digitalsee-ai-flow-cli 0.9.24-beta → 0.9.29-beta

package/dist/commands/flow/account.js

@@ -1,8 +1,271 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractAccountModelMeta = extractAccountModelMeta;
+exports.buildLegacyAccountConfig = buildLegacyAccountConfig;
+exports.validateCredentialFields = validateCredentialFields;
+exports.maskCredentialConfig = maskCredentialConfig;
+exports.resolveCredentialValues = resolveCredentialValues;
+exports.extractFieldErrorsFromApiError = extractFieldErrorsFromApiError;
+exports.maskAccountInstancesForList = maskAccountInstancesForList;
+exports.isAccountTestFailed = isAccountTestFailed;
 exports.registerFlowAccount = registerFlowAccount;
+const fs = __importStar(require("fs"));
 const node_1 = require("@/api/node");
 const output_1 = require("@/utils/output");
+const exit_code_1 = require("@/constants/exit-code");
+const mask_1 = require("@/utils/mask");
+const common_1 = require("@/utils/common");
+const format_1 = require("@/utils/format");
+const helpers_1 = require("@/commands/flow/helpers");
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function findLegacySchema(model) {
+    const candidates = [model.auth_schema, model.config_schema, model.schema, model].map(asRecord);
+    return candidates.find((s) => s && Array.isArray(s.sub_params));
+}
+/**
+ * 从账号模型响应中提取创建/测试所需的元数据。
+ * 优先走 credential_schema.fields（对齐 rcs CredentialAccountForm 新路径），
+ * 无 credential fields 时回退 legacy auth_schema/config_schema（sub_params 路径）。
+ */
+function extractAccountModelMeta(model, fallbackKey) {
+    const credentialSchema = asRecord(model.credential_schema);
+    const rawFields = credentialSchema?.fields;
+    const fields = Array.isArray(rawFields) ? rawFields : [];
+    return {
+        accountSchemaId: String(model.id ?? fallbackKey),
+        name: String(model.name ?? ''),
+        authType: String(model.auth_type ?? credentialSchema?.type ?? ''),
+        credentialFields: fields,
+        accountKey: model.account_key ?? credentialSchema?.key ?? null,
+        accountVer: model.account_ver ??
+            credentialSchema?.version ??
+            null,
+        legacySubParams: fields.length === 0 && !!findLegacySchema(model),
+    };
+}
+/**
+ * 将 --data 提供的凭据值回填到 legacy ConfigSchema（sub_params[].value），
+ * 并复用 classic 校验（required + page_control 类型契约，PASSWORD 按字符串断言）。
+ */
+function buildLegacyAccountConfig(model, values) {
+    const legacyModel = findLegacySchema(model);
+    const subParams = Array.isArray(legacyModel?.sub_params)
+        ? legacyModel.sub_params
+        : [];
+    const filled = subParams.map((param) => {
+        const key = String(param.name ?? '');
+        const provided = values[key];
+        const next = { ...param };
+        if (provided !== undefined) {
+            next.value = provided;
+        }
+        else if (next.value === undefined) {
+            next.value = '';
+        }
+        return next;
+    });
+    const schemaTree = {
+        ...(legacyModel ?? {}),
+        name: String(model.name ?? ''),
+        sub_params: filled,
+    };
+    const errors = (0, format_1.validateNodePropertyValues)(schemaTree);
+    return { config: { sub_params: filled }, errors };
+}
+/** 凭据值校验：新路径复用注册表驱动的 node_schema 校验（任务 15 fieldTypeRegistry） */
+function validateCredentialFields(values, fields) {
+    return (0, helpers_1.validateNodeSchemaProperties)(values, fields);
+}
+/** PASSWORD 类字段（及常见敏感键）脱敏后的 config 副本 */
+function maskCredentialConfig(config, fields) {
+    const passwordKeys = fields
+        .filter((f) => String(f.type || '').toUpperCase() === 'PASSWORD')
+        .map((f) => f.key.toLowerCase());
+    return (0, mask_1.maskJson)(config, {
+        maskPatterns: false,
+        sensitiveFields: passwordKeys,
+    });
+}
+function printValidationErrors(errors, json) {
+    if (errors.length === 0)
+        return;
+    if (json) {
+        (0, output_1.printStructuredResult)({
+            ok: false,
+            message: `凭据字段校验失败 (${errors.length} 处)`,
+            errors: errors.map((e) => ({ field: e.field, rule: e.rule, message: e.message })),
+        });
+    }
+    else {
+        (0, output_1.printError)(`凭据字段校验失败 (${errors.length} 处):`);
+        for (const e of errors) {
+            (0, output_1.printError)(`  - [${e.rule}] ${e.field}: ${e.message}`);
+        }
+    }
+    process.exitCode = exit_code_1.ExitCode.FAILURE;
+}
+/** 解析 --data / --data-file 为凭据值对象 */
+function resolveCredentialValues(options) {
+    const hasData = options.data !== undefined;
+    const hasFile = options.dataFile !== undefined;
+    if (hasData && hasFile) {
+        throw new Error('--data 和 --data-file 不能同时使用');
+    }
+    if (!hasData && !hasFile) {
+        throw new Error('必须提供 --data <json> 或 --data-file <path>');
+    }
+    let parsed;
+    if (hasFile) {
+        const dataFile = options.dataFile;
+        if (!fs.existsSync(dataFile)) {
+            throw new Error(`文件不存在: ${dataFile}`);
+        }
+        try {
+            parsed = JSON.parse(fs.readFileSync(dataFile, 'utf-8'));
+        }
+        catch {
+            throw new Error(`JSON 格式无效: ${dataFile}`);
+        }
+    }
+    else {
+        try {
+            parsed = JSON.parse(options.data);
+        }
+        catch {
+            throw new Error('JSON 格式无效: --data');
+        }
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('凭据数据必须是 JSON 对象');
+    }
+    return parsed;
+}
+/** 从服务端错误消息中提取字段级错误（message 为 JSON 数组/对象时） */
+function extractFieldErrorsFromApiError(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    const parsed = (0, common_1.safeParseJSON)(message, null);
+    if (Array.isArray(parsed)) {
+        return { message, fieldErrors: parsed };
+    }
+    if (parsed && typeof parsed === 'object') {
+        const record = parsed;
+        const errors = record.errors ?? record.fields ?? record.details ?? null;
+        return { message, fieldErrors: Array.isArray(errors) ? errors : [parsed] };
+    }
+    return { message, fieldErrors: null };
+}
+/** 凭据字段常见别名（小写），账号模型不可得时的兜底脱敏范围 */
+const ACCOUNT_SENSITIVE_KEY_FALLBACK = [
+    'appsecret',
+    'app_secret',
+    'appkey',
+    'app_key',
+    'clientsecret',
+    'client_secret',
+    'passphrase',
+];
+/** 从账号模型提取 PASSWORD 字段键（小写）：新路径 credential_schema.fields + legacy sub_params */
+function readAccountPasswordFieldKeys(model) {
+    const meta = extractAccountModelMeta(model, '');
+    const keys = meta.credentialFields
+        .filter((f) => String(f.type || '').toUpperCase() === 'PASSWORD')
+        .map((f) => f.key.toLowerCase());
+    if (keys.length === 0) {
+        const legacyModel = findLegacySchema(model);
+        const subParams = Array.isArray(legacyModel?.sub_params)
+            ? legacyModel.sub_params
+            : [];
+        for (const param of subParams) {
+            const control = String(param.page_control || param.type || '').toUpperCase();
+            if (control === 'PASSWORD' && param.name)
+                keys.push(String(param.name).toLowerCase());
+        }
+    }
+    return keys;
+}
+/**
+ * 账号实例 config 的列表输出脱敏：按 (account_key|account_schema_id, account_ver)
+ * 去重拉取账号模型，收集 PASSWORD 字段键；模型拉取失败不阻塞，回退通用别名。
+ */
+async function maskAccountInstancesForList(accounts) {
+    const passwordKeys = new Set();
+    const seenSchemas = new Set();
+    for (const account of accounts) {
+        const lookup = account.account_key || String(account.account_schema_id ?? '');
+        if (!lookup)
+            continue;
+        const ver = account.account_ver;
+        const cacheKey = `${lookup}@${ver ?? ''}`;
+        if (seenSchemas.has(cacheKey))
+            continue;
+        seenSchemas.add(cacheKey);
+        try {
+            const model = await (0, node_1.getAccountModel)(lookup, ver === undefined || ver === null ? undefined : String(ver));
+            for (const key of readAccountPasswordFieldKeys(model))
+                passwordKeys.add(key);
+        }
+        catch {
+            // 模型拉取失败不阻塞列表，仅用通用别名兜底
+        }
+    }
+    const sensitiveFields = [...passwordKeys, ...ACCOUNT_SENSITIVE_KEY_FALLBACK];
+    return accounts.map((account) => {
+        const config = asRecord(account.config);
+        if (!config)
+            return account;
+        return {
+            ...account,
+            config: (0, mask_1.maskJson)(config, { maskPatterns: false, sensitiveFields }),
+        };
+    });
+}
+/**
+ * account test 业务判读：连通失败走 HTTP 200，失败标志有两种形态——
+ * data 为裸布尔 false（{error:"0", data:false}，实测 0.9.29-beta）或
+ * data 为对象且 result:false。其余（true / {result:true} / 无标志）视为成功。
+ */
+function isAccountTestFailed(result) {
+    if (result === false)
+        return true;
+    return asRecord(result)?.result === false;
+}
 function registerFlowAccount(flowCmd) {
     const accountCmd = flowCmd.command('account').description('账号操作');
     accountCmd
@@ -16,7 +279,9 @@ function registerFlowAccount(flowCmd) {
                 (0, output_1.setJsonMode)(true);
             const accounts = await (0, node_1.getAccountInstances)(connectorId, options.accountSchemaId);
             if (options.json) {
-                (0, output_1.printStructuredResult)({ ok: true, data: accounts });
+                // config 含服务端回传的凭据明文（appSecret 等），列表输出统一脱敏
+                const masked = await maskAccountInstancesForList(accounts);
+                (0, output_1.printStructuredResult)({ ok: true, data: masked, total: masked.length });
                 return;
             }
             if (accounts.length === 0) {
@@ -45,5 +310,178 @@ function registerFlowAccount(flowCmd) {
             }
         }
     });
+    accountCmd
+        .command('create <connectorId>')
+        .description('创建账号实例（凭据字段校验复用字段类型契约注册表）')
+        .requiredOption('--account-schema-id <id>', '账号模型 ID（数字 schema id 或 account_key）')
+        .option('--data <json>', '凭据字段 JSON（key → 值，如 \'{"host":"...","password":"..."}\'）')
+        .option('--data-file <path>', '凭据字段 JSON 文件路径（与 --data 互斥）')
+        .option('--name <name>', '实例显示名称（缺省使用账号模型名称）')
+        .option('--proxy-id <id>', '代理网关 ID')
+        .option('--json', '以 JSON 格式输出')
+        .action(async (connectorId, options) => {
+        try {
+            if (options.json)
+                (0, output_1.setJsonMode)(true);
+            const values = resolveCredentialValues(options);
+            const model = await (0, node_1.getAccountModel)(options.accountSchemaId);
+            const meta = extractAccountModelMeta(model, options.accountSchemaId);
+            if (meta.credentialFields.length === 0 && !meta.legacySubParams) {
+                throw new Error(`账号模型 ${options.accountSchemaId} 未定义 credential_schema.fields，也无法回退 legacy sub_params，无法创建`);
+            }
+            let config;
+            let validationErrors;
+            if (meta.legacySubParams) {
+                const built = buildLegacyAccountConfig(model, values);
+                config = built.config;
+                validationErrors = built.errors;
+            }
+            else {
+                validationErrors = validateCredentialFields(values, meta.credentialFields);
+                config = values;
+            }
+            if (validationErrors.length > 0) {
+                printValidationErrors(validationErrors, options.json);
+                return;
+            }
+            const payload = {
+                connector_id: connectorId,
+                account_schema_id: meta.accountSchemaId,
+                auth_type: meta.authType,
+                name: String(options.name || meta.name || options.accountSchemaId),
+                config,
+                ...(options.proxyId ? { proxy_id: options.proxyId } : {}),
+                ...(meta.accountKey ? { account_key: meta.accountKey } : {}),
+                ...(meta.accountVer !== null && meta.accountVer !== undefined
+                    ? { account_ver: meta.accountVer }
+                    : {}),
+            };
+            const result = await (0, node_1.createAccountInstance)(payload);
+            const resultRecord = asRecord(result) ?? {};
+            const instanceId = String(resultRecord.id ?? asRecord(resultRecord.data)?.id ?? '');
+            if (options.json) {
+                (0, output_1.printStructuredResult)({
+                    ok: true,
+                    id: instanceId,
+                    message: '账号实例创建成功',
+                    account: {
+                        connector_id: connectorId,
+                        account_schema_id: meta.accountSchemaId,
+                        auth_type: meta.authType,
+                        name: payload.name,
+                        config: maskCredentialConfig(config, meta.credentialFields),
+                    },
+                });
+                return;
+            }
+            (0, output_1.printSuccess)('账号实例创建成功');
+            (0, output_1.printKeyValue)([
+                ['实例 ID', instanceId || '(服务端未返回)'],
+                ['名称', payload.name],
+                ['认证类型', meta.authType || '-'],
+                ['账号模型', meta.accountSchemaId],
+                ['连接器', connectorId],
+            ]);
+            if (instanceId) {
+                (0, output_1.printInfo)(`可通过 flow account test ${instanceId} 验证连通性`);
+            }
+        }
+        catch (error) {
+            if (options.json) {
+                (0, output_1.printStructuredResult)({ ok: false, message: error.message });
+            }
+            else {
+                (0, output_1.printError)(`创建账号实例失败: ${error.message}`);
+                (0, output_1.printError)(`提示: ai-flow flow account create ${connectorId} --account-schema-id ${options.accountSchemaId ?? '<id>'} --data '<凭据JSON>'`);
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+        }
+    });
+    accountCmd
+        .command('test <accountId>')
+        .description('测试账号实例连通性（服务端校验凭据，失败时给出字段级错误）')
+        .option('--json', '以 JSON 格式输出')
+        .action(async (accountId, options) => {
+        try {
+            if (options.json)
+                (0, output_1.setJsonMode)(true);
+            const detail = asRecord(await (0, node_1.getAccountInstanceDetail)(accountId)) ?? {};
+            const accountKey = detail.account_key;
+            const accountVer = detail.account_ver;
+            const schemaLookup = accountKey || detail.account_schema_id;
+            let model = {};
+            if (schemaLookup) {
+                try {
+                    model = await (0, node_1.getAccountModel)(String(schemaLookup), accountVer);
+                }
+                catch {
+                    // 模型拉取失败不阻塞测试，直接用实例详情构造请求
+                }
+            }
+            const meta = extractAccountModelMeta(model, String(detail.account_schema_id ?? ''));
+            const payload = {
+                connector_id: detail.connector_id ?? null,
+                account_schema_id: String(detail.account_schema_id ?? meta.accountSchemaId ?? schemaLookup ?? ''),
+                auth_type: String(detail.auth_type ?? meta.authType ?? ''),
+                name: String(detail.name ?? ''),
+                config: (asRecord(detail.config) ?? {}),
+                id: accountId,
+                ...(accountKey ? { account_key: accountKey } : {}),
+                ...(accountVer !== undefined && accountVer !== null ? { account_ver: accountVer } : {}),
+            };
+            const result = await (0, node_1.testAccountInstance)(payload);
+            const resultRecord = asRecord(result);
+            // 业务判读：连通性校验失败走 HTTP 200（不进 catch），唯一可信标志是
+            // data 本身（裸布尔 false）或 data.result —— ok/message 均不可信
+            const testFailed = isAccountTestFailed(result);
+            if (options.json) {
+                (0, output_1.printStructuredResult)({
+                    ok: !testFailed,
+                    data: { account_id: accountId, result },
+                    message: testFailed
+                        ? '测试连接失败: 服务端连通性校验未通过（判读 data 为 false 或 data.result）'
+                        : '测试连接成功',
+                });
+                return;
+            }
+            if (testFailed) {
+                (0, output_1.printError)(`测试连接失败 (账号: ${payload.name || accountId})`);
+            }
+            else {
+                (0, output_1.printSuccess)(`测试连接成功 (账号: ${payload.name || accountId})`);
+            }
+            if (resultRecord) {
+                const kv = [];
+                for (const key of Object.keys(resultRecord).slice(0, 10)) {
+                    kv.push([key, String(JSON.stringify(resultRecord[key]).substring(0, 120))]);
+                }
+                if (kv.length)
+                    (0, output_1.printKeyValue)(kv);
+            }
+            if (testFailed) {
+                process.exitCode = exit_code_1.ExitCode.FAILURE;
+            }
+        }
+        catch (error) {
+            const { message, fieldErrors } = extractFieldErrorsFromApiError(error);
+            if (options.json) {
+                (0, output_1.printStructuredResult)({
+                    ok: false,
+                    message: `测试连接失败: ${message}`,
+                    ...(fieldErrors ? { fieldErrors } : {}),
+                });
+            }
+            else {
+                (0, output_1.printError)(`测试连接失败: ${message}`);
+                if (fieldErrors) {
+                    (0, output_1.printError)('字段级错误:');
+                    for (const fe of fieldErrors) {
+                        (0, output_1.printError)(`  - ${JSON.stringify(fe)}`);
+                    }
+                }
+            }
+            process.exitCode = exit_code_1.ExitCode.FAILURE;
+        }
+    });
 }
 //# sourceMappingURL=account.js.map

package/dist/commands/flow/analyze.js

@@ -7,6 +7,7 @@ exports.registerFlowAnalyze = registerFlowAnalyze;
 const chalk_1 = __importDefault(require("chalk"));
 const flow_1 = require("@/api/flow");
 const flowAnalyzer_1 = require("@/services/flowAnalyzer");
+const flowValidator_1 = require("@/services/flowValidator");
 const helpers_1 = require("@/commands/flow/helpers");
 const output_1 = require("@/utils/output");
 function registerFlowAnalyze(flowCmd) {
@@ -94,8 +95,15 @@ function registerFlowAnalyze(flowCmd) {
                     console.log(`  ${chalk_1.default.gray(String(i + 1).padStart(3))}. ${chalk_1.default.cyan(nid)} ${chalk_1.default.white(`[${name}]`)}`);
                 });
             }
-            else {
-                (0, output_1.printWarning)('无法确定执行顺序（可能包含循环依赖或孤立节点）');
+            const graphResult = (0, flowValidator_1.validateFlowGraph)({
+                nodes: analysis.nodes,
+                edges: analysis.edges,
+            });
+            for (const issue of graphResult.issues) {
+                if (issue.severity === 'error')
+                    (0, output_1.printError)(issue.message);
+                else
+                    (0, output_1.printWarning)(issue.message);
             }
             if (options.format === 'brief') {
                 (0, output_1.printSuccess)('分析完成');

package/dist/commands/flow/export.js

@@ -33,11 +33,23 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectEnvelopeKeysInExport = detectEnvelopeKeysInExport;
 exports.registerFlowExport = registerFlowExport;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const flow_1 = require("@/api/flow");
 const output_1 = require("@/utils/output");
+/** NodePackage 提交信封中由宿主处理的顶层键（详见 @/utils/nodeEnvelope） */
+const ENVELOPE_HOST_KEYS = ['proxy_id', 'mcp_tool_description'];
+/**
+ * 扫描导出 YAML 文本中出现的信封宿主键（proxy_id / mcp_tool_description）。
+ *
+ * 导出文件保持服务端序列化原样（保证 flow import 回导语义），
+ * 此处仅做展示层识别：返回命中的键名列表，供命令输出单独提示。
+ */
+function detectEnvelopeKeysInExport(yamlText) {
+    return ENVELOPE_HOST_KEYS.filter((key) => new RegExp(`^[ \\t-]+\\b${key}\\s*:`, 'm').test(yamlText));
+}
 function registerFlowExport(flowCmd) {
     flowCmd
         .command('export <flowId>')
@@ -61,19 +73,32 @@ function registerFlowExport(flowCmd) {
             else {
                 outputPath = `./${flow.name || flowId}.yaml`;
             }
+            const envelopeKeys = await (0, flow_1.exportFlow)(flowId, outputPath);
+            const detected = detectEnvelopeKeysInExport(String(envelopeKeys));
             if (options.json) {
-                await (0, flow_1.exportFlow)(flowId, outputPath);
-                (0, output_1.printStructuredResult)({
+                const result = {
                     ok: true,
                     id: flowId,
                     file: outputPath,
                     message: `连接流已导出至 ${outputPath}`,
-                });
+                };
+                if (detected.length > 0) {
+                    result.envelopeKeys = detected;
+                }
+                (0, output_1.printStructuredResult)(result);
             }
             else {
                 (0, output_1.printInfo)(`正在导出连接流 ${flow.name || flowId}...`);
-                await (0, flow_1.exportFlow)(flowId, outputPath);
                 (0, output_1.printSuccess)(`连接流已导出至 ${outputPath}`);
+                if (detected.length > 0) {
+                    (0, output_1.printWarning)(`导出内容包含 NodePackage 信封字段: ${detected.join(', ')}`);
+                    (0, output_1.printKeyValue)([
+                        [
+                            '说明',
+                            'proxy_id / mcp_tool_description 为节点信封顶层字段（不属于业务 properties），文件保持服务端原样以保证导入兼容；可用 flow node show 查看解包后的可读结构',
+                        ],
+                    ]);
+                }
             }
         }
         catch (error) {