dsh-enterprise-knowledge-steward 0.0.0-stage → 1.0.0

package/.env.example

@@ -0,0 +1,5 @@
+# 复制为本目录下的 .env 后填写（不要提交真密码）
+KMS_BASE=http://cgzhdn.shudaodsj.com:50004
+KMS_USERNAME=
+KMS_PASSWORD=
+ZHDN_BASE=http://cgzhdn.shudaodsj.com:50005

package/README.md

@@ -1,3 +1,57 @@
-# Temporary Holding Version
+# 企业知识管家（DeepSeek Harness 插件）
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+制度与知识问答、清分数据、人员任职与信访台账。
+
+包名：`dsh-enterprise-knowledge-steward`
+
+## 安装（npm 包名拉取）
+
+桌面版：设置 → 插件 → 安装框填入包名：
+
+```
+dsh-enterprise-knowledge-steward
+```
+
+CLI：
+
+```bash
+# 桌面版 profile
+dsh plugin --profile desktop add dsh-enterprise-knowledge-steward
+
+# Web profile
+dsh plugin --profile web add dsh-enterprise-knowledge-steward
+
+# 终端 TUI（按本机实际 profile 名）
+dsh plugin --profile dsh-tui add dsh-enterprise-knowledge-steward
+```
+
+无全局 `dsh` 时可用：
+
+```bash
+npx @deepseek-ai/dsh plugin --profile desktop add dsh-enterprise-knowledge-steward
+```
+
+安装后**完全退出再打开** DSH。
+
+## 配置账密
+
+在插件安装目录复制 `.env.example` 为 `.env`，填写：
+
+```
+KMS_USERNAME=你的账号
+KMS_PASSWORD=你的密码
+```
+
+只需一套 50004（KMS）账密；`KMS_BASE` / `ZHDN_BASE` 一般不用改。**不要把 `.env` 提交或发布到 npm。**
+
+## 使用
+
+打开对话直接提问，例如「查一下人员任职台账」「川高公司收费清分管理办法」。
+也可点名工具：`ledger_personnel`、`zhdn_ask`、`knowledge_list` 等。
+
+## 本地目录 / tgz（可选）
+
+```bash
+dsh plugin --profile desktop add ./企业知识管家-dsh-plugin
+dsh plugin --profile desktop add ./dsh-enterprise-knowledge-steward-1.0.0.tgz
+```

package/cordis.patch.yml

@@ -0,0 +1,3 @@
+- insert:
+    - id: enterprise-knowledge-steward
+      name: dsh-enterprise-knowledge-steward

package/index.js

@@ -0,0 +1,253 @@
+import { defineTool } from '@deepseek-ai/dsh-tools'
+import { loadDotEnv } from './lib/env.js'
+import {
+  doLogin,
+  clearLogin,
+  ledgerPersonnel,
+  ledgerPetition,
+  ledgerYangguan,
+  ledgerJianshe,
+  zhdnAsk,
+  knowledgeList,
+} from './lib/api.js'
+
+export const name = 'enterprise-knowledge-steward'
+export const inject = ['tools']
+
+const textOut = {
+  schema: {
+    type: 'object',
+    additionalProperties: false,
+    properties: {
+      ok: { type: 'boolean', required: true },
+      summary: { type: 'string', required: true },
+      data: { type: 'object', additionalProperties: true },
+    },
+  },
+  render(_args, value) {
+    return [{ type: 'text', text: value.summary }]
+  },
+}
+
+function summarizeJson(obj, max = 3500) {
+  const s = typeof obj === 'string' ? obj : JSON.stringify(obj, null, 2)
+  if (s.length <= max) return s
+  return s.slice(0, max) + '\n…(已截断)'
+}
+
+function okResult(summary, data) {
+  return { ok: true, summary, data: data || {} }
+}
+
+function errResult(e) {
+  return {
+    ok: false,
+    summary: `失败：${e && e.message ? e.message : String(e)}`,
+    data: { code: (e && e.code) || 'ERROR' },
+  }
+}
+
+export function apply(ctx) {
+  loadDotEnv()
+
+  ctx.tools.register(
+    defineTool({
+      name: 'kms_login',
+      description: '登录企业知识管家（自动缓存；台账与问答前可先调用；force=true 强制重新登录）',
+      parameters: {
+        force: { type: 'boolean', description: '是否强制重新登录' },
+        clear: { type: 'boolean', description: '为 true 时仅清除本地登录缓存' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          if (args.clear) {
+            const r = await clearLogin()
+            return okResult('已清除登录缓存', r)
+          }
+          const r = await doLogin(!!args.force)
+          return okResult(`登录成功，用户 ${r.user}`, r)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: () => ({ card: 'generic', title: '登录企业知识管家', kind: 'other' }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'ledger_personnel',
+      description: '查询人员任职台账（分页，可选关键词）',
+      parameters: {
+        page: { type: 'integer', description: '页码，默认 1' },
+        page_size: { type: 'integer', description: '每页条数，默认 10' },
+        keyword: { type: 'string', description: '关键词' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const body = await ledgerPersonnel({
+            page: args.page || 1,
+            page_size: args.page_size || 10,
+            keyword: args.keyword || '',
+          })
+          const total = body?.data?.total ?? body?.total ?? ''
+          return okResult(`人员任职台账查询完成${total !== '' ? `（total=${total}）` : ''}\n` + summarizeJson(body), body)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: (args) => ({
+        card: 'generic',
+        title: '人员任职台账',
+        kind: 'other',
+        rawInput: args,
+      }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'ledger_petition',
+      description: '查询信访台账（分页，可选关键词）',
+      parameters: {
+        page: { type: 'integer', description: '页码，默认 1' },
+        per_page: { type: 'integer', description: '每页条数，默认 10' },
+        keyword: { type: 'string', description: '关键词' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const body = await ledgerPetition({
+            page: args.page || 1,
+            per_page: args.per_page || 10,
+            keyword: args.keyword || '',
+          })
+          const total = body?.data?.total ?? body?.total ?? ''
+          return okResult(`信访台账查询完成${total !== '' ? `（total=${total}）` : ''}\n` + summarizeJson(body), body)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: (args) => ({
+        card: 'generic',
+        title: '信访台账',
+        kind: 'other',
+        rawInput: args,
+      }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'ledger_yangguan',
+      description: '养管相关查询',
+      parameters: {
+        question: { type: 'string', required: true, description: '养管问题' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const body = await ledgerYangguan(args.question)
+          return okResult('养管查询完成\n' + summarizeJson(body), body)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: () => ({ card: 'generic', title: '养管查询', kind: 'other' }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'ledger_jianshe',
+      description: '建设智达相关分析查询',
+      parameters: {
+        question: { type: 'string', required: true, description: '建设问题' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const body = await ledgerJianshe(args.question)
+          return okResult('建设查询完成\n' + summarizeJson(body), body)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: () => ({ card: 'generic', title: '建设查询', kind: 'other' }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'zhdn_ask',
+      description:
+        '智能问答：制度/知识库、清分数据、服务区、养管月报等。按问题内容自动分流。若返回「网络原因暂时无法服务」属后端下游问题，须原文转述用户。',
+      parameters: {
+        question: { type: 'string', required: true, description: '用户问题' },
+        hint: {
+          type: 'string',
+          description: '可选提示：knowledge_qa | sqlbot | service_area | yhpt',
+        },
+        session_id: { type: 'string', description: '会话 id（可选）' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const r = await zhdnAsk({
+            question: args.question,
+            hint: args.hint || '',
+            session_id: args.session_id || '',
+          })
+          const refs = Array.isArray(r.reference_docs) ? r.reference_docs.length : 0
+          const head = r.type ? `[${r.type}] ` : ''
+          const tail = refs ? `\n（参考资料 ${refs} 篇）` : ''
+          return okResult(head + (r.answer || '(空回答)') + tail, r)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: (args) => ({
+        card: 'generic',
+        title: '智能问答',
+        kind: 'other',
+        rawInput: { question: args.question },
+      }),
+    }),
+  )
+
+  ctx.tools.register(
+    defineTool({
+      name: 'knowledge_list',
+      description: '检索知识库条目列表（文档标题/摘要），用于确认知识库是否有相关制度文档',
+      parameters: {
+        query: { type: 'string', description: '检索关键词' },
+        page: { type: 'integer', description: '页码' },
+        per_page: { type: 'integer', description: '每页条数' },
+      },
+      output: textOut,
+      async execute(args) {
+        try {
+          const r = await knowledgeList({
+            query: args.query || '',
+            page: args.page || 1,
+            per_page: args.per_page || 10,
+          })
+          const lines = (r.items || []).slice(0, 20).map((it, i) => `${i + 1}. ${it.name} (kb=${it.kb_id}, id=${it.id})`)
+          const summary =
+            `知识条目 ${r.total} 条` + (lines.length ? `\n` + lines.join('\n') : '\n（无命中）')
+          return okResult(summary, r)
+        } catch (e) {
+          return errResult(e)
+        }
+      },
+      presentCall: (args) => ({
+        card: 'generic',
+        title: '知识库条目',
+        kind: 'other',
+        rawInput: args,
+      }),
+    }),
+  )
+}

package/lib/api.js

@@ -0,0 +1,192 @@
+import { baseUrl, kmsBaseUrl, kmsCredentials, clearAllTokens } from './env.js'
+import { kmsLoginFull, login, withAuth, withKmsAuth } from './auth.js'
+
+export async function doLogin(force = false) {
+  const full = await kmsLoginFull(!!force)
+  const qa = await login(!!force)
+  const { username } = kmsCredentials()
+  return {
+    ok: true,
+    user: full.username || username || '',
+    kms_base: kmsBaseUrl(),
+    zhdn_base: baseUrl(),
+    kms_access_len: full.accessToken.length,
+    qa_token_len: qa.length,
+  }
+}
+
+export async function clearLogin() {
+  clearAllTokens()
+  return { ok: true, cleared: true }
+}
+
+async function kmsGet(pathOrUrl) {
+  const base = kmsBaseUrl()
+  const url = pathOrUrl.startsWith('http')
+    ? pathOrUrl
+    : base + (pathOrUrl.startsWith('/') ? pathOrUrl : '/' + pathOrUrl)
+  const res = await withKmsAuth((headers) =>
+    fetch(url, { method: 'GET', headers: { ...headers, Accept: 'application/json' } }),
+  )
+  const text = await res.text()
+  let body
+  try {
+    body = JSON.parse(text)
+  } catch {
+    const err = new Error(`台账返回非 JSON HTTP ${res.status}`)
+    err.code = 'KMS_BAD_JSON'
+    throw err
+  }
+  return body
+}
+
+async function kmsPost(pathOrUrl, payload) {
+  const base = kmsBaseUrl()
+  const url = pathOrUrl.startsWith('http')
+    ? pathOrUrl
+    : base + (pathOrUrl.startsWith('/') ? pathOrUrl : '/' + pathOrUrl)
+  const res = await withKmsAuth((headers) =>
+    fetch(url, {
+      method: 'POST',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
+      body: JSON.stringify(payload || {}),
+    }),
+  )
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    const err = new Error(`台账返回非 JSON HTTP ${res.status}`)
+    err.code = 'KMS_BAD_JSON'
+    throw err
+  }
+}
+
+export async function ledgerPersonnel({ page = 1, page_size = 10, keyword = '' } = {}) {
+  const qs = new URLSearchParams({ page: String(page), page_size: String(page_size) })
+  if (keyword) qs.set('keyword', keyword)
+  return kmsGet(`/api/rytz/personnel?${qs.toString()}`)
+}
+
+export async function ledgerPetition({ page = 1, per_page = 10, keyword = '' } = {}) {
+  const qs = new URLSearchParams({ page: String(page), per_page: String(per_page) })
+  if (keyword) qs.set('keyword', keyword)
+  return kmsGet(`/api/project/xftz?${qs.toString()}`)
+}
+
+export async function ledgerYangguan(question) {
+  return kmsPost('/api/project/yh/query', { question })
+}
+
+export async function ledgerJianshe(question) {
+  return kmsPost('/api/project/jgpt/analysis', { question })
+}
+
+export async function zhdnAsk({ question, hint = '', session_id = '' } = {}) {
+  if (!question || !String(question).trim()) {
+    const err = new Error('question 不能为空')
+    err.code = 'BAD_ARGS'
+    throw err
+  }
+  const form = new FormData()
+  form.append('question', String(question).trim())
+  if (session_id) form.append('session_id', session_id)
+
+  const url = `${baseUrl()}/api/agentic_router/chat`
+  const res = await withAuth((headers) => fetch(url, { method: 'POST', headers, body: form }))
+  const body = await res.json().catch(() => ({}))
+  if (!res.ok || body.code !== 0) {
+    const err = new Error(
+      `问答失败 HTTP ${res.status} code=${body.code} msg=${body.message || ''}`,
+    )
+    err.code = 'AGENTIC_FAILED'
+    throw err
+  }
+  const data = body.data || {}
+  const result = data.result || {}
+  const answer =
+    result.answer ||
+    result.content ||
+    (typeof result === 'string' ? result : '') ||
+    body.message ||
+    ''
+  return {
+    type: data.type || '',
+    hint: hint || undefined,
+    answer,
+    session_id: result.session_id || '',
+    reference_docs: result.reference_docs || [],
+    message: body.message || '',
+  }
+}
+
+async function kmsReq(method, p, body) {
+  const url = kmsBaseUrl() + p
+  const res = await withKmsAuth((h) =>
+    fetch(url, {
+      method,
+      headers: {
+        ...h,
+        Accept: 'application/json',
+        ...(body ? { 'Content-Type': 'application/json' } : {}),
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    }),
+  )
+  const text = await res.text()
+  try {
+    return JSON.parse(text)
+  } catch {
+    return { code: res.status, message: text.slice(0, 200) }
+  }
+}
+
+async function listAccessibleKbIds() {
+  const ids = new Set()
+  const mgmt = await kmsReq('GET', '/api/v1/knowledge_base/management?page=1&per_page=100')
+  if (mgmt && mgmt.data) {
+    if (Array.isArray(mgmt.data.items)) {
+      for (const it of mgmt.data.items) if (it && it.id != null) ids.add(Number(it.id))
+    } else if (mgmt.data.id != null) {
+      ids.add(Number(mgmt.data.id))
+    }
+  }
+  const list = await kmsReq('GET', '/api/v1/knowledge_base/list?page=1&per_page=100')
+  if (list && list.data && Array.isArray(list.data.items)) {
+    for (const it of list.data.items) if (it && it.id != null) ids.add(Number(it.id))
+  }
+  if (ids.size === 0) ids.add(1)
+  return [...ids]
+}
+
+export async function knowledgeList({ query = '', page = 1, per_page = 10 } = {}) {
+  const kbIds = await listAccessibleKbIds()
+  const hits = []
+  for (const kbId of kbIds) {
+    const body = await kmsReq('POST', '/api/v1/knowledge_item/knowledge_list', {
+      kb_id: kbId,
+      query_cate: 1,
+      query: query || '',
+      page: Number(page) || 1,
+      per_page: Number(per_page) || 10,
+      sort: 'update_time',
+      revert: 'descend',
+    })
+    const items = (body && body.data && body.data.items) || []
+    for (const it of items) {
+      hits.push({
+        kb_id: kbId,
+        id: it.id,
+        name: it.name || it.title || '',
+        abstract: it.abstract || '',
+        update_time: it.update_time || '',
+        department: it.department || '',
+      })
+    }
+  }
+  return { total: hits.length, items: hits }
+}

package/lib/auth.js

@@ -0,0 +1,183 @@
+import crypto from 'node:crypto'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import {
+  PLUGIN_ROOT,
+  TOKEN_KMS_PATH,
+  TOKEN_QA_PATH,
+  baseUrl,
+  kmsBaseUrl,
+  kmsCredentials,
+  readTokenFile,
+  tokenStillValid,
+  readCachedToken,
+  writeCachedToken,
+  clearCachedToken,
+  ensureEnv,
+} from './env.js'
+
+const require = createRequire(import.meta.url)
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+
+function loadSm2() {
+  try {
+    return require('sm-crypto').sm2
+  } catch {
+    try {
+      return require(path.join(PLUGIN_ROOT, 'node_modules', 'sm-crypto')).sm2
+    } catch {
+      const err = new Error('缺少 sm-crypto：请在插件目录执行 npm install')
+      err.code = 'NO_SM_CRYPTO'
+      throw err
+    }
+  }
+}
+
+/** Full KMS login → { accessToken, ucToken, username } */
+export async function kmsLoginFull(force = false) {
+  ensureEnv()
+  if (!force) {
+    const raw = readTokenFile(TOKEN_KMS_PATH)
+    if (raw && raw.token && tokenStillValid(raw.token) && raw.user_center_access_token) {
+      return {
+        accessToken: raw.token,
+        ucToken: raw.user_center_access_token,
+        username: raw.username || '',
+      }
+    }
+  }
+
+  const { username, password } = kmsCredentials()
+  if (!username || !password) {
+    const err = new Error('未配置账号：请在插件目录 .env 填写 KMS_USERNAME / KMS_PASSWORD')
+    err.code = 'NO_KMS_CREDENTIALS'
+    throw err
+  }
+
+  const pkRes = await fetch(`${kmsBaseUrl()}/api/search_pangu/get_public_key`, {
+    headers: { Accept: 'application/json' },
+  })
+  const pkBody = await pkRes.json().catch(() => ({}))
+  let pub = pkBody && pkBody.data
+  if (!pub) {
+    const err = new Error(`获取公钥失败 HTTP ${pkRes.status}`)
+    err.code = 'KMS_LOGIN_FAILED'
+    throw err
+  }
+  if (!String(pub).startsWith('04')) pub = '04' + pub
+
+  const digest = crypto.createHash('md5').update(String(password), 'utf8').digest('hex')
+  const sm2 = loadSm2()
+  const enc = sm2.doEncrypt(digest, pub, 1)
+
+  const loginRes = await fetch(`${kmsBaseUrl()}/api/search_pangu/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({ username, password: enc }),
+  })
+  const loginBody = await loginRes.json().catch(() => ({}))
+  const data = (loginBody && loginBody.data) || {}
+  const accessToken = data.access_token || data.token
+  const ucToken = data.user_center_access_token || data.userCenterAccessToken
+  if (!accessToken) {
+    const err = new Error(
+      `登录失败 HTTP ${loginRes.status} code=${loginBody.code} msg=${loginBody.message || ''}`,
+    )
+    err.code = 'KMS_LOGIN_FAILED'
+    throw err
+  }
+  if (!ucToken) {
+    const err = new Error('登录成功但缺少 user_center_access_token')
+    err.code = 'KMS_LOGIN_FAILED'
+    throw err
+  }
+
+  writeCachedToken(TOKEN_KMS_PATH, accessToken, {
+    username,
+    user_center_access_token: ucToken,
+  })
+  return { accessToken, ucToken, username }
+}
+
+export async function kmsLogin(force = false) {
+  const full = await kmsLoginFull(!!force)
+  return full.accessToken
+}
+
+export async function exchangeQaToken(ucToken) {
+  const url = `${baseUrl()}/api/admin/user/self`
+  const res = await fetch(url, {
+    method: 'GET',
+    headers: { Authorization: ucToken, Accept: 'application/json' },
+  })
+  const body = await res.json().catch(() => ({}))
+  if (!res.ok || body.code !== 0) {
+    const err = new Error(
+      `会话交换失败 HTTP ${res.status} code=${body.code} msg=${body.message || ''}`,
+    )
+    err.code = 'QA_EXCHANGE_FAILED'
+    throw err
+  }
+  const t = body.data && body.data.token
+  if (typeof t === 'string' && t.length > 20) {
+    return { qaToken: t, source: 'self.data.token', user: body.data }
+  }
+  return { qaToken: ucToken, source: 'user_center_access_token', user: body.data }
+}
+
+export async function login(force = false) {
+  if (!force) {
+    const cached = readCachedToken(TOKEN_QA_PATH)
+    if (cached) return cached
+  }
+  const { ucToken, username } = await kmsLoginFull(!!force)
+  const { qaToken, source } = await exchangeQaToken(ucToken)
+  writeCachedToken(TOKEN_QA_PATH, qaToken, { username, source })
+  return qaToken
+}
+
+export async function authHeader(forceLogin = false) {
+  const token = await login(!!forceLogin)
+  return { Authorization: token }
+}
+
+export async function kmsAuthHeader(forceLogin = false) {
+  const token = await kmsLogin(!!forceLogin)
+  return { Authorization: 'Bearer ' + token }
+}
+
+export async function withAuth(doRequest) {
+  let headers = await authHeader(false)
+  let res = await doRequest(headers)
+  if (res.status === 401) {
+    clearCachedToken(TOKEN_QA_PATH)
+    clearCachedToken(TOKEN_KMS_PATH)
+    headers = await authHeader(true)
+    res = await doRequest(headers)
+  }
+  return res
+}
+
+export async function withKmsAuth(doRequest) {
+  let headers = await kmsAuthHeader(false)
+  let res = await doRequest(headers)
+  try {
+    const bodyText = await res.clone().text()
+    const j = JSON.parse(bodyText)
+    if (j && (j.code === 401 || j.status === 401)) {
+      clearCachedToken(TOKEN_KMS_PATH)
+      headers = await kmsAuthHeader(true)
+      res = await doRequest(headers)
+      return res
+    }
+  } catch {
+    /* ignore */
+  }
+  if (res.status === 401) {
+    clearCachedToken(TOKEN_KMS_PATH)
+    headers = await kmsAuthHeader(true)
+    res = await doRequest(headers)
+  }
+  return res
+}

package/lib/env.js

@@ -0,0 +1,121 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+export const PLUGIN_ROOT = path.resolve(__dirname, '..')
+export const ENV_PATH = path.join(PLUGIN_ROOT, '.env')
+export const TOKEN_QA_PATH = path.join(PLUGIN_ROOT, '.token-qa')
+export const TOKEN_KMS_PATH = path.join(PLUGIN_ROOT, '.token-kms')
+
+export const DEFAULT_BASE = 'http://cgzhdn.shudaodsj.com:50005'
+export const DEFAULT_KMS_BASE = 'http://cgzhdn.shudaodsj.com:50004'
+
+let loaded = false
+
+export function loadDotEnv(extraPath) {
+  const candidates = [extraPath, ENV_PATH, path.join(process.cwd(), '.env')].filter(Boolean)
+  for (const p of candidates) {
+    if (!p || !fs.existsSync(p)) continue
+    const text = fs.readFileSync(p, 'utf8')
+    for (const line of text.split(/\r?\n/)) {
+      const s = line.trim()
+      if (!s || s.startsWith('#')) continue
+      const i = s.indexOf('=')
+      if (i < 0) continue
+      const k = s.slice(0, i).trim()
+      let v = s.slice(i + 1).trim()
+      if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) {
+        v = v.slice(1, -1)
+      }
+      if (!(k in process.env) || process.env[k] === '') process.env[k] = v
+    }
+  }
+  loaded = true
+}
+
+export function ensureEnv() {
+  if (!loaded) loadDotEnv()
+}
+
+export function baseUrl() {
+  ensureEnv()
+  return (process.env.ZHDN_BASE || DEFAULT_BASE).replace(/\/$/, '')
+}
+
+export function kmsBaseUrl() {
+  ensureEnv()
+  return (
+    process.env.KMS_BASE ||
+    process.env.ZHDN_KMS_BASE ||
+    process.env.KMS_BASE_URL ||
+    DEFAULT_KMS_BASE
+  ).replace(/\/$/, '')
+}
+
+export function kmsCredentials() {
+  ensureEnv()
+  const username =
+    process.env.KMS_USERNAME ||
+    process.env.ZHDN_KMS_USERNAME ||
+    process.env.ZHDN_USERNAME ||
+    ''
+  const password = process.env.KMS_PASSWORD || process.env.ZHDN_KMS_PASSWORD || ''
+  return { username, password }
+}
+
+export function readTokenFile(filePath) {
+  try {
+    if (!fs.existsSync(filePath)) return null
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'))
+  } catch {
+    return null
+  }
+}
+
+export function tokenStillValid(token) {
+  if (!token || typeof token !== 'string') return false
+  try {
+    const parts = String(token).split('.')
+    if (parts.length >= 2) {
+      const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'))
+      if (payload.exp && Date.now() / 1000 > payload.exp - 3600) return false
+    }
+    return true
+  } catch {
+    return true
+  }
+}
+
+export function readCachedToken(filePath) {
+  const raw = readTokenFile(filePath)
+  if (!raw || !raw.token) return null
+  if (!tokenStillValid(raw.token)) return null
+  return raw.token
+}
+
+export function writeCachedToken(filePath, token, meta) {
+  const data = {
+    token,
+    saved_at: new Date().toISOString(),
+    username: meta && meta.username ? meta.username : undefined,
+  }
+  if (meta && meta.user_center_access_token) {
+    data.user_center_access_token = meta.user_center_access_token
+  }
+  if (meta && meta.source) data.source = meta.source
+  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), { mode: 0o600 })
+}
+
+export function clearCachedToken(filePath) {
+  try {
+    if (fs.existsSync(filePath)) fs.unlinkSync(filePath)
+  } catch {
+    /* ignore */
+  }
+}
+
+export function clearAllTokens() {
+  clearCachedToken(TOKEN_QA_PATH)
+  clearCachedToken(TOKEN_KMS_PATH)
+}

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "dsh-enterprise-knowledge-steward",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "1.0.0",
+  "description": "企业知识管家：制度问答、清分数据、人员任职与信访台账",
+  "type": "module",
+  "main": "index.js",
+  "license": "UNLICENSED",
+  "files": [
+    "index.js",
+    "cordis.patch.yml",
+    "lib",
+    ".env.example",
+    "README.md"
+  ],
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    }
+  },
+  "engines": {
+    "dsh": ">=0.1.0-rc.0"
+  },
+  "dependencies": {
+    "sm-crypto": "^0.3.13"
+  },
+  "peerDependencies": {
+    "@deepseek-ai/dsh-tools": ">=0.1.0-rc.0",
+    "@deepseek-ai/cordis": "*"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "dsh-plugin",
+    "企业知识管家",
+    "deepseek-harness"
+  ]
+}