, opts) {
+	const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+	const now = opts.now ?? (() => Date.now());
+	const deadline = now() + opts.expiresInSec * 1e3;
+	while (now() < deadline) {
+		await sleep(opts.intervalSec * 1e3);
+		const resp = await client.request("POST", "/auth/device/token", { body: { deviceCode } });
+		const data = dataOf(resp.body);
+		if (resp.status === 200 && data.accessToken) return String(data.accessToken);
+		if (resp.status >= 500) throw new DeviceFlowUnavailableError(`设备授权轮询失败（HTTP ${resp.status}）`);
+		const error = String(data.error || "");
+		if (error === "authorization_pending") continue;
+		if (error) throw new DeviceFlowDeniedError(`设备授权失败：${error}`);
+	}
+	throw new DeviceFlowDeniedError("设备授权超时，请重试");
+}
 async function runLogin(args, globalOpts) {
-	const token = getOptionValue$3(args, "--token") || await promptForToken();
 	const { registry } = resolveConfig(globalOpts);
+	const explicitToken = getOptionValue$3(args, "--token");
+	const noDevice = args.includes("--no-device");
+	const token = explicitToken || (noDevice ? await promptForToken() : await loginViaDevice(registry));
 	const api = new SkillHubAPI(registry, token);
 	try {
 		const response = await api.whoami();
@@ -5922,6 +5982,42 @@ async function runLogin(args, globalOpts) {
 		process.exit(1);
 	}
 }
+async function loginViaDevice(registry) {
+	const tokenPage = `${registry.replace(/\/$/, "")}/dashboard/tokens`;
+	const client = new SkillHubAPI(registry, null);
+	let deviceCode;
+	try {
+		deviceCode = await requestDeviceCode(client);
+	} catch (error) {
+		return fallbackToTokenInput(error, tokenPage);
+	}
+	console.error("\n请在浏览器打开以下地址完成授权：");
+	console.error(`  ${deviceCode.verificationUri}`);
+	console.error(`并输入设备代码：${deviceCode.userCode}（${Math.ceil(deviceCode.expiresIn / 60)} 分钟内有效）`);
+	openBrowser(deviceCode.verificationUri);
+	console.error("等待授权中…（Ctrl+C 取消）");
+	try {
+		const token = await pollDeviceToken(client, deviceCode.deviceCode, {
+			intervalSec: deviceCode.interval,
+			expiresInSec: deviceCode.expiresIn
+		});
+		console.error("✓ 设备授权成功");
+		return token;
+	} catch (error) {
+		if (error instanceof DeviceFlowUnavailableError) return fallbackToTokenInput(error, tokenPage);
+		if (error instanceof DeviceFlowDeniedError) {
+			console.error(`登录失败：${error.message}`);
+			process.exit(1);
+		}
+		throw error;
+	}
+}
+async function fallbackToTokenInput(error, tokenPage) {
+	console.error(`⚠️ ${error?.message || "设备授权不可用"}，改用网页 Token。`);
+	console.error(`Token 页面：${tokenPage}`);
+	openBrowser(tokenPage);
+	return promptForToken();
+}
 async function runLogout() {
 	const config = loadGlobalConfig();
 	if (config?.token) {
@@ -5934,7 +6030,7 @@ async function runLogout() {
 async function runWhoami(globalOpts) {
 	const { registry, token } = resolveConfig(globalOpts);
 	if (!token) {
-		console.error("未认证。运行：bfi auth login（在隐藏提示中输入 Token）");
+		console.error("未认证。运行：bfi auth login（浏览器设备授权；或 --token 直接指定）");
 		process.exit(1);
 	}
 	const response = await new SkillHubAPI(registry, token).whoami();
@@ -10710,7 +10806,7 @@ ${BOLD}bfi — 用友大业财BFI统一命令行工具${RESET}
 ${BOLD}Usage:${RESET} bfi <command> [options]
 
 ${BOLD}━━━ 认证 ━━━${RESET}
-  auth login [--token <token>]  登录 SkillHub（不带参数时隐藏输入 Token）
+  auth login [--token <token>]  登录 SkillHub（默认设备授权：浏览器打开并输入代码；--no-device 走隐藏输入）
   auth logout                   登出
   auth whoami                   查看当前用户
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bfi-cli",
-  "version": "0.1.110",
+  "version": "0.1.111",
   "description": "用友大业财BFI统一命令行工具，支持技能，技能包，元数据，UI元数据等",
   "type": "module",
   "bin": {