bfi-cli 0.1.71 → 0.1.73

package/bin/bfi-db-mcp.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import module from 'node:module';
+
+if (module.enableCompileCache && !process.env.NODE_DISABLE_COMPILE_CACHE) {
+  try {
+    module.enableCompileCache();
+  } catch {
+    // Ignore errors
+  }
+}
+
+await import('../dist/mcp-db/main.mjs');

package/dist/mcp-db/main.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/mcp-db/main.mjs

@@ -0,0 +1,287 @@
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { z } from "zod";
+import mysql from "mysql2/promise";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+const SEMICOLON_SPLIT = /;\s*(?=(?:[^']*'[^']*')*[^']*$)/;
+const FIRST_WORD = /[a-zA-Z_]+/;
+function no(reason) {
+	return {
+		ok: false,
+		kind: "query",
+		reason
+	};
+}
+function stripComments(sql) {
+	let out = "";
+	let i = 0;
+	const len = sql.length;
+	while (i < len) {
+		const c = sql[i];
+		if (c === "'") {
+			out += c;
+			i++;
+			while (i < len) {
+				out += sql[i];
+				if (sql[i] === "'") {
+					if (i + 1 < len && sql[i + 1] === "'") {
+						out += "'";
+						i += 2;
+						continue;
+					}
+					i++;
+					break;
+				}
+				i++;
+			}
+		} else if (c === "-" && sql[i + 1] === "-") while (i < len && sql[i] !== "\n") i++;
+		else if (c === "#") while (i < len && sql[i] !== "\n") i++;
+		else if (c === "/" && sql[i + 1] === "*") {
+			i += 2;
+			while (i + 1 < len && !(sql[i] === "*" && sql[i + 1] === "/")) i++;
+			i = Math.min(i + 2, len);
+		} else {
+			out += c;
+			i++;
+		}
+	}
+	return out;
+}
+function firstKeyword(sql) {
+	const m = sql.match(FIRST_WORD);
+	return m ? m[0].toLowerCase() : "";
+}
+function checkGate(rawSql) {
+	if (!rawSql || !rawSql.trim()) return no("SQL 为空");
+	const stripped = stripComments(rawSql);
+	if (!stripped.trim()) return no("SQL 为空（仅注释）");
+	const stmts = stripped.trim().split(SEMICOLON_SPLIT).map((s) => s.trim()).filter(Boolean);
+	if (stmts.length > 1) return no(`仅支持单语句，实际 ${stmts.length} 条`);
+	const word = firstKeyword(stmts[0]);
+	switch (word) {
+		case "select":
+		case "with": return {
+			ok: true,
+			kind: "query"
+		};
+		case "explain": {
+			const rest = stmts[0].replace(/^explain\s+/i, "");
+			if (/^analyze/i.test(rest)) return no("EXPLAIN ANALYZE 会真实执行语句，拒绝");
+			const target = firstKeyword(rest);
+			if (target === "select" || target === "with") return {
+				ok: true,
+				kind: "explain"
+			};
+			return no("EXPLAIN 仅支持 SELECT/WITH 目标语句");
+		}
+		default: return no(`本地直连仅允许 SELECT/WITH/EXPLAIN，收到: ${(word || "空").toUpperCase()}`);
+	}
+}
+const DEFAULT_MAX_ROWS = 200;
+const MAX_ROWS_LIMIT = 2e3;
+const QUERY_TIMEOUT_MS = 3e4;
+function errMessage(e) {
+	const msg = e instanceof Error ? e.message : String(e);
+	return msg.length > 300 ? `${msg.slice(0, 300)}...` : msg;
+}
+async function directExecute(dsn, sql, maxRows = DEFAULT_MAX_ROWS) {
+	const gate = checkGate(sql);
+	if (!gate.ok) return {
+		ok: false,
+		error_kind: "unsupported_sql",
+		message: gate.reason
+	};
+	const limit = Math.min(Math.max(maxRows, 1), MAX_ROWS_LIMIT);
+	let conn;
+	try {
+		conn = await mysql.createConnection({
+			uri: dsn,
+			connectTimeout: 8e3
+		});
+	} catch (e) {
+		return {
+			ok: false,
+			error_kind: "connection_failed",
+			message: `连接失败: ${errMessage(e)}`
+		};
+	}
+	try {
+		await conn.query("SELECT 1");
+		const started = Date.now();
+		const [rows, fields] = await conn.query({
+			sql,
+			timeout: QUERY_TIMEOUT_MS,
+			rowsAsArray: true
+		});
+		const arr = rows;
+		const truncated = arr.length > limit;
+		return {
+			ok: true,
+			mode: "direct（本地直连，词法级闸门）",
+			columns: fields?.map((f) => f.name) ?? [],
+			rows: arr.slice(0, limit),
+			row_count: Math.min(arr.length, limit),
+			truncated,
+			elapsed_ms: Date.now() - started
+		};
+	} catch (e) {
+		return {
+			ok: false,
+			error_kind: "execute_failed",
+			message: errMessage(e)
+		};
+	} finally {
+		await conn.end().catch(() => {});
+	}
+}
+const GLOBAL_CONFIG_DIR = path.join(os.homedir(), ".bfi");
+const GLOBAL_CONFIG_FILE = path.join(GLOBAL_CONFIG_DIR, "config.json");
+path.join(".bfi", "lock.json");
+function loadGlobalConfig() {
+	try {
+		if (fs.existsSync(GLOBAL_CONFIG_FILE)) {
+			const content = fs.readFileSync(GLOBAL_CONFIG_FILE, "utf8");
+			return JSON.parse(content);
+		}
+	} catch (error) {
+		console.warn(`Warning: Failed to load global config: ${error.message}`);
+	}
+	return null;
+}
+function resolveApiBase() {
+	return process.env.BFI_API_BASE || "http://172.20.35.178:8901";
+}
+function resolveToken() {
+	if (process.env.BFI_TOKEN) return process.env.BFI_TOKEN;
+	return loadGlobalConfig()?.token ?? null;
+}
+var RestError = class extends Error {
+	errorKind;
+	constructor(errorKind, message) {
+		super(message);
+		this.errorKind = errorKind;
+	}
+};
+function requireParam(name, value) {
+	if (!value || !value.trim()) throw new RestError("invalid_params", `${name} 不能为空：请从 db_list_envs 返回结果中原样复制（如 env_code=core1_3）`);
+	return value;
+}
+async function post(path, payload, fetchImpl = fetch) {
+	const token = resolveToken();
+	if (!token) throw new RestError("unauthorized", "未找到 bfi token：请先执行 `bfi auth login --token <sk-token>`（token 获取地址 https://bfi.yyuap.com/user/profile），或设置 BFI_TOKEN 环境变量");
+	let resp;
+	try {
+		resp = await fetchImpl(resolveApiBase() + path, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				Authorization: `Bearer ${token}`
+			},
+			body: JSON.stringify(payload)
+		});
+	} catch (e) {
+		throw new RestError("upstream_unreachable", `bfi-api（${resolveApiBase()}）不可达：${e instanceof Error ? e.message : String(e)}`);
+	}
+	if (resp.status === 401) throw new RestError("unauthorized", "v2 token 无效或过期：请重新 `bfi auth login --token <token>`");
+	const body = await resp.json().catch(() => ({}));
+	if (body.code === 0) return body.data;
+	throw new RestError(body.data?.error_kind || "upstream_error", body.msg || "bfi-api 返回错误");
+}
+async function listEnvs(keyword, envType, fetchImpl) {
+	return post("/bficli/api/v2/db/envs", {
+		keyword,
+		env_type: envType,
+		enabled_only: true
+	}, fetchImpl);
+}
+async function execSql(envCode, sql, maxRows, fetchImpl) {
+	return post("/bficli/api/v2/db/exec", {
+		env_code: requireParam("env_code", envCode),
+		sql: requireParam("sql", sql),
+		max_rows: maxRows
+	}, fetchImpl);
+}
+async function explainSql(envCode, sql, fetchImpl) {
+	return post("/bficli/api/v2/db/explain", {
+		env_code: requireParam("env_code", envCode),
+		sql: requireParam("sql", sql)
+	}, fetchImpl);
+}
+function textResult(payload, isError = false) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(payload, null, 2)
+		}],
+		isError
+	};
+}
+function wrap(fn) {
+	return async (args) => {
+		try {
+			return textResult(await fn(args));
+		} catch (e) {
+			return textResult({
+				ok: false,
+				error_kind: e instanceof RestError ? e.errorKind : "internal_error",
+				message: e instanceof Error ? e.message : String(e)
+			}, true);
+		}
+	};
+}
+function buildServer() {
+	const server = new McpServer({
+		name: "bfi-db",
+		version: "0.1.0"
+	}, { instructions: [
+		"数据库取证通道（只读）：查询环境列表 → EXPLAIN 执行计划（优先）→ 必要时小行数 SELECT 采样。",
+		"DDL/DML 默认被环境权限位拒绝；db_direct 为用户自备连接的本地直连，词法级闸门仅放行 SELECT/WITH/EXPLAIN，结果无审计，写报告须标注\"本地直连取证\"。",
+		"执行前先用 db_list_envs 锁定 env_code（对应诊断的 appCode 先行铁律）。",
+		"降级链：环境清单匹配不到目标环境（env_not_found），或选中环境连接不可达（connection_failed）时，向用户说明并**提示附上数据库连接串**（mysql://user:pwd@host:3306/db），改走 db_direct 本地直连兜底。"
+	].join("\n") });
+	server.registerTool("db_list_envs", {
+		description: "获取可查询的数据库环境列表（env_code/env_name/db_type/datacenter/权限位 allow_ddl·dml·query·explain）。不含密码。执行任何 SQL 前必须先用本工具锁定 env_code。",
+		inputSchema: {
+			keyword: z.string().optional().describe("模糊关键字，匹配 env_code/env_name/datacenter（如 core3、商开）"),
+			env_type: z.enum([
+				"private",
+				"dev",
+				"prod"
+			]).optional().describe("环境类型过滤")
+		}
+	}, wrap((args) => listEnvs(args.keyword, args.env_type)));
+	server.registerTool("db_execute", {
+		description: "在指定环境执行单条 SQL（只读取证）。仅 SELECT/WITH/SHOW/DESC/EXPLAIN；DML/DDL 需环境显式授权位否则 permission_denied。行数上限默认 200。非 mysql 库自动翻译（mysql 语法输入即可）。诊断场景优先 db_explain。",
+		inputSchema: {
+			env_code: z.string().min(1, "env_code 不能为空：请从 db_list_envs 返回的 env_code 字段原样复制（如 core1_3）").describe("环境编码，来自 db_list_envs 返回的 env_code 字段（如 core1_3）原样传入"),
+			sql: z.string().min(1, "sql 不能为空").describe("单条 SQL（mysql 语法）"),
+			max_rows: z.number().int().min(1).max(2e3).optional().describe("行数上限，默认 200")
+		}
+	}, wrap((args) => execSql(args.env_code, args.sql, args.max_rows)));
+	server.registerTool("db_explain", {
+		description: "获取执行计划（慢 SQL 实证首选）。目标语句必须为 SELECT/WITH；gscm 按 db_type 组装 EXPLAIN（oracle 两步 EXPLAIN PLAN + DBMS_XPLAN）。结果为计划行，EXPLAIN 结果进报告须附原始计划行。",
+		inputSchema: {
+			env_code: z.string().min(1, "env_code 不能为空：请从 db_list_envs 返回的 env_code 字段原样复制（如 core1_3）").describe("环境编码，来自 db_list_envs 返回的 env_code 字段（如 core1_3）原样传入"),
+			sql: z.string().min(1, "sql 不能为空").describe("目标 SELECT/WITH 语句（mysql 语法）")
+		}
+	}, wrap((args) => explainSql(args.env_code, args.sql)));
+	server.registerTool("db_direct", {
+		description: "用户自备连接串的本地直连（不经服务端，无审计）。词法级闸门仅放行单条 SELECT/WITH/EXPLAIN（EXPLAIN ANALYZE 拒绝），执行前连接预检。仅当用户明确提供连接串且环境通道不可达时使用；报告引用本工具结果必须标注\"本地直连取证\"。",
+		inputSchema: {
+			dsn: z.string().min(1, "dsn 不能为空").describe("连接串 mysql://user:pwd@host:3306/db（密码仅内存持有）"),
+			sql: z.string().min(1, "sql 不能为空").describe("单条 SELECT/WITH/EXPLAIN"),
+			max_rows: z.number().int().min(1).max(2e3).optional().describe("行数上限，默认 200")
+		}
+	}, wrap((args) => directExecute(args.dsn, args.sql, args.max_rows)));
+	return server;
+}
+async function main() {
+	await buildServer().connect(new StdioServerTransport());
+}
+main().catch((e) => {
+	console.error("[bfi-db-mcp] 启动失败:", e);
+	process.exit(1);
+});
+export {};

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "bfi-cli",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "description": "用友大业财BFI统一命令行工具，支持技能，技能包，元数据，UI元数据等",
   "type": "module",
   "bin": {
-    "bfi": "./bin/bfi.js"
+    "bfi": "./bin/bfi.js",
+    "bfi-db-mcp": "./bin/bfi-db-mcp.js"
   },
   "files": [
     "dist",
@@ -46,7 +47,10 @@
     "node": ">=18"
   },
   "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.0",
     "@vercel/detect-agent": "^1.2.3",
-    "yaml": "^2.8.3"
+    "mysql2": "^3.14.0",
+    "yaml": "^2.8.3",
+    "zod": "^3.25.0"
   }
 }