buckyos 0.7.114 → 0.7.116

package/README.md

@@ -17,6 +17,14 @@ npx buckyos app status example
 npx buckyos log tail --app example
 ```
 
+当命令需要读取项目目录和 Tool 包目录之外的源码时，通过可重复的全局参数显式授权：
+
+```bash
+npx buckyos --allow-read ../shared-assets --allow-read /opt/app-source pikg build ./dapp_meta
+```
+
+`--allow-read` 只增加读权限，不会增加写权限。
+
 `npx buckyos` 和 npm scripts 中的 `buckyos` 固定使用项目 lockfile 对应的 Tool。PATH 中裸 `buckyos`
 由 BuckyOS 系统安装器管理并指向 `$BUCKYOS_ROOT/bin/buckyos`；文档不推荐全局
 `npm install -g buckyos`。两种分发运行同一套命令实现，互不覆盖、互不调用、也不会自更新。

package/cli/core/app.ts

@@ -487,6 +487,7 @@ function topLevelHelp(registry: CommandRegistry): string {
     '',
     'Global options:',
     '  --config-dir <path>  --profile <name>  --zone <host-or-did>',
+    '  --allow-read <path>  Add a readable filesystem root (repeatable)',
     '  --endpoint <url>      --identity <did-or-name>',
     '  --session-token <token> | --session-token-file <path>',
     '    Prefer --session-token-file for automation; argv tokens may appear in process listings.',

package/cli/core/argv.ts

@@ -7,6 +7,7 @@ export type OutputFormat = typeof OUTPUT_FORMATS[number]
 
 export interface GlobalOptions {
   configDir?: string
+  allowRead?: string[]
   profile?: string
   zone?: string
   endpoint?: string
@@ -60,6 +61,10 @@ const STRING_GLOBALS = new Map<string, keyof GlobalOptions>([
   ['idempotency-key', 'idempotencyKey'],
 ])
 
+const REPEATABLE_STRING_GLOBALS = new Map<string, keyof GlobalOptions>([
+  ['allow-read', 'allowRead'],
+])
+
 const BOOLEAN_GLOBALS = new Map<string, keyof GlobalOptions>([
   ['cli', 'cli'],
   ['wait', 'wait'],
@@ -106,11 +111,16 @@ export function parseInvocation(argv: string[]): Invocation {
       continue
     }
     const stringProperty = STRING_GLOBALS.get(parsed.name)
-    if (!stringProperty) {
+    const repeatableStringProperty = REPEATABLE_STRING_GLOBALS.get(parsed.name)
+    if (!stringProperty && !repeatableStringProperty) {
       throw new UsageError('UNKNOWN_OPTION', `unknown global option: --${parsed.name}`)
     }
     const { value, consumed } = readOptionValue(argv, index, parsed)
-    setGlobal(global, stringProperty, normalizeGlobalValue(parsed.name, value))
+    if (repeatableStringProperty === 'allowRead') {
+      global.allowRead = [...(global.allowRead ?? []), value]
+    } else {
+      setGlobal(global, stringProperty!, normalizeGlobalValue(parsed.name, value))
+    }
     index += consumed
   }
 
@@ -183,7 +193,8 @@ export function parseCommandArgs(
     }
     if (
       allowReplScopedGlobals &&
-      (STRING_GLOBALS.has(parsed.name) || BOOLEAN_GLOBALS.has(parsed.name))
+      (STRING_GLOBALS.has(parsed.name) || REPEATABLE_STRING_GLOBALS.has(parsed.name) ||
+        BOOLEAN_GLOBALS.has(parsed.name))
     ) {
       throw new UsageError(
         'SESSION_OPTION_FROZEN',

package/cli/core/registry.ts

@@ -6,6 +6,13 @@ const KEBAB_CASE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/
 
 const GLOBAL_OPTIONS = [
   { name: 'config-dir', property: 'configDir', type: 'string', scope: 'process' },
+  {
+    name: 'allow-read',
+    property: 'allowRead',
+    type: 'string',
+    scope: 'process',
+    repeatable: true,
+  },
   { name: 'profile', property: 'profile', type: 'string', scope: 'session' },
   { name: 'zone', property: 'zone', type: 'string', scope: 'session' },
   { name: 'endpoint', property: 'endpoint', type: 'string', scope: 'session' },

package/cli/dist/cli.mjs

@@ -104,6 +104,9 @@ const STRING_GLOBALS = /* @__PURE__ */ new Map([
   ["trace-id", "traceId"],
   ["idempotency-key", "idempotencyKey"]
 ]);
+const REPEATABLE_STRING_GLOBALS = /* @__PURE__ */ new Map([
+  ["allow-read", "allowRead"]
+]);
 const BOOLEAN_GLOBALS = /* @__PURE__ */ new Map([
   ["cli", "cli"],
   ["wait", "wait"],
@@ -149,11 +152,16 @@ function parseInvocation(argv) {
       continue;
     }
     const stringProperty = STRING_GLOBALS.get(parsed.name);
-    if (!stringProperty) {
+    const repeatableStringProperty = REPEATABLE_STRING_GLOBALS.get(parsed.name);
+    if (!stringProperty && !repeatableStringProperty) {
       throw new UsageError("UNKNOWN_OPTION", `unknown global option: --${parsed.name}`);
     }
     const { value, consumed } = readOptionValue(argv, index, parsed);
-    setGlobal(global, stringProperty, normalizeGlobalValue(parsed.name, value));
+    if (repeatableStringProperty === "allowRead") {
+      global.allowRead = [...global.allowRead ?? [], value];
+    } else {
+      setGlobal(global, stringProperty, normalizeGlobalValue(parsed.name, value));
+    }
     index += consumed;
   }
   const module = argv[index];
@@ -214,7 +222,7 @@ function parseCommandArgs(command, argv, inputObject, allowReplScopedGlobals = f
       index += consumed2;
       continue;
     }
-    if (allowReplScopedGlobals && (STRING_GLOBALS.has(parsed.name) || BOOLEAN_GLOBALS.has(parsed.name))) {
+    if (allowReplScopedGlobals && (STRING_GLOBALS.has(parsed.name) || REPEATABLE_STRING_GLOBALS.has(parsed.name) || BOOLEAN_GLOBALS.has(parsed.name))) {
       throw new UsageError(
         "SESSION_OPTION_FROZEN",
         `--${parsed.name} is frozen for the interactive session`
@@ -593,6 +601,8 @@ function collectArgumentPaths(argv) {
       if (name === "config-dir") {
         read.push(value);
         write.push(value);
+      } else if (name === "allow-read") {
+        read.push(value);
       } else if (["input", "session-token-file", "identity-root", "security-root", "pikg"].includes(name)) {
         if (value !== "-")
           read.push(value);
@@ -1984,6 +1994,13 @@ function displayValue(value) {
 const KEBAB_CASE = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const GLOBAL_OPTIONS = [
   { name: "config-dir", property: "configDir", type: "string", scope: "process" },
+  {
+    name: "allow-read",
+    property: "allowRead",
+    type: "string",
+    scope: "process",
+    repeatable: true
+  },
   { name: "profile", property: "profile", type: "string", scope: "session" },
   { name: "zone", property: "zone", type: "string", scope: "session" },
   { name: "endpoint", property: "endpoint", type: "string", scope: "session" },
@@ -4741,7 +4758,7 @@ function invalid(stage, message, entry) {
 function stableJsonDigest(value) {
   return sha256Bytes(new TextEncoder().encode(ndn.toCanonicalJsonString(value)));
 }
-const PACKAGE_VERSION = "0.7.114";
+const PACKAGE_VERSION = "0.7.116";
 const TOOL_VERSION = PACKAGE_VERSION;
 const SDK_VERSION = PACKAGE_VERSION;
 const PROTOCOL_VERSION = "1";
@@ -8795,6 +8812,7 @@ function topLevelHelp(registry) {
     "",
     "Global options:",
     "  --config-dir <path>  --profile <name>  --zone <host-or-did>",
+    "  --allow-read <path>  Add a readable filesystem root (repeatable)",
     "  --endpoint <url>      --identity <did-or-name>",
     "  --session-token <token> | --session-token-file <path>",
     "    Prefer --session-token-file for automation; argv tokens may appear in process listings.",