digitalsee-ai-flow-cli 0.7.6 → 0.7.23-beta.1

package/README.md

@@ -98,7 +98,7 @@ ai-flow auth status --json
 
 `--json` 输出示例：
 ```json
-{ "ok": true, "loggedIn": true, "activeProfile": "dev", "token": "abcd****1234", "baseUrl": "https://dev.example.com" }
+{ "ok": true, "data": { "loggedIn": true, "activeProfile": "dev", "token": "abcd****1234", "baseUrl": "https://dev.example.com" } }
 ```
 
 ### auth logout
@@ -1284,6 +1284,57 @@ ai-flow sync status --id <connectorId> --json
 
 ---
 
+## 运维日志
+
+查询和实时跟踪运维服务日志。
+
+### service-log search
+
+查询历史运维日志，按时间范围、级别、关键词等条件筛选。
+
+```bash
+ai-flow service-log search --time-range 1h
+ai-flow service-log search --time-range 3h --level ERROR
+ai-flow service-log search --time-range 7d --keyword "timeout" --service-type iam
+ai-flow service-log search --start-time "2026-07-01 00:00:00" --end-time "2026-07-20 23:59:59"
+ai-flow service-log search --time-range 24h --limit 100 --json
+```
+
+| 选项 | 必填 | 默认值 | 说明 |
+|------|------|--------|------|
+| `--time-range` | 二选一 | — | 相对时间范围，格式: `<N>s\|m\|h\|d`（如 `30s`, `15m`, `3h`, `7d`），与 `--start-time` 互斥 |
+| `--start-time` | 二选一 | — | 开始时间 `yyyy-MM-dd HH:mm:ss`，与 `--time-range` 互斥 |
+| `--end-time` | 否 | 请求时刻 | 结束时间 `yyyy-MM-dd HH:mm:ss` |
+| `--limit` | 否 | `50` | 最大返回条数（上限 500） |
+| `--level` | 否 | — | 日志级别：`INFO` / `WARN` / `ERROR` |
+| `--request-id` | 否 | — | 链路 trace id（精确匹配） |
+| `--keyword` | 否 | — | 日志正文关键词 |
+| `--service-type` | 否 | — | 服务类型：`iam` / `acm` / `ncm` / `adm` / `mdm` / `nginx` 等 |
+| `--json` | 否 | — | 以 JSON 格式输出 `{ ok, data, total }` |
+
+### service-log stream
+
+通过 WebSocket 实时跟随运维日志，按 `Ctrl+C` 退出。连接前自动校验 token 可用性。
+
+```bash
+ai-flow service-log stream
+ai-flow service-log stream --level ERROR --service-type iam
+ai-flow service-log stream --keyword "exception" --max 100
+ai-flow service-log stream --json   # NDJSON 输出（每行一条 { ok, data }）
+```
+
+| 选项 | 必填 | 默认值 | 说明 |
+|------|------|--------|------|
+| `--level` | 否 | — | 日志级别：`INFO` / `WARN` / `ERROR` |
+| `--request-id` | 否 | — | 链路 trace id（精确匹配） |
+| `--keyword` | 否 | — | 日志正文关键词 |
+| `--service-type` | 否 | — | 服务类型：`iam` / `acm` / `ncm` / `adm` / `mdm` / `nginx` 等 |
+| `--limit` | 否 | `20` | 单次 ES 拉取批量 |
+| `--max` | 否 | — | 收到 N 条后自动退出（默认不限） |
+| `--json` | 否 | — | NDJSON 输出，每行一条 `{ ok, data }` |
+
+---
+
 ## 知识库
 
 ### knowledge categories
@@ -1563,6 +1614,7 @@ src/
 │   │   ├── cancel-sync.ts
 │   │   └── status.ts
 │   ├── org.ts            # ai-flow org（组织架构）
+│   ├── service-log.ts    # ai-flow service-log（运维日志）
 │   └── knowledge.ts      # ai-flow knowledge
 ├── api/
 │   ├── client.ts         # axios 实例（SSL、Token）
@@ -1574,6 +1626,7 @@ src/
 │   ├── link.ts           # 上游连接器 API
 │   ├── mapping.ts        # 属性映射 API
 │   ├── sync.ts           # 下游连接器 API
+│   ├── service-log.ts    # 运维日志 API（search + stream）
 │   └── org.ts            # 组织架构 API
 ├── services/
 │   ├── flowAnalyzer.ts   # DAG 拓扑分析

package/dist/api/client.js

@@ -14,6 +14,7 @@ exports.apiDelete = apiDelete;
 const https_1 = __importDefault(require("https"));
 const axios_1 = __importDefault(require("axios"));
 const config_1 = require("@/utils/config");
+const refresh_1 = require("@/api/refresh");
 let clientInstance = null;
 function classifyError(error) {
     if (error && typeof error === 'object') {
@@ -116,10 +117,19 @@ function buildClient() {
         },
         timeout: 30000,
     });
-    instance.interceptors.request.use((reqConfig) => {
+    instance.interceptors.request.use(async (reqConfig) => {
         const cfg = (0, config_1.loadConfig)();
-        if (cfg.token) {
-            reqConfig.headers.Authorization = `Bearer ${cfg.token}`;
+        if (cfg.auth?.access_token) {
+            // 临近过期时主动刷新，避免发送已知过期的 token
+            if ((0, refresh_1.isTokenExpired)() && cfg.auth.refresh_token) {
+                const newAuth = await (0, refresh_1.attemptTokenRefresh)();
+                if (newAuth) {
+                    reqConfig.headers.Authorization = `${newAuth.token_type ?? 'Bearer'} ${newAuth.access_token}`;
+                    return reqConfig;
+                }
+                // 刷新失败不阻塞，继续用当前 token，401 interceptor 会再尝试
+            }
+            reqConfig.headers.Authorization = `${cfg.auth.token_type ?? 'Bearer'} ${cfg.auth.access_token}`;
         }
         return reqConfig;
     });
@@ -127,9 +137,29 @@ function buildClient() {
         const body = response.data;
         if (body && typeof body === 'object' && 'data' in body) {
             response.data = body.data;
+            //钉钉网关可能会触发 code: -1, Access Denied
+            if (body.data === null && body.code === '-1') {
+                throw new Error(humanizeError(body.message ?? body));
+            }
         }
         return response;
-    }, (error) => {
+    }, async (error) => {
+        const errObj = error;
+        const originalRequest = errObj.config;
+        if (errObj.response?.status === 401 &&
+            originalRequest &&
+            !originalRequest._retry) {
+            const cfg = (0, config_1.loadConfig)();
+            if (cfg.auth?.refresh_token) {
+                originalRequest._retry = true;
+                const newAuth = await (0, refresh_1.attemptTokenRefresh)();
+                if (newAuth) {
+                    originalRequest.headers = originalRequest.headers || {};
+                    originalRequest.headers.Authorization = `${newAuth.token_type ?? 'Bearer'} ${newAuth.access_token}`;
+                    return instance.request(originalRequest);
+                }
+            }
+        }
         throw new Error(humanizeError(error));
     });
     return instance;

package/dist/api/refresh.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attemptTokenRefresh = attemptTokenRefresh;
+exports.isTokenExpired = isTokenExpired;
+const https_1 = __importDefault(require("https"));
+const axios_1 = __importDefault(require("axios"));
+const config_1 = require("@/utils/config");
+/**
+ * 并发控制：多个 401 同时到达时，只发一次 refresh 请求，
+ * 其他调用复用同一个 Promise。
+ */
+let isRefreshing = false;
+let pendingRefresh = null;
+const EXPIRY_BUFFER_MS = 120000; // 提前 120 秒刷新，避免临界区过期
+/**
+ * 使用 refresh_token 向 /iam/token 获取新 access_token，
+ * 成功后自动写入 global config 并返回新的 AuthConfig。
+ * 无 refresh_token 或刷新失败返回 null。
+ */
+async function attemptTokenRefresh() {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.refresh_token) {
+        return null;
+    }
+    // 去重：如果已有正在进行的刷新，复用同一个 Promise
+    if (isRefreshing && pendingRefresh) {
+        return pendingRefresh;
+    }
+    isRefreshing = true;
+    pendingRefresh = (async () => {
+        try {
+            const httpsAgent = new https_1.default.Agent({ rejectUnauthorized: !cfg.insecure });
+            const res = await axios_1.default.post(`${cfg.baseUrl}/iam/token`, {
+                grant_type: 'refresh_token',
+                client_id: 'usercenter',
+                refresh_token: cfg.auth.refresh_token,
+            }, {
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                httpsAgent,
+                timeout: 15000,
+                // 不使用 getClient()，避免触发 request/response 拦截器
+            });
+            const { access_token, refresh_token: newRt, token_type, expires_in } = res.data;
+            const newAuth = {
+                access_token,
+                refresh_token: newRt || cfg.auth.refresh_token,
+                token_type: token_type || cfg.auth.token_type || 'Bearer',
+                // 使用客户端本地时间计算过期时刻，服务端不支持返回绝对过期时间
+                expires_at: Date.now() + (expires_in || 3600) * 1000,
+            };
+            (0, config_1.saveGlobalConfig)({ auth: newAuth });
+            return newAuth;
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : JSON.stringify(err);
+            process.stderr.write(`[refresh] token 刷新失败: ${detail}\n`);
+            return null;
+        }
+        finally {
+            isRefreshing = false;
+            pendingRefresh = null;
+        }
+    })();
+    return pendingRefresh;
+}
+/**
+ * 基于 config.auth.expires_at 判断 token 是否已（或即将）过期。
+ * 包含 120 秒缓冲，避免 token 在飞行期间过期。
+ * 无 expires_at 时默认返回 false（不阻塞，让 401 响应来驱动刷新）。
+ */
+function isTokenExpired() {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.expires_at) {
+        return false;
+    }
+    return Date.now() >= cfg.auth.expires_at - EXPIRY_BUFFER_MS;
+}
+//# sourceMappingURL=refresh.js.map

package/dist/api/service-log.js

@@ -0,0 +1,125 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyToken = verifyToken;
+exports.searchServiceLogs = searchServiceLogs;
+exports.openServiceLogStream = openServiceLogStream;
+const https_1 = __importDefault(require("https"));
+const axios_1 = __importDefault(require("axios"));
+const ws_1 = __importDefault(require("ws"));
+const config_1 = require("@/utils/config");
+const client_1 = require("@/api/client");
+const SEARCH_PATH = '/iam/api/service-log/search';
+const STREAM_PATH = '/iam/api/service-log/stream';
+/**
+ * 验证当前 token 是否可用（发起轻量 GET 请求）
+ * token 无效时抛出 axios interceptor 格式化的错误
+ */
+async function verifyToken() {
+    const client = (0, client_1.getClient)();
+    await client.get('/iam/api/connectors');
+}
+function buildHttpClient() {
+    const cfg = (0, config_1.loadConfig)();
+    return axios_1.default.create({
+        baseURL: cfg.baseUrl,
+        httpsAgent: new https_1.default.Agent({ rejectUnauthorized: !cfg.insecure }),
+        headers: {
+            'Content-Type': 'application/json',
+            Authorization: `${cfg.auth?.token_type ?? 'Bearer'} ${cfg.auth?.access_token}`,
+        },
+        timeout: 30000,
+    });
+}
+/**
+ * 本地校验 envelope：现有 client.ts 拦截器只解包 data、不检查 result 字段，
+ * 而文档 2.6 规定业务错误（如 "limit 不能超过 500"）以 HTTP 200 + result=false 返回，
+ * 因此本函数不复用 apiPost，独立 POST 并自行检查 envelope。
+ */
+async function searchServiceLogs(req) {
+    const client = buildHttpClient();
+    const response = await client.post(SEARCH_PATH, req);
+    const body = response.data;
+    if (Array.isArray(body)) {
+        return body;
+    }
+    if (body && typeof body === 'object' && 'result' in body) {
+        if (body.result === false) {
+            throw new Error(body.error_description || body.error || '日志查询失败');
+        }
+        return body.data ?? [];
+    }
+    return [];
+}
+function toWsUrl(baseUrl) {
+    const trimmed = baseUrl.replace(/\/+$/, '');
+    if (trimmed.startsWith('https://')) {
+        return `wss://${trimmed.slice(8)}${STREAM_PATH}`;
+    }
+    if (trimmed.startsWith('http://')) {
+        return `ws://${trimmed.slice(7)}${STREAM_PATH}`;
+    }
+    return `${trimmed}${STREAM_PATH}`;
+}
+function openServiceLogStream(filters, handlers) {
+    const cfg = (0, config_1.loadConfig)();
+    if (!cfg.auth?.access_token) {
+        throw new Error('未登录，请先执行 ai-flow auth login');
+    }
+    const url = toWsUrl(cfg.baseUrl);
+    const ws = new ws_1.default(url, {
+        headers: { Authorization: `${cfg.auth.token_type ?? 'Bearer'} ${cfg.auth.access_token}` },
+        rejectUnauthorized: !cfg.insecure,
+    });
+    let cancelled = false;
+    ws.on('open', () => {
+        const subscribeFrame = {
+            action: 'subscribe',
+            ...filters,
+        };
+        ws.send(JSON.stringify(subscribeFrame));
+        handlers.onOpen?.();
+    });
+    ws.on('message', (raw) => {
+        let msg;
+        try {
+            msg = JSON.parse(raw.toString());
+        }
+        catch {
+            return;
+        }
+        if (msg.type === 'log' && msg.data) {
+            handlers.onLog(msg.data);
+            return;
+        }
+        if (msg.type === 'error' && msg.message) {
+            handlers.onError(msg.message);
+        }
+    });
+    ws.on('close', (code, reasonBuf) => {
+        const reason = reasonBuf?.toString?.() ?? '';
+        handlers.onClose(code, reason);
+    });
+    ws.on('error', (err) => {
+        handlers.onError(err.message || 'WebSocket 连接错误');
+    });
+    return {
+        cancel() {
+            if (cancelled)
+                return;
+            cancelled = true;
+            if (ws.readyState === ws_1.default.OPEN) {
+                ws.send(JSON.stringify({ action: 'cancel' }));
+            }
+            try {
+                ws.close();
+            }
+            catch {
+                // ignore
+            }
+        },
+    };
+}
+//# sourceMappingURL=service-log.js.map

package/dist/commands/auth.js

@@ -29,14 +29,14 @@ function registerAuthCommand(program) {
             (0, output_1.printInfo)(`使用 Profile: ${(0, config_1.getActiveProfile)()}`);
             const protocol = options.https ? 'https' : 'http';
             (0, output_1.printInfo)(`正在准备 OAuth 登录 (${protocol.toUpperCase()})...`);
-            const { server, port, waitForCode } = options.https
+            const { server, port, waitForResult } = options.https
                 ? await (0, oauth_1.createAuthServerHttps)()
                 : await (0, oauth_1.createAuthServer)();
             const authorizeUrl = (0, oauth_1.buildAuthorizeUrl)(config.baseUrl, port, protocol);
             (0, output_1.printHeader)('OAuth 2 登录');
             (0, output_1.printInfo)('打开下方链接，授权登录');
             console.log(`\n${chalk_1.default.cyan(authorizeUrl)}\n`);
-            const codePromise = waitForCode();
+            const resultPromise = waitForResult();
             (0, output_1.printInfo)('等待授权回调...');
             rl = readline.createInterface({ input, output });
             rl.question('按 Enter 在浏览器中打开...\n', () => {
@@ -50,9 +50,17 @@ function registerAuthCommand(program) {
                     rl.close();
                 }
             });
-            const token = await codePromise;
+            const { access_token, refresh_token, id_token, token_type, expires_in } = await resultPromise;
+            // 使用客户端本地时间计算过期时刻，服务端不支持返回绝对过期时间
+            const expires_at = new Date().getTime() + expires_in * 1000;
             const saveData = {
-                token,
+                auth: {
+                    access_token,
+                    refresh_token,
+                    id_token,
+                    token_type,
+                    expires_at,
+                },
             };
             (0, config_1.saveGlobalConfig)(saveData);
             (0, output_1.printSuccess)('登录成功');
@@ -75,11 +83,20 @@ function registerAuthCommand(program) {
             if (options.json)
                 (0, output_1.setJsonMode)(true);
             const scope = options.project ? 'project' : 'global';
+            const defaultConfig = {
+                auth: {
+                    access_token: '',
+                    refresh_token: '',
+                    id_token: '',
+                    token_type: '',
+                    expires_at: 0,
+                },
+            };
             if (options.project) {
-                (0, config_1.saveProjectConfig)({ token: '' });
+                (0, config_1.saveProjectConfig)(defaultConfig);
             }
             else {
-                (0, config_1.saveGlobalConfig)({ token: '' });
+                (0, config_1.saveGlobalConfig)(defaultConfig);
             }
             if (options.json) {
                 (0, output_1.printStructuredResult)({ ok: true, scope, activeProfile: (0, config_1.getActiveProfile)() });
@@ -105,9 +122,12 @@ function registerAuthCommand(program) {
             if (options.json)
                 (0, output_1.setJsonMode)(true);
             const config = (0, config_1.loadConfig)();
-            if (!config.token) {
+            if (!config.auth || !config.auth.access_token) {
                 if (options.json) {
-                    (0, output_1.printStructuredResult)({ ok: true, loggedIn: false, activeProfile: (0, config_1.getActiveProfile)() });
+                    (0, output_1.printStructuredResult)({
+                        ok: true,
+                        data: { loggedIn: false, activeProfile: (0, config_1.getActiveProfile)() },
+                    });
                     return;
                 }
                 (0, output_1.printHeader)('认证状态');
@@ -116,18 +136,20 @@ function registerAuthCommand(program) {
                 (0, output_1.printInfo)('请执行 ai-flow auth login 登录');
                 return;
             }
-            const maskedToken = config.token.length > 8
-                ? config.token.substring(0, 4) +
+            const maskedToken = config.auth.access_token.length > 8
+                ? config.auth.access_token.substring(0, 4) +
                     '****' +
-                    config.token.substring(config.token.length - 4)
+                    config.auth.access_token.substring(config.auth.access_token.length - 4)
                 : '****';
             if (options.json) {
                 (0, output_1.printStructuredResult)({
                     ok: true,
-                    loggedIn: true,
-                    activeProfile: (0, config_1.getActiveProfile)(),
-                    token: maskedToken,
-                    baseUrl: config.baseUrl,
+                    data: {
+                        loggedIn: true,
+                        activeProfile: (0, config_1.getActiveProfile)(),
+                        token: maskedToken,
+                        baseUrl: config.baseUrl,
+                    },
                 });
                 return;
             }

package/dist/commands/config.js

@@ -15,7 +15,7 @@ function registerConfigCommand(program) {
         (0, output_1.printKeyValue)([
             ['Profile', (0, config_1.getActiveProfile)()],
             ['baseUrl', config.baseUrl],
-            ['token', (0, output_1.truncateToken)(config.token) || '(未设置)'],
+            ['token', (0, output_1.truncateToken)((0, config_1.getAccessToken)(config)) || '(未设置)'],
             ['insecure', String(config.insecure)],
         ]);
     });
@@ -31,8 +31,10 @@ function registerConfigCommand(program) {
         const updates = {};
         if (options.baseUrl)
             updates.baseUrl = options.baseUrl.replace(/\/+$/, '');
-        if (options.token)
-            updates.token = options.token;
+        if (options.token) {
+            const currentConfig = (0, config_1.loadConfig)(options.profile || undefined);
+            updates.auth = { ...(currentConfig.auth || {}), access_token: options.token };
+        }
         if (options.insecure !== undefined)
             updates.insecure = true;
         if (Object.keys(updates).length === 0) {

package/dist/commands/profile.js

@@ -82,7 +82,7 @@ function registerProfileCommand(program) {
                 ok: true,
                 profile: profileName,
                 baseUrl: config.baseUrl,
-                token: config.token ? (0, output_1.truncateToken)(config.token) : '',
+                token: (0, output_1.truncateToken)((0, config_1.getAccessToken)(config)),
                 insecure: config.insecure,
             });
             return;
@@ -90,7 +90,7 @@ function registerProfileCommand(program) {
         (0, output_1.printHeader)(`Profile: ${profileName}`);
         (0, output_1.printKeyValue)([
             ['baseUrl', config.baseUrl],
-            ['token', (0, output_1.truncateToken)(config.token) || '(未设置)'],
+            ['token', (0, output_1.truncateToken)((0, config_1.getAccessToken)(config)) || '(未设置)'],
             ['insecure', String(config.insecure)],
         ]);
     });
@@ -130,7 +130,10 @@ function registerProfileCommand(program) {
         }
         const baseUrl = options.baseUrl || '';
         const token = options.token || '';
-        (0, config_1.addProfile)(name, { baseUrl, token, insecure: !!options.insecure });
+        const auth = {
+            access_token: token,
+        };
+        (0, config_1.addProfile)(name, { baseUrl, auth, insecure: !!options.insecure });
         if (options.setDefault) {
             (0, config_1.setDefaultProfile)(name);
             (0, config_1.setActiveProfile)(name);

package/dist/commands/service-log.js

@@ -0,0 +1,286 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerServiceLogCommand = registerServiceLogCommand;
+const chalk_1 = __importDefault(require("chalk"));
+const service_log_1 = require("@/api/service-log");
+const output_1 = require("@/utils/output");
+const exit_code_1 = require("@/constants/exit-code");
+const common_1 = require("@/utils/common");
+const config_1 = require("@/utils/config");
+const DATETIME_REGEX = /^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/;
+function pad2(n) {
+    return n < 10 ? `0${n}` : String(n);
+}
+function formatDateTime(d) {
+    return (`${d.getFullYear()}-${pad2(d.getMonth() + 1)}-${pad2(d.getDate())} ` +
+        `${pad2(d.getHours())}:${pad2(d.getMinutes())}:${pad2(d.getSeconds())}`);
+}
+function colorizeLevel(level) {
+    const upper = (level || '').toUpperCase();
+    if (upper === 'ERROR' || upper === 'FATAL')
+        return chalk_1.default.red(level);
+    if (upper === 'WARN' || upper === 'WARNING')
+        return chalk_1.default.yellow(level);
+    if (upper === 'INFO')
+        return chalk_1.default.green(level);
+    if (upper === 'DEBUG' || upper === 'TRACE')
+        return chalk_1.default.gray(level);
+    return level;
+}
+function pickLogTime(entry) {
+    return entry.log_time || entry.timestamp || '-';
+}
+function flattenMessage(message) {
+    return (message ?? '').replace(/\r?\n/g, ' ');
+}
+function registerServiceLogCommand(program) {
+    const cmd = program.command('service-log').description('运维日志查询');
+    registerSearch(cmd);
+    registerStream(cmd);
+}
+function registerSearch(serviceLogCmd) {
+    serviceLogCmd
+        .command('search')
+        .description('查询历史运维日志')
+        .option('--time-range <r>', '相对时间范围，格式: <N>s|m|h|d（如 30s, 15m, 3h, 7d）（与 --start-time 互斥）')
+        .option('--start-time <time>', '开始时间 yyyy-MM-dd HH:mm:ss（与 --time-range 互斥）')
+        .option('--end-time <time>', '结束时间 yyyy-MM-dd HH:mm:ss（不传则服务端用请求时刻）')
+        .option('--limit <n>', '最大返回条数（默认 50，上限 500）', '50')
+        .option('--level <level>', '日志级别: INFO / WARN / ERROR')
+        .option('--request-id <id>', '链路 trace id（精确匹配）')
+        .option('--keyword <text>', '日志正文关键词')
+        .option('--service-type <type>', '服务类型: iam / acm / ncm / adm / mdm / nginx 等')
+        .option('--json', '以 JSON 输出')
+        .action(async (options) => {
+        try {
+            if (options.json)
+                (0, output_1.setJsonMode)(true);
+            const req = buildSearchRequest(options);
+            if (req instanceof Error) {
+                if (options.json) {
+                    (0, output_1.printStructuredResult)({ ok: false, message: req.message });
+                }
+                else {
+                    (0, output_1.printError)(req.message);
+                }
+                process.exitCode = exit_code_1.ExitCode.FAILURE;
+                return;
+            }
+            if (!options.json) {
+                (0, output_1.printInfo)('正在查询历史日志...');
+            }
+            const logs = await (0, service_log_1.searchServiceLogs)(req);
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: true, data: logs, total: logs.length });
+                return;
+            }
+            if (logs.length === 0) {
+                (0, output_1.printInfo)('暂无符合条件的日志');
+                return;
+            }
+            (0, output_1.printHeader)(`运维日志 (共 ${logs.length} 条，按时间倒序)`);
+            const rows = logs.map((entry) => [
+                pickLogTime(entry),
+                colorizeLevel(entry.level || '-'),
+                String(entry.host ?? '-'),
+                String(entry.trace_id ?? '-'),
+                flattenMessage(entry.message),
+            ]);
+            (0, output_1.printTable)(['时间', '级别', '服务实例', 'Trace', '消息'], rows, {
+                wrapCols: [4],
+            });
+        }
+        catch (error) {
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: error.message });
+            }
+            else {
+                (0, output_1.printError)(`查询日志失败: ${error.message}`);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+        }
+    });
+}
+function buildSearchRequest(options) {
+    const hasRange = Boolean(options.timeRange);
+    const hasStart = Boolean(options.startTime);
+    if (!hasRange && !hasStart) {
+        return new Error('必须指定 --time-range 或 --start-time 之一');
+    }
+    if (hasRange && hasStart) {
+        return new Error('--time-range 与 --start-time 不可同时使用');
+    }
+    let start_time;
+    let end_time;
+    if (hasRange) {
+        const rangeKey = String(options.timeRange);
+        const ms = (0, common_1.parseTimeRange)(rangeKey);
+        if (ms === null) {
+            return new Error(`不支持的 --time-range 格式: "${rangeKey}"，应为 <N>s|m|h|d（如 30s, 15m, 3h, 7d）`);
+        }
+        const now = new Date();
+        start_time = formatDateTime(new Date(now.getTime() - ms));
+        end_time = formatDateTime(now);
+    }
+    else {
+        const st = String(options.startTime);
+        if (!DATETIME_REGEX.test(st)) {
+            return new Error('--start-time 格式应为 yyyy-MM-dd HH:mm:ss');
+        }
+        start_time = st;
+        if (options.endTime) {
+            const et = String(options.endTime);
+            if (!DATETIME_REGEX.test(et)) {
+                return new Error('--end-time 格式应为 yyyy-MM-dd HH:mm:ss');
+            }
+            end_time = et;
+        }
+    }
+    const limit = Number(options.limit);
+    if (!Number.isFinite(limit) || limit <= 0) {
+        return new Error('--limit 必须为正整数');
+    }
+    const req = { start_time, limit };
+    if (end_time)
+        req.end_time = end_time;
+    if (options.level)
+        req.log_level = String(options.level);
+    if (options.requestId)
+        req.request_id = String(options.requestId);
+    if (options.keyword)
+        req.keyword = String(options.keyword);
+    if (options.serviceType)
+        req.service_type = String(options.serviceType);
+    return req;
+}
+function registerStream(serviceLogCmd) {
+    serviceLogCmd
+        .command('stream')
+        .description('实时跟随运维日志（WebSocket，Ctrl+C 退出）')
+        .option('--level <level>', '日志级别: INFO / WARN / ERROR')
+        .option('--request-id <id>', '链路 trace id（精确匹配）')
+        .option('--keyword <text>', '日志正文关键词')
+        .option('--service-type <type>', '服务类型: iam / acm / ncm / adm / mdm / nginx 等')
+        .option('--limit <n>', '单次 ES 拉取批量（默认 20）', '20')
+        .option('--max <n>', '收到 N 条后自动退出（默认不限）')
+        .option('--json', 'NDJSON 输出（每行一条 { ok, data }）')
+        .action(async (options) => {
+        if (options.json)
+            (0, output_1.setJsonMode)(true);
+        const cfg = (0, config_1.loadConfig)();
+        if (!cfg.auth || !cfg.auth.access_token) {
+            const msg = '未登录，请先执行 ai-flow auth login';
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: msg });
+            }
+            else {
+                (0, output_1.printError)(msg);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+            return;
+        }
+        try {
+            await (0, service_log_1.verifyToken)();
+        }
+        catch (error) {
+            const msg = error.message || 'Token 校验失败';
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: msg });
+            }
+            else {
+                (0, output_1.printError)(`Token 不可用: ${msg}`);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+            return;
+        }
+        const filters = buildStreamFilters(options);
+        if (filters instanceof Error) {
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: filters.message });
+            }
+            else {
+                (0, output_1.printError)(filters.message);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+            return;
+        }
+        const maxCount = options.max ? Number(options.max) : 0;
+        if (options.max && (!Number.isFinite(maxCount) || maxCount <= 0)) {
+            const msg = '--max 必须为正整数';
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: msg });
+            }
+            else {
+                (0, output_1.printError)(msg);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+            return;
+        }
+        let received = 0;
+        let closed = false;
+        if (!options.json) {
+            (0, output_1.printInfo)('正在连接实时日志... (Ctrl+C 退出)');
+        }
+        const control = (0, service_log_1.openServiceLogStream)(filters, {
+            onLog: (entry) => {
+                received += 1;
+                if (options.json) {
+                    (0, output_1.printStructuredResult)({ ok: true, data: entry });
+                }
+                else {
+                    const time = pickLogTime(entry);
+                    const level = colorizeLevel(entry.level || '-');
+                    const host = entry.host ?? '-';
+                    const msg = flattenMessage(entry.message);
+                    console.log(`[${time}] [${level}] [${host}] ${msg}`);
+                }
+                if (maxCount > 0 && received >= maxCount) {
+                    control.cancel();
+                }
+            },
+            onError: (message) => {
+                if (options.json) {
+                    (0, output_1.printStructuredResult)({ ok: false, message });
+                }
+                else {
+                    (0, output_1.printWarning)(message);
+                }
+            },
+            onClose: (code) => {
+                if (closed)
+                    return;
+                closed = true;
+                if (!options.json) {
+                    (0, output_1.printInfo)(`实时日志连接已关闭 (code=${code})`);
+                }
+            },
+        });
+        const onSigInt = () => {
+            if (!closed) {
+                control.cancel();
+            }
+            process.removeListener('SIGINT', onSigInt);
+        };
+        process.on('SIGINT', onSigInt);
+    });
+}
+function buildStreamFilters(options) {
+    const limit = Number(options.limit);
+    if (!Number.isFinite(limit) || limit <= 0) {
+        return new Error('--limit 必须为正整数');
+    }
+    const filters = { limit };
+    if (options.level)
+        filters.log_level = String(options.level);
+    if (options.requestId)
+        filters.request_id = String(options.requestId);
+    if (options.keyword)
+        filters.keyword = String(options.keyword);
+    if (options.serviceType)
+        filters.service_type = String(options.serviceType);
+    return filters;
+}
+//# sourceMappingURL=service-log.js.map

package/dist/index.js

@@ -57,6 +57,7 @@ const link_1 = require("@/commands/link");
 const sync_1 = require("@/commands/sync");
 const org_1 = require("@/commands/org");
 const profile_1 = require("@/commands/profile");
+const service_log_1 = require("@/commands/service-log");
 const updateCheck_1 = require("@/utils/updateCheck");
 const output_1 = require("@/utils/output");
 const config_2 = require("@/utils/config");
@@ -76,6 +77,7 @@ async function main() {
     (0, sync_1.registerSyncCommand)(program);
     (0, org_1.registerOrgCommand)(program);
     (0, profile_1.registerProfileCommand)(program);
+    (0, service_log_1.registerServiceLogCommand)(program);
     program.hook('preAction', (thisCommand) => {
         const opts = thisCommand.optsWithGlobals();
         if (opts.quiet) {

package/dist/utils/common.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.safeParseJSON = safeParseJSON;
+exports.parseTimeRange = parseTimeRange;
 function safeParseJSON(value, fallback) {
     if (typeof value !== 'string')
         return fallback;
@@ -11,4 +12,19 @@ function safeParseJSON(value, fallback) {
         return fallback;
     }
 }
+const UNIT_MS = {
+    s: 1000,
+    m: 60 * 1000,
+    h: 60 * 60 * 1000,
+    d: 24 * 60 * 60 * 1000,
+};
+function parseTimeRange(value) {
+    const trimmed = String(value).trim();
+    const match = trimmed.match(/^(\d+)([smhd])$/i);
+    if (!match)
+        return null;
+    const num = parseInt(match[1], 10);
+    const unit = match[2].toLowerCase();
+    return num * (UNIT_MS[unit] ?? 0);
+}
 //# sourceMappingURL=common.js.map

package/dist/utils/config.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAccessToken = getAccessToken;
 exports.setActiveProfile = setActiveProfile;
 exports.getActiveProfile = getActiveProfile;
 exports.loadConfig = loadConfig;
@@ -55,8 +56,8 @@ const PROJECT_RC = '.ai-flowrc';
 const DEFAULT_PROFILE_NAME = 'default';
 const DEFAULT_CONFIG = {
     baseUrl: 'https://poc.digitalsee.cn',
-    token: '',
     insecure: false,
+    auth: null,
 };
 let activeProfileOverride = null;
 function ensureConfigDir() {
@@ -88,12 +89,18 @@ function buildProfileStoreFromFlat(raw) {
         profiles: {
             [DEFAULT_PROFILE_NAME]: {
                 baseUrl: raw.baseUrl || DEFAULT_CONFIG.baseUrl,
-                token: raw.token ?? DEFAULT_CONFIG.token,
+                auth: raw.auth ?? (raw.token ? { access_token: raw.token } : DEFAULT_CONFIG.auth),
                 insecure: raw.insecure ?? DEFAULT_CONFIG.insecure,
             },
         },
     };
 }
+/**
+ * 从 FlowConfig 中提取 access_token，不存在时返回空字符串。
+ */
+function getAccessToken(config) {
+    return config.auth?.access_token ?? '';
+}
 function setActiveProfile(name) {
     activeProfileOverride = name;
     try {

package/dist/utils/oauth.js

@@ -219,8 +219,8 @@ function createAuthServer() {
                 return;
             }
             const port = addr.port;
-            const waitForCode = createWaitForCode(server, 'http', port);
-            resolve({ server, port, waitForCode });
+            const waitForResult = createWaitForCode(server, 'http', port);
+            resolve({ server, port, waitForResult });
         });
     });
 }
@@ -236,8 +236,8 @@ function createAuthServerHttps() {
                 return;
             }
             const port = addr.port;
-            const waitForCode = createWaitForCode(server, 'https', port);
-            resolve({ server, port, waitForCode });
+            const waitForResult = createWaitForCode(server, 'https', port);
+            resolve({ server, port, waitForResult });
         });
     });
 }
@@ -300,14 +300,22 @@ function createWaitForCode(server, protocol, _port) {
         server.on('request', (req, res) => {
             const url = new URL(req.url || '/', `${protocol}://127.0.0.1`);
             const error = url.searchParams.get('error');
-            const ak = url.searchParams.get('ak');
-            if (!ak && !error) {
+            const accessToken = url.searchParams.get('access_token');
+            const refreshToken = url.searchParams.get('refresh_token');
+            const idToken = url.searchParams.get('id_token');
+            const tokenType = url.searchParams.get('token_type');
+            const expiresIn = url.searchParams.get('expires_in');
+            if (!accessToken && !error) {
                 res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
-                const str = "`${location.href.substring(0, location.href.indexOf('#'))}?ak=${token}`";
+                const str = "`${location.href.substring(0, location.href.indexOf('#'))}?access_token=${token}&refresh_token=${refresh_token}&id_token=${id_token}&token_type=${token_type}&expires_in=${expires_in}`";
                 res.end(renderPage('等待授权回调', `<p>正在等待浏览器授权，请勿关闭此页面...</p><div class="spinner"></div>`, '').replace('</body>', `<script>
             (function(){
               var params = new URLSearchParams(location.hash.substring(1));
               var token = params.get('access_token');
+              var refresh_token = params.get('refresh_token');
+              var id_token = params.get('id_token');
+              var token_type = params.get('token_type');
+              var expires_in = params.get('expires_in');
               location.href = ${str};
             })();
           </script></body>`));
@@ -325,7 +333,18 @@ function createWaitForCode(server, protocol, _port) {
             res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
             res.end(renderPage('登录成功', '<p>请关闭此页面返回终端</p>', '').replace('card">', 'card success">'));
             server.close();
-            resolveCode(ak);
+            const result = {
+                access_token: accessToken ?? '',
+                refresh_token: refreshToken ?? '',
+                id_token: idToken ?? '',
+                token_type: tokenType ?? '',
+                expires_in: expiresIn ? Number(expiresIn) : 0,
+            };
+            if (!accessToken) {
+                rejectCode(new Error('授权回调缺少 access_token'));
+                return;
+            }
+            resolveCode(result);
         });
         server.on('error', (err) => {
             clearTimeout(timer);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "digitalsee-ai-flow-cli",
-  "version": "0.7.6",
+  "version": "0.7.23-beta.1",
   "description": "AI Flow CLI - manage connection flows and node configurations",
   "main": "dist/index.js",
   "bin": {
@@ -17,12 +17,14 @@
     "axios": "^1.18.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",
-    "form-data": "^4.0.6"
+    "form-data": "^4.0.6",
+    "ws": "^8.21.1"
   },
   "devDependencies": {
     "@commitlint/cli": "^21.0.2",
     "@commitlint/config-conventional": "^21.0.2",
     "@types/node": "^20.14.0",
+    "@types/ws": "^8.18.1",
     "@typescript-eslint/eslint-plugin": "^8.60.1",
     "@typescript-eslint/parser": "^8.60.1",
     "eslint": "^10.4.1",