ccem 2.25.0 → 2.27.0

package/dist/index.js

@@ -400,24 +400,57 @@ import crypto from "crypto";
 import fs from "fs";
 import os from "os";
 import path from "path";
-var ALGORITHM = "aes-256-cbc";
-var SECRET_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var LEGACY_ALGORITHM = "aes-256-cbc";
+var LEGACY_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var V2_ALGORITHM = "aes-256-gcm";
+var _installKey = null;
+function getOrCreateInstallKey() {
+  if (_installKey) return _installKey;
+  const keyPath = path.join(getCcemConfigDir(), ".install-key");
+  if (fs.existsSync(keyPath)) {
+    _installKey = Buffer.from(fs.readFileSync(keyPath, "utf-8").trim(), "hex");
+    return _installKey;
+  }
+  ensureCcemDir();
+  _installKey = crypto.randomBytes(32);
+  fs.writeFileSync(keyPath, _installKey.toString("hex"), { mode: 384 });
+  return _installKey;
+}
 var encrypt = (text) => {
   if (!text) return text;
-  const iv = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv(ALGORITHM, SECRET_KEY, iv);
+  const key = getOrCreateInstallKey();
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv(V2_ALGORITHM, key, nonce);
   let encrypted = cipher.update(text, "utf8", "hex");
   encrypted += cipher.final("hex");
-  return `enc:${iv.toString("hex")}:${encrypted}`;
+  const tag = cipher.getAuthTag();
+  return `enc:v2:${nonce.toString("hex")}:${encrypted}:${tag.toString("hex")}`;
 };
 var decrypt = (text) => {
   if (!text || !text.startsWith("enc:")) return text;
+  if (text.startsWith("enc:v2:")) {
+    const parts = text.split(":");
+    if (parts.length !== 5) return text;
+    try {
+      const key = getOrCreateInstallKey();
+      const nonce = Buffer.from(parts[2], "hex");
+      const ciphertext = parts[3];
+      const tag = Buffer.from(parts[4], "hex");
+      const decipher = crypto.createDecipheriv(V2_ALGORITHM, key, nonce);
+      decipher.setAuthTag(tag);
+      let decrypted = decipher.update(ciphertext, "hex", "utf8");
+      decrypted += decipher.final("utf8");
+      return decrypted;
+    } catch {
+      throw new Error("Failed to decrypt enc:v2: data (tampered or wrong install key)");
+    }
+  }
   try {
     const parts = text.split(":");
     if (parts.length !== 3) return text;
     const iv = Buffer.from(parts[1], "hex");
     const encryptedText = parts[2];
-    const decipher = crypto.createDecipheriv(ALGORITHM, SECRET_KEY, iv);
+    const decipher = crypto.createDecipheriv(LEGACY_ALGORITHM, LEGACY_KEY, iv);
     let decrypted = decipher.update(encryptedText, "hex", "utf8");
     decrypted += decipher.final("utf8");
     return decrypted;
@@ -1396,7 +1429,7 @@ import crypto2 from "crypto";
 import fs3 from "fs";
 import os3 from "os";
 import path3 from "path";
-var SECRET_KEY2 = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var SECRET_KEY = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
 var findProjectRoot = () => {
   let currentDir = process.cwd();
   const root = path3.parse(currentDir).root;
@@ -1466,7 +1499,7 @@ function startCliClaudeProvenanceTracking(options) {
   if (!workingDir) {
     return null;
   }
-  const ccemSessionId = `cli-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+  const ccemSessionId = normalizeText(options.ccemSessionId) ?? `cli-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   try {
     registerLaunch({
       ccemSessionId,
@@ -1826,6 +1859,7 @@ function ensureSessionsDir() {
 }
 async function launchClaude(options) {
   const { envName, envConfig, permMode, workingDir, sessionId, resumeSessionId, silent } = options;
+  const ccemRuntimeId = sessionId ?? `cli-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
   const env = { ...process.env };
   for (const key of MANAGED_CLAUDE_ENV_KEYS) {
     delete env[key];
@@ -1834,6 +1868,8 @@ async function launchClaude(options) {
     Object.assign(env, buildEnvVars(envConfig));
   }
   delete env.CLAUDECODE;
+  env.CCEM_RUNTIME_ID = ccemRuntimeId;
+  env.CCEM_SESSION_ID = ccemRuntimeId;
   const args = [];
   if (permMode) {
     const preset = PERMISSION_PRESETS[permMode];
@@ -1870,6 +1906,7 @@ async function launchClaude(options) {
         return;
       }
       provenanceTracking = startCliClaudeProvenanceTracking({
+        ccemSessionId: ccemRuntimeId,
         envName: envName ?? "unknown",
         workingDir: effectiveWorkingDir,
         permMode,
@@ -2687,13 +2724,17 @@ var getUniqueName = (baseName, existingNames) => {
   }
   return newName;
 };
-var loadFromRemote = async (url, secret) => {
+var loadFromRemote = async (url, key, secret) => {
   console.log(chalk6.gray("Fetching from remote..."));
+  const headerKey = key || secret;
+  if (!key) {
+    console.log(chalk6.yellow("Warning: --key not provided; using --secret for authentication (deprecated). Use --key <access-key> --secret <encryption-secret>."));
+  }
   let response;
   try {
     response = await fetch(url, {
       headers: {
-        "X-CCEM-Key": secret
+        "X-CCEM-Key": headerKey
       }
     });
   } catch (err) {
@@ -2769,6 +2810,66 @@ Loaded ${results.length} environment(s) from remote:`));
   return results;
 };
 
+// src/bot-bind-skill.ts
+var CCEM_BOT_BIND_SKILL_CONTENT = `# ccem-bot-bind
+
+Bind the current CCEM-launched Claude Code session to a bot target such as WeCom or Weixin.
+
+Use this skill when the user asks to bind, attach, connect, or push the current task/session to a bot, chat, WeCom, Weixin, Telegram, or a remote task card.
+
+## What this skill does
+
+- Creates a bot-binding request for the current CCEM runtime.
+- Relies on \`CCEM_RUNTIME_ID\` or \`CCEM_SESSION_ID\`, which CCEM injects into sessions it launches.
+- Writes the request to \`~/.ccem/bot-bind-requests.jsonl\`.
+- CCEM Desktop consumes the request and binds the matching session to the bot outbox.
+
+## Required inputs
+
+Ask for any missing target information:
+
+- \`platform\`: one of \`wecom\`, \`weixin\`, or \`telegram\`.
+- \`peer_id\`: user id, chat id, group id, or equivalent target id.
+- For WeCom, include \`bot_id\` when known.
+
+## Command
+
+Run:
+
+\`\`\`bash
+ccem bot-bind --platform <platform> --peer-id <peer_id> --title "<short task title>" --summary "<one sentence summary>"
+\`\`\`
+
+For WeCom:
+
+\`\`\`bash
+ccem bot-bind --platform wecom --bot-id <bot_id> --peer-id <userid_or_chatid> --title "<short task title>" --summary "<one sentence summary>"
+\`\`\`
+
+If the user only wants to create the binding without pushing a task card, add \`--no-send-card\`.
+
+If CCEM did not inject a runtime id, ask the user for the runtime id or list sessions with:
+
+\`\`\`bash
+ccem sessions
+\`\`\`
+
+Then pass:
+
+\`\`\`bash
+ccem bot-bind --runtime-id <runtime_id> --platform <platform> --peer-id <peer_id>
+\`\`\`
+
+## Behavior rules
+
+- Do not invent peer ids or bot ids.
+- Keep the title short enough for a task card.
+- Include a summary that explains what this session is currently doing.
+- After the command succeeds, tell the user the request was queued and CCEM Desktop will consume it when running.
+- Do not ask the bot target to execute shell commands; user commands should flow back through the CCEM binding.
+- For WeCom, authorization and target membership are owned by the configured WeCom bot; do not create a separate allowlist.
+`;
+
 // src/cron-skill.ts
 var CCEM_CRON_SKILL_CONTENT = `# ccem-cron
 
@@ -2939,6 +3040,27 @@ function parseStringList(value) {
   }
   return trimmed.split(",").map((item) => item.trim()).filter(Boolean);
 }
+function normalizeWecomNotification(value) {
+  if (!value) {
+    return null;
+  }
+  return {
+    botId: value.botId?.trim() || null,
+    peerId: value.peerId?.trim() || null,
+    enabled: value.enabled ?? true
+  };
+}
+function parseWecomNotification(value) {
+  if (typeof value !== "object" || value === null) {
+    return null;
+  }
+  const record = value;
+  return {
+    botId: typeof record.botId === "string" ? record.botId : typeof record.bot_id === "string" ? record.bot_id : null,
+    peerId: typeof record.peerId === "string" ? record.peerId : typeof record.peer_id === "string" ? record.peer_id : null,
+    enabled: typeof record.enabled === "boolean" ? record.enabled : true
+  };
+}
 function createCronTask(input, tasksPath = getCronTasksPath()) {
   const name = input.name?.trim();
   if (!name) {
@@ -2976,6 +3098,7 @@ function createCronTask(input, tasksPath = getCronTasksPath()) {
     enabled: input.enabled ?? true,
     timeoutSecs,
     templateId: input.templateId?.trim() || null,
+    wecomNotification: normalizeWecomNotification(input.wecomNotification),
     triggerType: "schedule",
     parentTaskId: null,
     createdAt: now,
@@ -3014,6 +3137,7 @@ function resolveJsonInput(raw) {
 }
 function parseCronCreateJson(raw) {
   const parsed = JSON.parse(resolveJsonInput(raw));
+  const wecomNotification = parsed.wecomNotification ?? parsed.wecom_notification;
   return {
     name: String(parsed.name ?? ""),
     cronExpression: String(parsed.cronExpression ?? parsed.schedule ?? ""),
@@ -3026,7 +3150,8 @@ function parseCronCreateJson(raw) {
     disallowedTools: Array.isArray(parsed.disallowedTools) ? parsed.disallowedTools.map(String) : null,
     enabled: typeof parsed.enabled === "boolean" ? parsed.enabled : null,
     timeoutSecs: typeof parsed.timeoutSecs === "number" ? parsed.timeoutSecs : null,
-    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null
+    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null,
+    wecomNotification: parseWecomNotification(wecomNotification)
   };
 }
 function formatCronTaskTableRows(tasks) {
@@ -3308,6 +3433,7 @@ var switchEnvironment = async (name) => {
 };
 var getSessionsFilePath = () => path8.join(getCcemConfigDir(), "sessions.json");
 var getRuntimeStateFilePath = () => path8.join(getCcemConfigDir(), "runtime-state.json");
+var getBotBindRequestFilePath = () => path8.join(getCcemConfigDir(), "bot-bind-requests.jsonl");
 var parseJsonFile = (filePath) => {
   if (!fs10.existsSync(filePath)) {
     return null;
@@ -3387,6 +3513,29 @@ var attachTmuxTarget = (target) => {
     });
   });
 };
+var normalizeBotBindPlatform = (value) => {
+  const normalized = value.trim().toLowerCase();
+  return normalized === "telegram" || normalized === "weixin" || normalized === "wecom" ? normalized : null;
+};
+var resolveBotBindRuntimeId = (explicitRuntimeId) => {
+  const explicit = explicitRuntimeId?.trim();
+  if (explicit) {
+    return explicit;
+  }
+  const fromEnv = process.env.CCEM_RUNTIME_ID?.trim() || process.env.CCEM_SESSION_ID?.trim();
+  if (fromEnv) {
+    return fromEnv;
+  }
+  const sessions = readInteractiveAttachSessions();
+  return sessions.length === 1 ? sessions[0].id : null;
+};
+var appendBotBindRequest = (payload) => {
+  const requestPath = getBotBindRequestFilePath();
+  fs10.mkdirSync(path8.dirname(requestPath), { recursive: true });
+  fs10.appendFileSync(requestPath, `${JSON.stringify(payload)}
+`, "utf-8");
+  return requestPath;
+};
 program.command("ls").description("List all configured environments").action(() => {
   const registries = getRegistries();
   const current = config2.get("current");
@@ -3442,6 +3591,57 @@ program.command("attach [id]").description("Attach to a tmux-backed interactive
     process.exit(1);
   }
 });
+program.command("bot-bind").description("Request binding the current ccem session to a chat bot target").requiredOption("--platform <platform>", "target platform: telegram, weixin, or wecom").option("--peer-id <peerId>", "target user/chat id").option("--peer <peerId>", "alias for --peer-id").option("--runtime-id <runtimeId>", "ccem runtime id; defaults to CCEM_RUNTIME_ID").option("--bot-id <botId>", "WeCom bot id or platform bot id").option("--thread-id <threadId>", "thread/topic id for platforms that support it").option("--title <title>", "task card title").option("--summary <summary>", "task card summary").option("--no-send-card", "bind without sending the initial task card").option("--json", "print the queued request as JSON").action((options) => {
+  const platform = normalizeBotBindPlatform(options.platform);
+  if (!platform) {
+    console.error(chalk7.red("\u2717 --platform must be telegram, weixin, or wecom"));
+    process.exitCode = 1;
+    return;
+  }
+  const peerId = (options.peerId ?? options.peer ?? "").trim();
+  if (!peerId) {
+    console.error(chalk7.red("\u2717 --peer-id is required"));
+    process.exitCode = 1;
+    return;
+  }
+  const runtimeId = resolveBotBindRuntimeId(options.runtimeId);
+  if (!runtimeId) {
+    console.error(chalk7.red("\u2717 Unable to resolve ccem runtime id"));
+    console.error(chalk7.gray("  Run from a ccem-launched session or pass --runtime-id explicitly."));
+    process.exitCode = 1;
+    return;
+  }
+  const botId = options.botId?.trim() || void 0;
+  if (platform === "wecom" && !botId) {
+    console.error(chalk7.red("\u2717 --bot-id is required for WeCom bot bindings"));
+    process.exitCode = 1;
+    return;
+  }
+  const payload = {
+    request_id: `botbind-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+    runtime_id: runtimeId,
+    platform,
+    peer_id: peerId,
+    bot_id: botId,
+    thread_id: options.threadId?.trim() || void 0,
+    task_title: options.title?.trim() || void 0,
+    task_summary: options.summary?.trim() || void 0,
+    send_task_card: options.sendCard !== false,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const requestPath = appendBotBindRequest(payload);
+  if (options.json) {
+    console.log(JSON.stringify({ requestPath, payload }, null, 2));
+    return;
+  }
+  console.log(chalk7.green("\u2713 \u5DF2\u63D0\u4EA4 bot \u7ED1\u5B9A\u8BF7\u6C42"));
+  console.log(chalk7.gray(`  runtime: ${runtimeId}`));
+  console.log(chalk7.gray(`  target: ${platform}/${peerId}`));
+  console.log(chalk7.gray(`  queue: ${requestPath}`));
+  console.log(chalk7.cyan(
+    options.sendCard === false ? "  \u5982\u679C CCEM Desktop \u6B63\u5728\u8FD0\u884C\uFF0C\u4F1A\u81EA\u52A8\u6D88\u8D39\u8BE5\u8BF7\u6C42\u5E76\u5EFA\u7ACB\u7ED1\u5B9A\u3002" : "  \u5982\u679C CCEM Desktop \u6B63\u5728\u8FD0\u884C\uFF0C\u4F1A\u81EA\u52A8\u6D88\u8D39\u8BE5\u8BF7\u6C42\u5E76\u53D1\u9001\u4EFB\u52A1\u5361\u7247\u5230\u7ED1\u5B9A\u76EE\u6807\u3002"
+  ));
+});
 program.command("add <name>").description("Add a new environment configuration").action(async (name) => {
   const registries = getRegistries();
   if (registries[name]) {
@@ -3606,7 +3806,7 @@ cronCmd.command("list").description("List CCEM cron tasks").option("--json", "Ou
     process.exitCode = 1;
   }
 });
-cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
+cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--wecom-result", "Send cron result summary to the configured WeCom default target").option("--wecom-bot-id <id>", "WeCom bot id for cron result notifications").option("--wecom-peer-id <id>", "WeCom peer id for cron result notifications").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
   try {
     const input = options.fromJson ? parseCronCreateJson(options.fromJson) : {
       name: options.name,
@@ -3620,7 +3820,12 @@ cronCmd.command("create").description("Create a CCEM cron task").option("--from-
       disallowedTools: parseStringList(options.disallowedTools),
       enabled: options.disabled ? false : true,
       timeoutSecs: options.timeoutSecs === void 0 ? null : Number(options.timeoutSecs),
-      templateId: options.templateId
+      templateId: options.templateId,
+      wecomNotification: options.wecomResult || options.wecomBotId || options.wecomPeerId ? {
+        botId: options.wecomBotId ?? null,
+        peerId: options.wecomPeerId ?? null,
+        enabled: true
+      } : null
     };
     const task = createCronTask(input);
     if (options.json) {
@@ -3760,6 +3965,34 @@ setupCmd.command("cron").description("\u5B89\u88C5 ccem-cron skill \u5230 Claude
   console.log(chalk7.cyan(`
 \u5728 Claude Code \u4E2D\u4F7F\u7528 /ccem-cron \u5373\u53EF\u8C03\u7528\u6B64 skill`));
 });
+setupCmd.command("bot-bind").description("\u5B89\u88C5 ccem-bot-bind skill \u5230 Claude Code\uFF08~/.claude/skills/\uFF09").option("--force", "\u5F3A\u5236\u8986\u76D6\u5DF2\u6709\u6587\u4EF6").action(async function() {
+  const options = this.opts();
+  const skillDir = path8.join(getHomeDir(), ".claude", "skills");
+  const targetPath = path8.join(skillDir, "ccem-bot-bind.md");
+  if (!fs10.existsSync(skillDir)) {
+    fs10.mkdirSync(skillDir, { recursive: true });
+    console.log(chalk7.gray(`\u521B\u5EFA\u76EE\u5F55: ${skillDir}`));
+  }
+  if (fs10.existsSync(targetPath) && !options.force) {
+    const { overwrite } = await inquirer.prompt([
+      {
+        type: "confirm",
+        name: "overwrite",
+        message: `${targetPath} \u5DF2\u5B58\u5728\uFF0C\u662F\u5426\u8986\u76D6\uFF1F`,
+        default: false
+      }
+    ]);
+    if (!overwrite) {
+      console.log(chalk7.yellow("\u5DF2\u53D6\u6D88"));
+      return;
+    }
+  }
+  fs10.writeFileSync(targetPath, CCEM_BOT_BIND_SKILL_CONTENT, "utf-8");
+  console.log(chalk7.green(`\u2713 \u5DF2\u5B89\u88C5 ccem-bot-bind skill`));
+  console.log(chalk7.gray(`  \u8DEF\u5F84: ${targetPath}`));
+  console.log(chalk7.cyan(`
+\u5728 Claude Code \u4E2D\u8BA9\u5B83\u4F7F\u7528 ccem-bot-bind skill \u5373\u53EF\u7ED1\u5B9A\u5F53\u524D\u4F1A\u8BDD\u5230 bot`));
+});
 var skillCmd = program.command("skill").description("\u7BA1\u7406 Claude Code skills");
 skillCmd.command("add [url]").description("\u6DFB\u52A0 skill\uFF08\u4ECE\u5B98\u65B9\u9884\u8BBE\u6216 GitHub URL\uFF09").action(async (url) => {
   if (url) {
@@ -3810,8 +4043,8 @@ skillCmd.command("ls").description("\u5217\u51FA\u5DF2\u5B89\u88C5\u7684 skills"
 skillCmd.command("rm <name>").description("\u5220\u9664\u5DF2\u5B89\u88C5\u7684 skill").action((name) => {
   removeSkill(name);
 });
-program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
-  const results = await loadFromRemote(url, options.secret);
+program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5\uFF08encryption secret\uFF09").option("--key <key>", "\u8BBF\u95EE\u5BC6\u94A5\uFF08access key\uFF0C\u7528\u4E8E\u8BA4\u8BC1\uFF1B\u4E0D\u586B\u5219\u56DE\u9000\u7528 --secret \u8BA4\u8BC1\uFF09").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
+  const results = await loadFromRemote(url, options.key ?? "", options.secret);
   if (options.json) {
     console.log(JSON.stringify({
       count: results.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.25.0",
+  "version": "2.27.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {