dsh-data-cleaning-agent 0.6.3 → 0.8.0

package/lib/image-intake.js

@@ -0,0 +1,414 @@
+/**
+ * 图片企业名单接入。
+ *
+ * Browser 只负责把用户明确选择/粘贴的图片暂存到 Host；真实视觉识别由
+ * Agent-owned 高层工具在当前会话执行上下文中调用已探测到的 Provider。
+ * 当前已验证 Provider 是 modlens_read_image。图片使用 0600 临时文件，识别
+ * 完成、失败、取消或 TTL 到期后立即删除；不会进入 storageDomain 或导出制品。
+ */
+import { randomUUID } from 'node:crypto';
+import { mkdir, unlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+export const TOOL_IMAGE_EXTRACT = 'data_cleaning_extract_image_companies';
+export const IMAGE_PROVIDER_MODLENS = 'modlens_read_image';
+
+export const IMAGE_LIMITS = Object.freeze({
+  maxBytes: 8 * 1024 * 1024,
+  maxEntries: 100,
+  ttlMs: 15 * 60 * 1000,
+});
+
+const IMAGE_ROOT = join(tmpdir(), 'dsh-data-cleaning-agent-images');
+
+export class ImageIntakeError extends Error {
+  constructor(code, message, status = 400, details = {}) {
+    super(message);
+    this.name = 'ImageIntakeError';
+    this.code = code;
+    this.status = status;
+    Object.assign(this, details);
+  }
+}
+
+function safeName(value) {
+  return String(value ?? '企业名单图片')
+    .replace(/[\u0000-\u001f\u007f/\\]/g, '_')
+    .trim()
+    .slice(0, 160) || '企业名单图片';
+}
+
+export function sniffImage(bytes) {
+  if (!Buffer.isBuffer(bytes) || bytes.length < 12) return null;
+  if (bytes.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) {
+    return { mimeType: 'image/png', extension: 'png' };
+  }
+  if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) {
+    return { mimeType: 'image/jpeg', extension: 'jpg' };
+  }
+  if (bytes.subarray(0, 4).toString('ascii') === 'RIFF' && bytes.subarray(8, 12).toString('ascii') === 'WEBP') {
+    return { mimeType: 'image/webp', extension: 'webp' };
+  }
+  return null;
+}
+
+function decodeImage(content) {
+  const raw = String(content ?? '').replace(/^data:image\/[a-z0-9.+-]+;base64,/i, '');
+  if (!raw || !/^[A-Za-z0-9+/]*={0,2}$/.test(raw) || raw.length % 4 === 1) {
+    throw new ImageIntakeError('DC_IMAGE_BASE64', '图片内容不是有效的 Base64 数据。');
+  }
+  const bytes = Buffer.from(raw, 'base64');
+  if (!bytes.length) throw new ImageIntakeError('DC_IMAGE_EMPTY', '图片内容为空。');
+  if (bytes.length > IMAGE_LIMITS.maxBytes) {
+    throw new ImageIntakeError('DC_IMAGE_TOO_LARGE', '图片不能超过 8 MiB。', 413);
+  }
+  const detected = sniffImage(bytes);
+  if (!detected) {
+    throw new ImageIntakeError('DC_IMAGE_TYPE', '仅支持真实 PNG、JPEG 或 WebP 图片。', 415);
+  }
+  return { bytes, ...detected };
+}
+
+function unwrapProviderValue(result) {
+  if (result?.isError === true) {
+    const message = result?.error?.message || result?.message || '图片识别 Provider 调用失败。';
+    throw new ImageIntakeError('DC_IMAGE_PROVIDER_FAILED', String(message), 502);
+  }
+  let value = result?.value ?? result;
+  if (value && Array.isArray(value.content)) {
+    const text = value.content.filter((item) => item?.type === 'text').map((item) => item.text).join('\n');
+    if (text) {
+      try { value = JSON.parse(text); } catch { value = { ocr: { full_text: text } }; }
+    }
+  }
+  return value;
+}
+
+export function providerText(result) {
+  const value = unwrapProviderValue(result);
+  const lines = Array.isArray(value?.ocr?.lines)
+    ? value.ocr.lines.map((line) => String(line?.text ?? '').trim()).filter(Boolean)
+    : [];
+  const text = String(value?.ocr?.full_text ?? lines.join('\n') ?? '').trim();
+  if (!text) {
+    throw new ImageIntakeError('DC_IMAGE_NO_TEXT', '图片中未识别到可用文字，请换用更清晰的原图。', 422);
+  }
+  return text;
+}
+
+const CREDIT_RE = /\b[0-9A-HJ-NPQRTUWXY]{18}\b/gi;
+const COMPANY_END = '(?:有限责任公司|股份有限公司|集团有限公司|有限公司|集团公司|公司|普通合伙|有限合伙|合伙企业|个人独资企业|农民专业合作社|合作社|事务所|研究院|研究所|中心|商行|工厂|厂)';
+const COMPANY_RE = new RegExp(`[\\p{Script=Han}A-Za-z0-9（）()·&＋+—\\-]{2,72}${COMPANY_END}`, 'gu');
+const HEADER_RE = /^(?:序号|企业名称|公司名称|单位名称|统一社会信用代码|信用代码|注册号|名称|企业名单)$/i;
+
+function cleanCell(value) {
+  return String(value ?? '')
+    .replace(/^\s*(?:[-•·●▪◦]|\d{1,4}[.)、：:]?)\s*/, '')
+    .replace(/^(?:企业名称|公司名称|单位名称|统一社会信用代码|信用代码|注册号)\s*[:：]\s*/i, '')
+    .replace(/[\s\u00a0]+/g, '')
+    .trim();
+}
+
+/** 从 OCR 文本确定性提取一企一行的名称/信用代码，不推断不存在的主体。 */
+export function extractCompanyEntries(text, maxEntries = IMAGE_LIMITS.maxEntries) {
+  const entries = [];
+  const seen = new Set();
+  const push = (name, creditNo) => {
+    const cleanName = cleanCell(name);
+    const cleanCredit = String(creditNo ?? '').trim().toUpperCase();
+    if (!cleanName && !cleanCredit) return;
+    if (cleanName && HEADER_RE.test(cleanName)) return;
+    const display = [cleanName, cleanCredit].filter(Boolean).join(' | ');
+    const key = `${cleanName.toLowerCase()}|${cleanCredit}`;
+    if (!seen.has(key) && entries.length < maxEntries) {
+      seen.add(key);
+      entries.push(display);
+    }
+  };
+
+  for (const rawLine of String(text ?? '').split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    const credits = [...line.matchAll(CREDIT_RE)].map((match) => match[0].toUpperCase());
+    const names = [];
+    for (const cell of line.split(/\t|[|｜]|\s{2,}|[，,；;]/)) {
+      const compact = cleanCell(cell);
+      for (const match of compact.matchAll(COMPANY_RE)) names.push(match[0]);
+    }
+    if (!names.length) {
+      const compact = cleanCell(line.replace(CREDIT_RE, ''));
+      for (const match of compact.matchAll(COMPANY_RE)) names.push(match[0]);
+    }
+    if (names.length === 1 && credits.length === 1) push(names[0], credits[0]);
+    else {
+      for (const name of names) push(name, '');
+      for (const credit of credits) push('', credit);
+    }
+    if (entries.length >= maxEntries) break;
+  }
+  return entries;
+}
+
+function publicRecord(record, now = Date.now()) {
+  return structuredClone({
+    commandId: record.commandId,
+    state: record.state,
+    fileName: record.fileName,
+    mimeType: record.mimeType,
+    sizeBytes: record.sizeBytes,
+    provider: record.provider,
+    createdAt: record.createdAt,
+    updatedAt: record.updatedAt,
+    expiresInMs: Math.max(0, record.expiresAt - now),
+    result: record.result,
+    error: record.error,
+  });
+}
+
+function safeFailure(error) {
+  if (error instanceof ImageIntakeError && error.code !== 'DC_IMAGE_PROVIDER_FAILED') {
+    return { code: error.code, message: error.message };
+  }
+  return {
+    code: 'DC_IMAGE_PROVIDER_FAILED',
+    message: '图片识别 Provider 当前不可用或配置无效。请配置 Modlens 可用视觉通道，或改用文本/Excel 名单。',
+  };
+}
+
+export class ImageIntakeStore {
+  constructor({ tools, clock = () => Date.now(), ttlMs = IMAGE_LIMITS.ttlMs } = {}) {
+    if (!tools || typeof tools.get !== 'function' || typeof tools.execute !== 'function') {
+      throw new TypeError('ImageIntakeStore requires ctx.tools get/execute');
+    }
+    this.tools = tools;
+    this.clock = clock;
+    this.ttlMs = ttlMs;
+    this.records = new Map();
+  }
+
+  providerDefinition() {
+    try { return this.tools.get(IMAGE_PROVIDER_MODLENS); } catch { return undefined; }
+  }
+
+  capabilities() {
+    const definition = this.providerDefinition();
+    return {
+      ready: Boolean(definition),
+      provider: definition ? IMAGE_PROVIDER_MODLENS : null,
+      nativeAttachmentUi: true,
+      pasteAndDrop: true,
+      formats: ['image/png', 'image/jpeg', 'image/webp'],
+      limits: IMAGE_LIMITS,
+      persistence: 'ephemeral-host-file',
+    };
+  }
+
+  scheduleExpiry(record) {
+    if (record.timer) clearTimeout(record.timer);
+    const delay = Math.max(1, Math.min(2_147_483_647, record.expiresAt - this.clock()));
+    record.timer = setTimeout(() => {
+      this.expire(record.commandId).catch(() => {});
+    }, delay);
+    record.timer.unref?.();
+  }
+
+  async expire(commandId) {
+    const record = this.records.get(commandId);
+    if (!record) return;
+    if (record.state === 'running') {
+      record.expiresAt = this.clock() + 60_000;
+      this.scheduleExpiry(record);
+      return;
+    }
+    if (record.timer) clearTimeout(record.timer);
+    await this.removeFile(record);
+    this.records.delete(commandId);
+  }
+
+  async cleanup() {
+    const now = this.clock();
+    for (const [id, record] of this.records) {
+      if (record.expiresAt <= now && record.state !== 'running') {
+        if (record.timer) clearTimeout(record.timer);
+        await this.removeFile(record);
+        this.records.delete(id);
+      }
+    }
+  }
+
+  async removeFile(record) {
+    if (!record?.path) return;
+    const path = record.path;
+    record.path = null;
+    try { await unlink(path); } catch (error) {
+      if (error?.code !== 'ENOENT') throw error;
+    }
+  }
+
+  async prepare(input = {}) {
+    await this.cleanup();
+    const provider = this.providerDefinition();
+    if (!provider) {
+      throw new ImageIntakeError(
+        'DC_IMAGE_PROVIDER_UNAVAILABLE',
+        '当前 DSH 没有可用的图片文字识别 Provider。请安装并配置 Modlens，或改用文本/Excel 名单。',
+        503,
+      );
+    }
+    const decoded = decodeImage(input.content);
+    const commandId = `dci-${randomUUID()}`;
+    const at = new Date(this.clock()).toISOString();
+    await mkdir(IMAGE_ROOT, { recursive: true, mode: 0o700 });
+    const path = join(IMAGE_ROOT, `${commandId}.${decoded.extension}`);
+    await writeFile(path, decoded.bytes, { mode: 0o600, flag: 'wx' });
+    const record = {
+      commandId,
+      state: 'prepared',
+      fileName: safeName(input.fileName),
+      mimeType: decoded.mimeType,
+      sizeBytes: decoded.bytes.length,
+      provider: IMAGE_PROVIDER_MODLENS,
+      path,
+      createdAt: at,
+      updatedAt: at,
+      expiresAt: this.clock() + this.ttlMs,
+      result: null,
+      error: null,
+      promise: null,
+      timer: null,
+    };
+    this.records.set(commandId, record);
+    this.scheduleExpiry(record);
+    return publicRecord(record, this.clock());
+  }
+
+  require(commandId) {
+    const record = this.records.get(String(commandId ?? ''));
+    if (!record || (record.expiresAt <= this.clock() && record.state !== 'running')) {
+      if (record && record.state !== 'running') this.expire(record.commandId).catch(() => {});
+      throw new ImageIntakeError('DC_IMAGE_COMMAND_NOT_FOUND', '图片识别任务不存在或已过期。', 404);
+    }
+    return record;
+  }
+
+  status(commandId) {
+    return publicRecord(this.require(commandId), this.clock());
+  }
+
+  async run(commandId, exec) {
+    const record = this.require(commandId);
+    if (!exec?.agent || !exec?.token) {
+      throw new ImageIntakeError('DC_IMAGE_AGENT_EXECUTION_REQUIRED', '图片识别必须由当前 DSH Agent 会话执行。', 409);
+    }
+    if (record.promise) return record.promise;
+    if (record.state === 'completed') return { commandId, ...record.result };
+    const provider = this.providerDefinition();
+    if (!provider) {
+      throw new ImageIntakeError('DC_IMAGE_PROVIDER_UNAVAILABLE', '图片识别 Provider 已离线。', 503);
+    }
+    record.state = 'running';
+    record.updatedAt = new Date(this.clock()).toISOString();
+    record.promise = this.tools.execute({
+      name: provider.name ?? IMAGE_PROVIDER_MODLENS,
+      callId: `dc-image-${randomUUID()}`,
+      rootCallId: exec.rootCallId,
+      parent: exec.token,
+      agent: exec.agent,
+      signal: exec.signal,
+      arguments: {
+        path: record.path,
+        prompt: '完整识别图片中的企业名单。重点逐行转写企业全称、统一社会信用代码或注册号；保留原始文字，不猜测模糊字符。',
+      },
+    }).then(async (providerResult) => {
+      const text = providerText(providerResult);
+      const entries = extractCompanyEntries(text);
+      if (!entries.length) {
+        throw new ImageIntakeError('DC_IMAGE_NO_COMPANY', '图片文字已识别，但未提取到企业全称或 18 位统一社会信用代码。', 422);
+      }
+      record.result = {
+        entries,
+        entryCount: entries.length,
+        truncated: entries.length >= IMAGE_LIMITS.maxEntries,
+      };
+      record.state = 'completed';
+      record.error = null;
+      record.updatedAt = new Date(this.clock()).toISOString();
+      await this.removeFile(record);
+      return { commandId, ...structuredClone(record.result) };
+    }).catch(async (error) => {
+      record.state = 'failed';
+      const failure = safeFailure(error);
+      record.error = failure;
+      record.updatedAt = new Date(this.clock()).toISOString();
+      await this.removeFile(record);
+      throw new ImageIntakeError(failure.code, failure.message, 502);
+    });
+    return record.promise;
+  }
+
+  async remove(commandId) {
+    const record = this.records.get(String(commandId ?? ''));
+    if (!record) return false;
+    if (record.state === 'running') {
+      throw new ImageIntakeError('DC_IMAGE_OPERATION_IN_PROGRESS', '图片正在识别，暂不能移除。', 409);
+    }
+    if (record.timer) clearTimeout(record.timer);
+    await this.removeFile(record);
+    this.records.delete(record.commandId);
+    return true;
+  }
+
+  async dispose() {
+    for (const record of this.records.values()) if (record.timer) clearTimeout(record.timer);
+    await Promise.all([...this.records.values()].map((record) => this.removeFile(record).catch(() => {})));
+    this.records.clear();
+  }
+}
+
+export function serializeImageExtractionPrompt(command) {
+  return [
+    '请识别我刚刚在向导中安全暂存的企业名单图片，并把识别结果交回数据清洗补全工作台供我逐条核验。',
+    '',
+    `图片文件：${command.fileName}。`,
+    '识别目标：逐行提取企业全称、18 位统一社会信用代码或注册号；不得猜测模糊字符。',
+    '本步骤只做图片文字识别与名单提取，不调用企查查，不消耗企查查 MCP 额度。',
+    `安全图片凭证：${command.commandId}`,
+    '',
+    `发送本说明后，请仅调用一次图片名单识别工具（${TOOL_IMAGE_EXTRACT}），参数只传递上述安全图片凭证。`,
+    '工具完成后立即结束本轮；不要直接调用任何 mcp__qcc-* 工具。',
+  ].join('\n');
+}
+
+export function registerImageIntakeTool(tools, store) {
+  return tools.register({
+    name: TOOL_IMAGE_EXTRACT,
+    description: 'Recognize one already-staged company-list image. Call only when a visible data-cleaning prompt supplies a dci-* commandId. The Host owns the temporary image and invokes the available vision provider in the current Agent execution.',
+    parameters: {
+      type: 'object',
+      additionalProperties: false,
+      properties: { commandId: { type: 'string' } },
+      required: ['commandId'],
+    },
+    output: {
+      schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+          commandId: { type: 'string' },
+          entries: { type: 'array', items: { type: 'string' } },
+          entryCount: { type: 'integer' },
+          truncated: { type: 'boolean' },
+        },
+        required: ['commandId', 'entries', 'entryCount', 'truncated'],
+      },
+      render: (_args, value) => [{
+        type: 'text',
+        text: `图片企业名单已识别：${value.entryCount} 条，已同步回数据清洗补全工作台等待核验。`,
+      }],
+    },
+    async execute(args, exec) {
+      return store.run(args.commandId, exec);
+    },
+  });
+}

package/lib/index.js

@@ -28,6 +28,7 @@ export function apply(ctx, config) {
     webMounted: false,
     webSkipped: false,
     qccBridgeMounted: false,
+    imageIntakeToolRegistered: false,
   };
   const disposers = [];
 

package/lib/qcc-field-catalog.js

@@ -0,0 +1,185 @@
+/**
+ * 数据清洗补全的一企一行字段目录。
+ *
+ * 这里只收录已核对 QCC MCP 一手实现、能够稳定投影为单个 Excel 单元格的字段。
+ * 任何明细列表（电话全集、海关资质、风险关联方等）都不得进入本目录。
+ */
+
+const field = (id, label, options = {}) => Object.freeze({ id, label, ...options });
+const group = (id, label, sourceTool, fields, options = {}) => Object.freeze({
+  id,
+  label,
+  sourceTool,
+  ...options,
+  fields: Object.freeze(fields),
+});
+
+export const SELF_RISK_FACTORS = Object.freeze([
+  ['dishonest', '失信信息'],
+  ['judgment_debtor', '被执行人'],
+  ['consumption_restriction', '限制高消费'],
+  ['terminated_case', '终本案件'],
+  ['judicial_document', '裁判文书'],
+  ['case_filing', '立案信息'],
+  ['hearing_announcement', '开庭公告'],
+  ['court_announcement', '法院公告'],
+  ['service_notice', '送达公告'],
+  ['bankruptcy_reorganization', '破产重整'],
+  ['equity_freeze', '股权冻结'],
+  ['judicial_auction', '司法拍卖'],
+  ['valuation_inquiry', '询价评估'],
+  ['pre_litigation_mediation', '诉前调解'],
+  ['exit_restriction', '限制出境'],
+  ['administrative_penalty', '行政处罚'],
+  ['operating_exception', '经营异常'],
+  ['serious_violation', '严重违法'],
+  ['environmental_penalty', '环保处罚'],
+  ['abnormal_taxpayer', '税务非正常户'],
+  ['tax_arrears', '欠税公告'],
+  ['tax_violation', '税收违法'],
+  ['disciplinary_list', '惩戒名单'],
+  ['default_matter', '违约事项'],
+  ['guarantee', '担保信息'],
+  ['equity_pledge_registration', '股权出质'],
+  ['stock_pledge', '股权质押'],
+  ['chattel_mortgage', '动产抵押'],
+  ['land_mortgage', '土地抵押'],
+  ['simple_cancellation', '简易注销'],
+  ['cancellation_filing', '注销备案'],
+  ['liquidation', '清算信息'],
+  ['labor_arbitration', '劳动仲裁'],
+  ['public_notice', '公示催告'],
+  ['property_reward_notice', '财产悬赏公告'],
+].map(Object.freeze));
+
+export const RELATED_RISK_FACTORS = Object.freeze([
+  ['dishonest', '失信被执行人'],
+  ['judgment_debtor', '被执行人'],
+  ['consumption_restriction', '限制高消费'],
+  ['serious_violation', '严重违法'],
+  ['tax_violation', '税收违法'],
+  ['administrative_penalty', '行政处罚'],
+  ['bankruptcy_reorganization', '破产重整'],
+  ['terminated_case', '终本案件'],
+  ['equity_freeze', '股权冻结'],
+  ['tax_arrears', '欠税公告'],
+  ['operating_exception', '经营异常'],
+].map(Object.freeze));
+
+export const RELATED_RISK_KEY_FACTORS = Object.freeze([
+  ['dishonest', '失信被执行人'],
+  ['serious_violation', '严重违法'],
+  ['bankruptcy_reorganization', '破产重整'],
+  ['tax_violation', '税收违法'],
+  ['judgment_debtor', '被执行人'],
+  ['terminated_case', '终本案件'],
+  ['equity_freeze', '股权冻结'],
+].map(Object.freeze));
+
+export const RISK_FACTOR_CATALOG_VERSION = 'qcc-risk-snapshot-2026-09-05';
+
+export const QCC_FIELD_CATALOG = Object.freeze([
+  group('company_registration', '企业工商信息', 'get_company_registration_info', [
+    field('company_name', '企业名称', { inputAnchor: true, defaultSelected: true }),
+    field('credit_no', '统一社会信用代码', { inputAnchor: true, defaultSelected: true }),
+    field('reg_no', '注册号', { inputAnchor: true }),
+    field('org_no', '组织机构代码'),
+    field('tax_no', '纳税人识别号'),
+    field('reg_status', '登记状态', { defaultSelected: true }),
+    field('legal_rep', '法定代表人', { defaultSelected: true }),
+    field('reg_capital', '注册资本', { defaultSelected: true }),
+    field('paid_capital', '实缴资本'),
+    field('establish_date', '成立日期', { defaultSelected: true }),
+    field('company_type', '企业类型'),
+    field('approval_date', '核准日期'),
+    field('registration_authority', '登记机关'),
+    field('taxpayer_qualification', '纳税人资质'),
+    field('payment_line_no', '支付系统行号'),
+    field('import_export_company_code', '进出口企业代码'),
+    field('short_name', '企业简称'),
+    field('english_name', '英文名'),
+    field('registered_address', '注册地址', { defaultSelected: true }),
+    field('mailing_address', '通信地址'),
+    field('region', '所属地区', { matchAuxiliary: true }),
+    field('business_scope', '经营范围'),
+    field('industry_category', '国标行业'),
+    field('operating_period', '营业期限'),
+    field('company_size', '人员规模'),
+    field('insured_count', '参保人数'),
+    field('branch_insured_count', '分支机构参保人数'),
+  ], { releaseBatch: 'current' }),
+  group('company_profile', '企业简介', 'get_company_profile', [
+    field('qcc_industry', '企查查行业'),
+    field('company_profile', '企业简介'),
+    field('industry_chain_overview', '产业链概览'),
+  ], { releaseBatch: 'current' }),
+  group('contact_info', '联系方式', 'get_contact_info', [
+    field('contact_preferred_phone', '首选联系电话'),
+    field('contact_phone_invalid_flag', '首选电话无效标记'),
+    field('contact_phone_tags', '首选电话标签'),
+    field('contact_preferred_email', '首选邮箱'),
+    field('contact_official_website', '官方网站'),
+    field('contact_official_website_icp', '官网 ICP 备案'),
+  ], { releaseBatch: 'batch-1' }),
+  group('listing_info', '上市信息', 'get_listing_info', [
+    field('listing_date', '上市日期'),
+    field('listing_short_name', '股票简称'),
+    field('listing_stock_code', '股票代码'),
+    field('listing_exchange', '上市交易所'),
+    field('listing_board', '上市板块'),
+    field('listing_former_short_name', '上市曾用名'),
+    field('listing_total_market_value', '总市值'),
+    field('listing_total_shares', '总股本'),
+    field('listing_predicted_pe', '预测市盈率'),
+    field('listing_float_market_value', '流通值'),
+    field('listing_float_shares', '流通股'),
+    field('listing_pb_ratio', '市净率'),
+    field('listing_eps', 'EPS'),
+    field('listing_voting_rights_difference', '表决权差异'),
+    field('listing_registration_based', '是否注册制'),
+  ], { releaseBatch: 'batch-1', selectionNote: '首个 A 股或红筹证券快照' }),
+  group('tax_invoice_info', '税务开票信息', 'get_tax_invoice_info', [
+    field('tax_company_name', '税务主体名称'),
+    field('tax_identification_no', '税务纳税人识别号'),
+    field('tax_company_type', '税务企业类型'),
+    field('tax_business_status', '税务经营状态'),
+    field('invoice_address', '开票地址'),
+    field('invoice_phone', '开票联系电话'),
+    field('invoice_bank', '开户行'),
+    field('invoice_bank_account', '开户行账号'),
+  ], { releaseBatch: 'batch-1' }),
+  group('import_export_credit', '进出口信用', 'get_import_export_credit', [
+    field('import_export_credit_no', '进出口统一社会信用代码'),
+    field('import_export_customs', '所在地海关'),
+    field('import_export_admin_division', '进出口行政区划'),
+    field('import_export_address', '进出口备案地址'),
+    field('import_export_economic_area', '经济区划'),
+    field('import_export_trade_type', '经营类别'),
+    field('import_export_statistical_economic_area', '统计经济区划'),
+    field('import_export_industry', '进出口行业种类'),
+    field('import_export_ecommerce_type', '跨境贸易电子商务类型'),
+    field('import_export_credit_grade', '海关信用等级'),
+    field('import_export_filing_date', '进出口备案日期'),
+  ], { releaseBatch: 'batch-1' }),
+  group('company_risk_scan', '企业自身风险扫描', 'get_company_risk_scan', [
+    field('risk_recorded_factor_count', '风险有记录因子数'),
+    field('risk_no_record_factor_count', '风险无记录因子数'),
+    field('risk_hit_summary', '企业自身风险命中摘要'),
+    ...SELF_RISK_FACTORS.map(([id, label]) => field(`risk_${id}_count`, `${label}条目数`)),
+  ], { releaseBatch: 'batch-2', catalogVersion: RISK_FACTOR_CATALOG_VERSION }),
+  group('company_related_risk_scan', '企业关联风险扫描', 'get_company_related_risk_scan', [
+    field('related_risk_party_count', '有风险关联方数'),
+    field('related_risk_summary', '企业关联风险摘要'),
+    ...RELATED_RISK_FACTORS.map(([id, label]) => field(`related_risk_${id}_count`, `关联风险-${label}条目数`)),
+    ...RELATED_RISK_KEY_FACTORS.map(([id, label]) => field(`related_risk_${id}_party_count`, `关联风险-${label}命中关联方数`)),
+  ], { releaseBatch: 'batch-2', catalogVersion: RISK_FACTOR_CATALOG_VERSION }),
+]);
+
+export const QCC_FIELD_SOURCE_TOOL = Object.freeze(Object.fromEntries(
+  QCC_FIELD_CATALOG.flatMap((entry) => entry.fields.map((item) => [item.id, entry.sourceTool])),
+));
+
+export function selectedSourceTools(fieldSelection, fallbackFields = []) {
+  const fields = Array.isArray(fieldSelection) && fieldSelection.length ? fieldSelection : fallbackFields;
+  return [...new Set(fields.map((id) => QCC_FIELD_SOURCE_TOOL[String(id)]).filter(Boolean))];
+}

package/lib/qcc-safety.js

@@ -63,7 +63,11 @@ export function redactSensitive(value, options = {}) {
 
 export function safeAuditEvent(event) {
   const source = event && typeof event === 'object' ? event : {};
-  return {
+  const safeCatalogLabels = (value) => (Array.isArray(value) ? value : [])
+    .slice(0, 64)
+    .map((item) => redactSensitiveText(String(item ?? '')).slice(0, 128))
+    .filter(Boolean);
+  const safe = {
     at: String(source.at ?? new Date().toISOString()),
     event: 'qcc-tool-call',
     toolName: String(source.toolName ?? ''),
@@ -74,4 +78,10 @@ export function safeAuditEvent(event) {
     upstreamCode: source.upstreamCode ? String(source.upstreamCode) : null,
     durationMs: Math.max(0, Number(source.durationMs ?? 0)),
   };
+  if (source.catalogVersion || Array.isArray(source.missing) || Array.isArray(source.unknown)) {
+    safe.catalogVersion = source.catalogVersion ? String(source.catalogVersion).slice(0, 64) : null;
+    safe.missing = safeCatalogLabels(source.missing);
+    safe.unknown = safeCatalogLabels(source.unknown);
+  }
+  return safe;
 }