e10-data 0.1.17 → 0.1.20

package/bin/e10-data.mjs

@@ -1,1932 +1,2525 @@
-#!/usr/bin/env node
-// -*- coding: utf-8 -*-
-/**
- * e10-data CLI —— data-assistant 专家统一数据接口命令行（2026-09-03 扩展）
- *
- * 覆盖（数据查询链路全部家族；登录/HRM 复用 e10-login / hrm-cli，checkEbModulePermission 已废弃不提供）：
- *   e10-data login  xiaoe-env [--domain <url>]   **无凭据时**用环境变量 XIAOE_USER_TOKEN + XIAOE_DOMAIN
- *                   （XiaoE 全局 token）换 ETEAMSID 并落 profile（免浏览器/免 python；2026-09-17 移植）
- *   e10-data query    DSL 查询 executeQueryDsl（conn/model/schema/tableId/dslQuery/debug）
- *   e10-data ds     tables|fields|list|chart|stat|count   数据源（业务模块）取数与元数据
- *                   appId 一律由调用方显式传入（v0.1.14 起 CLI 不再自动反查）：
- *                   EB 建模表单（groupId=weaver-ebuilder-form-service）取数必须带 --app-id <id>，
- *                   该值只能来自 chat_bi_eb_config_map 的权限校验查询（同一次查询给出权限与 appId）；
- *                   不带 appId 时按原样发送，由后端报错（CLI 不做拦截）
- *   e10-data doc    count|list   文档查询 documentListCount / documentList
- *   e10-data noun   list         词库 getChatDocsBySkillKey
- *   e10-data field  id2name|name2id  关联字段翻译 testRemoteBrowser / complete
- *   e10-data conf   get|batch|batch-file|group|group-file|resolve|resolve-file|add|add-file|update|delete
- *                              环境参数配置中心（chatBi config map，替代 config-resolve 脚本 URL 直连；
- *                              confType=api 时支持 confGroup 分组二级定位，见 --group）
- *   e10-data attend statis     考勤假期余额统计 getAttendInfoStatis（hr-attendance 病假/事假，2026-09-07）
- *
- * 通用：--json 原样输出；复杂 JSON 参数支持 @文件 或 内联（中文走 @文件 更稳）
- * 认证：加解密全部由 e10-login 负责（本 CLI 不实现任何加解密）。凭据出口优先级：
- *   ① e10-login auth --json → ② e10-login whoami --json → ③ e10-login whoami（文本解析）
- *   → ④ 明文镜像 ~/.workbuddy/e10-login-cache.md（兜底，命中时告警）；均不可用时提示先 e10-login oidc 登录
- *   例外：`login xiaoe-env` 在"还没有任何凭据"时可独立完成登录（换 token 自己算，落 profile 仍交 e10-login）
- *
- * 用法示例：
- *   node e10-data.mjs query  --conn 1144919996804022272 --model dw --schema dw --dsl @q.json
- *   node e10-data.mjs ds count --group weaver-project-servicetask --table 715738355537494016
- *   node e10-data.mjs doc count --name 测试
- *   node e10-data.mjs noun list --skill rd-department
- *   node e10-data.mjs field id2name --module ebuilder/form --type ebuilder \
- *        --ids 3194494277170470571 --form-param '{"fieldId":"966849910772850766","module":"ebuilderform"}'
- */
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import crypto from "node:crypto";
-import net from "node:net";
-import { spawn, spawnSync } from "node:child_process";
-import { fileURLToPath } from "node:url";
-import { createRequire } from "node:module";
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-function cliVersion() {
-  try { return JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf-8")).version; }
-  catch { return "dev"; }
-}
-
-const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36";
-const EB_BIZ_ID = "10000000000000000";
-
-// ---------------- 认证（加解密全部交由 e10-login，本 CLI 不再实现任何加解密）----------------
-// 背景：auth 文件由 e10-login 自己的密钥体系加密 —— e10-login 1.5.0 起为「每机随机密钥 + OS keychain
-//   （@napi-rs/keyring，service=e10-cli / account=auth-key；keychain 不可用才落 ~/.e10-cli/.key）」，
-//   早期版本为固定 seed。**只有 e10-login 解得开**，所以本 CLI 只负责「向 e10-login 要明文凭据」，
-//   不再自行解密 —— e10-login 以后更换密钥体系 / 算法 / profile 机制，本 CLI 都无需改动。
-// 凭据出口优先级（命中即返回；命中的"模式名"会记入 ~/.e10-cli/.e10-data-auth-mode，只存模式、不存凭据）：
-//   ① e10-login auth --json      正式契约（推荐 e10-login 侧新增；一旦可用自动优先）
-//   ② e10-login whoami --json    其 JSON 输出带 cookies 字段时可用
-//   ③ e10-login whoami           文本输出解析（当前 e10-login 1.5.0 的实际可用路径）
-//   ④ ~/.workbuddy/e10-login-cache.md 明文镜像 —— 最后兜底，命中时打印告警（该文件可能已过期）
-// 环境变量：E10_DATA_AUTH_PROBE=1 强制重新探测优先级；E10_DATA_AUTH_MODE=<模式名> 手动指定；
-//   E10_DATA_QUIET=1 抑制告警输出（告警一律走 stderr，不污染 --json 的 stdout）。
-const AUTH_MODE_FILE = path.join(os.homedir(), ".e10-cli", ".e10-data-auth-mode");
-
-/** 定位当前 profile 的 auth 文件（仅用于"是否已登录"的判断与报错提示，本 CLI 不读其内容做解密） */
-function authFilePath() {
-  const home = os.homedir();
-  let profile = "default";
-  try {
-    const activeFile = path.join(home, ".e10-cli", "profile");
-    if (fs.existsSync(activeFile)) { const n = fs.readFileSync(activeFile, "utf-8").trim(); if (n) profile = n; }
-  } catch {}
-  return { profile, file: path.join(home, ".e10-cli", "profiles", profile, "auth") };
-}
-
-// ---------------- e10-login 入口解析（v0.1.17：去掉 shell:true，这是最大的性能改动）----------------
-// 背景（2026-09-20 实测）：`spawnSync("e10-login", …, { shell: true })` 在 Windows 上会先起一层
-//   cmd.exe；该层**单独**耗时 ~0.98~1.04s（杀软对每个新进程的实时扫描所致），而 e10-login 自身
-//   的活（读 profile + 解密 auth + 打印）只花 ~0.1s。改为「定位 e10-login 的 JS 入口，用
-//   process.execPath 直接拉起」后，实测 **1.0s → 0.22s**（每调用省 ~0.78s）。
-// ⚠️ 不能直接 spawn `e10-login.cmd`：Node ≥18.20/20.12 起为修 CVE-2024-27980，禁止在 shell:false
-//   下执行 .cmd/.bat（抛 EINVAL）。因此必须解析到 .cmd shim 背后**真正的 .js 入口**。
-// 解析顺序：① 环境变量 E10_LOGIN_ENTRY → ② Node 模块解析（与 e10-data 同 prefix 时命中）
-//   → ③ 沿 PATH 找 shim，再取 <shimDir>/node_modules/e10-login → ④ 常见全局前缀兜底。
-//   全部失败 → 返回 null，调用方退化回 shell:true（保持旧行为可用，只慢不错）。
-let _loginEntry;          // 进程内缓存解析结果；null 表示"已尝试但未找到"
-let _loginEntryDone = false;
-
-function resolveLoginEntry() {
-  if (_loginEntryDone) return _loginEntry;
-  _loginEntryDone = true;
-  const tried = [];
-  const isFile = (p) => { try { return !!p && fs.statSync(p).isFile(); } catch { return false; } };
-
-  /** 读 <dir>/package.json 的 bin 字段定位入口文件；非 e10-login 包返回 null */
-  const entryFromPkgDir = (dir) => {
-    try {
-      const pj = path.join(dir, "package.json");
-      if (!isFile(pj)) return null;
-      const j = JSON.parse(fs.readFileSync(pj, "utf-8"));
-      if (j.name !== "e10-login") return null;
-      let b = j.bin;
-      if (typeof b === "string") b = { "e10-login": b };
-      const rel = b && b["e10-login"];
-      if (!rel) return null;
-      const entry = path.resolve(dir, rel);
-      return isFile(entry) ? entry : null;
-    } catch { return null; }
-  };
-
-  // ① 环境变量显式指定（排障与特殊安装方式用）
-  const envEntry = (process.env.E10_LOGIN_ENTRY || "").trim();
-  if (envEntry) {
-    if (isFile(envEntry)) { _loginEntry = envEntry; return _loginEntry; }
-    tried.push("E10_LOGIN_ENTRY 指向的文件不存在: " + envEntry);
-  }
-
-  // ② Node 模块解析（e10-data 与 e10-login 装在同一个 prefix 时命中）
-  try {
-    const pj = createRequire(import.meta.url).resolve("e10-login/package.json");
-    const e = entryFromPkgDir(path.dirname(pj));
-    if (e) { _loginEntry = e; return _loginEntry; }
-    tried.push("模块解析命中 " + pj + " 但 bin 入口不可用");
-  } catch (e) { tried.push("模块解析: " + ((e && e.message) || e)); }
-
-  // ③ 沿 PATH 找 shim，再取 shim 同级的 node_modules/e10-login
-  //    （npm 全局安装的常规布局：<prefix>/e10-login.cmd + <prefix>/node_modules/e10-login）
-  const pathDirs = String(process.env.PATH || "").split(path.delimiter).filter(Boolean);
-  const shimNames = process.platform === "win32"
-    ? ["e10-login.cmd", "e10-login.exe", "e10-login"]
-    : ["e10-login"];
-  for (const d of pathDirs) {
-    for (const n of shimNames) {
-      const shim = path.join(d, n);
-      if (!isFile(shim)) continue;
-      const e = entryFromPkgDir(path.join(d, "node_modules", "e10-login"));
-      if (e) { _loginEntry = e; return _loginEntry; }
-      tried.push("找到 shim " + shim + "，但其同级 node_modules/e10-login 不可用");
-    }
-  }
-
-  // ④ 常见全局前缀兜底
-  const home = os.homedir();
-  const prefixes = [
-    path.join(path.dirname(process.execPath), "node_modules"),
-    path.join(path.dirname(process.execPath), "..", "lib", "node_modules"),
-    path.join(home, ".npm-global", "lib", "node_modules"),
-    process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules") : null,
-    process.env.ProgramFiles ? path.join(process.env.ProgramFiles, "nodejs", "node_modules") : null,
-  ].filter(Boolean);
-  for (const p of prefixes) {
-    const e = entryFromPkgDir(path.join(p, "e10-login"));
-    if (e) { _loginEntry = e; return _loginEntry; }
-  }
-  tried.push("常见全局前缀均未命中: " + prefixes.join(" | "));
-
-  if (!process.env.E10_DATA_QUIET) {
-    console.error("[e10-data][warn] 未定位到 e10-login 的 JS 入口，本次退化为 shell 调用（较慢，且 Windows 上多花约 1 秒）。"
-      + "可用 E10_LOGIN_ENTRY=<e10-login/bin/e10-login.js 绝对路径> 显式指定。诊断：" + tried.join(" ｜ "));
-  }
-  _loginEntry = null;
-  return null;
-}
-
-let lastLoginDiag = "";
-/** 底层调用 e10-login，返回 spawnSync 结果（供需要看 stderr/status 的调用方使用）。
- *  优先 shell:false 直连 JS 入口；解析失败才退化为 shell:true。 */
-function spawnLoginCli(args, timeout = 20000) {
-  const entry = resolveLoginEntry();
-  if (entry) return spawnSync(process.execPath, [entry, ...args], { encoding: "utf-8", timeout, windowsHide: true });
-  return spawnSync("e10-login", args, { shell: true, encoding: "utf-8", timeout, windowsHide: true });
-}
-
-/** 调用 e10-login（凭据的唯一来源）；失败返回 null，并把诊断信息留在 lastLoginDiag */
-function runLoginCli(args) {
-  try {
-    const r = spawnLoginCli(args);
-    const out = (r.stdout || "").trim();
-    if (r.error || r.status !== 0) {
-      lastLoginDiag = ((r.stderr || "") + out).trim().split(/\r?\n/).slice(0, 2).join(" / ") || (r.error ? String(r.error.message) : "exit=" + r.status);
-      return null;
-    }
-    return out || null;
-  } catch (e) { lastLoginDiag = String((e && e.message) || e); return null; }
-}
-
-/** 归一化 + 校验（缺 baseUrl / eteamsid / cookie 一律视为该出口不可用，继续下一个出口） */
-function normalizeAuth(o) {
-  if (!o) return null;
-  const baseUrl = String(o.baseUrl || "").trim().replace(/\/+$/, "");
-  const eteamsid = String(o.eteamsid || "").trim();
-  const cookie = String(o.cookie || "").trim();
-  if (!baseUrl || !eteamsid || !cookie) return null;
-  if (/^\((未知|空)\)$/.test(eteamsid) || /^\((未知|空)\)$/.test(cookie)) return null;
-  return { baseUrl, eteamsid, cookie, userId: String(o.userId || "").trim(), tenantKey: String(o.tenantKey || "").trim(), source: o.source };
-}
-
-/** ① e10-login auth --json（正式契约：{v,baseUrl,eteamsId,cookie,userAgent,userId,tenantKey,agentType,profile}） */
-function providerAuthJson() {
-  const out = runLoginCli(["auth", "--json"]);
-  if (!out) return null;
-  let j; try { j = JSON.parse(out); } catch { return null; }
-  if (!j || typeof j !== "object" || Array.isArray(j)) return null;
-  return normalizeAuth({
-    baseUrl: j.baseUrl || j.base_url,
-    eteamsid: j.eteamsId || j.eteamsid,
-    cookie: typeof j.cookie === "string" ? j.cookie : "",
-    userId: j.userId || j.employeeId,
-    tenantKey: j.tenantKey,
-    source: "e10-login auth --json",
-  });
-}
-
-/** ② e10-login whoami --json（需其 JSON 带 cookies 字符串；当前 1.5.0 未带 → 自动落到 ③） */
-function providerWhoamiJson() {
-  const out = runLoginCli(["whoami", "--json"]);
-  if (!out) return null;
-  let j; try { j = JSON.parse(out); } catch { return null; }
-  if (!j || typeof j !== "object" || Array.isArray(j)) return null;
-  const cookie = typeof j.cookies === "string" ? j.cookies : (typeof j.cookie === "string" ? j.cookie : "");
-  return normalizeAuth({
-    baseUrl: j.baseUrl,
-    eteamsid: j.eteamsId || j.eteamsid,
-    cookie,
-    userId: j.employeeId || j.userId,
-    tenantKey: j.tenantKey,
-    source: "e10-login whoami --json",
-  });
-}
-
-/** ③ e10-login whoami（文本输出解析：employeeId / tenantKey / baseUrl / ETEAMSID / cookies / User-Agent） */
-function providerWhoamiText() {
-  const out = runLoginCli(["whoami"]);
-  if (!out) return null;
-  const m = {};
-  for (const line of out.split(/\r?\n/)) {
-    const x = line.match(/^\s*([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.+?)\s*$/);
-    if (x) m[x[1].toLowerCase()] = x[2];
-  }
-  return normalizeAuth({
-    baseUrl: m["baseurl"],
-    eteamsid: m["eteamsid"],
-    cookie: m["cookies"],
-    userId: m["employeeid"] || m["userid"],
-    tenantKey: m["tenantkey"],
-    source: "e10-login whoami（文本）",
-  });
-}
-
-/** ④ 明文镜像（最后兜底：不涉及任何解密，但可能已过期 → 命中时告警） */
-function providerCacheMd() {
-  const p = path.join(os.homedir(), ".workbuddy", "e10-login-cache.md");
-  if (!fs.existsSync(p)) return null;
-  const txt = fs.readFileSync(p, "utf-8");
-  const get = (key) => {
-    const mm = txt.match(new RegExp("\\*\\*" + key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\*\\*\\s*[:：]\\s*`?([^`\\n]+)`?"));
-    return mm ? mm[1].trim() : "";
-  };
-  const eteamsid = get("ETEAMSID");
-  let cookie = get("完整 Cookie 串");
-  if (!cookie && eteamsid) cookie = "langType=zh_CN; ETEAMSID=" + eteamsid + "; agentType=workbuddy; isAgent=true";
-  return normalizeAuth({
-    baseUrl: get("baseUrl"), eteamsid, cookie,
-    userId: get("userId") || get("employeeId"), tenantKey: get("tenantKey"),
-    source: "明文镜像 ~/.workbuddy/e10-login-cache.md（可能已过期）",
-  });
-}
-
-const AUTH_PROVIDERS = [
-  ["auth-json", providerAuthJson],
-  ["whoami-json", providerWhoamiJson],
-  ["whoami-text", providerWhoamiText],
-  ["cache-md", providerCacheMd],
-];
-/** 兜底出口不进记忆：否则 e10-login 偶发不可用一次，就会把"用镜像"永久设为首选、次次告警 */
-const AUTH_FALLBACK_PROVIDERS = new Set(["cache-md"]);
-
-function readAuthModeMemo() {
-  try {
-    const s = fs.readFileSync(AUTH_MODE_FILE, "utf-8").trim();
-    return AUTH_PROVIDERS.some(([n]) => n === s) ? s : null;
-  } catch { return null; }
-}
-function writeAuthModeMemo(name) {
-  try { fs.mkdirSync(path.dirname(AUTH_MODE_FILE), { recursive: true }); fs.writeFileSync(AUTH_MODE_FILE, name, "utf-8"); } catch {}
-}
-
-/** 凭据取自 e10-login 时，顺手把明文镜像刷新到最新（保持镜像可用；镜像不参与正常取数） */
-function syncCacheMd(auth) {
-  try {
-    const p = path.join(os.homedir(), ".workbuddy", "e10-login-cache.md");
-    if (!fs.existsSync(p) || !/🔐 登录信息缓存/.test(fs.readFileSync(p, "utf-8"))) return; // 非标准缓存文件不动它
-    const d = new Date();
-    const ts = d.getFullYear() + "-" + String(d.getMonth() + 1).padStart(2, "0") + "-" + String(d.getDate()).padStart(2, "0") + " " + String(d.getHours()).padStart(2, "0") + ":" + String(d.getMinutes()).padStart(2, "0");
-    let txt = fs.readFileSync(p, "utf-8");
-    let changed = false;
-    const rep = (key, val) => {
-      const re = new RegExp("(\\*\\*" + key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\*\\*\\s*[:：]\\s*`?)([^`\\n]*)(`?)");
-      const n = txt.replace(re, (m, a, b, c) => { if (b === val && c === "`") return m; changed = true; return a + val + (c || "`"); });
-      txt = n;
-    };
-    rep("baseUrl", auth.baseUrl); rep("ETEAMSID", auth.eteamsid); rep("完整 Cookie 串", auth.cookie); rep("userId", auth.userId || ""); rep("tenantKey", auth.tenantKey || "");
-    rep("缓存记录时间", ts + "（e10-data 自动同步，凭据来源：" + (auth.source || "") + "）");
-    if (changed) fs.writeFileSync(p, txt, "utf-8");
-  } catch {}
-}
-
-/** 取凭据：按优先级依次尝试各出口；命中的模式会被记住（下次优先尝试它，省一次进程调用） */
-function loadAuth() {
-  const { profile, file } = authFilePath();
-  const override = (process.env.E10_DATA_AUTH_MODE || "").trim();
-  const memo = override || (process.env.E10_DATA_AUTH_PROBE ? null : readAuthModeMemo());
-  const order = memo
-    ? AUTH_PROVIDERS.filter(([n]) => n === memo).concat(AUTH_PROVIDERS.filter(([n]) => n !== memo))
-    : AUTH_PROVIDERS;
-
-  const diag = [];
-  for (const [name, fn] of order) {
-    let got = null;
-    lastLoginDiag = "";
-    try { got = fn(); } catch (e) { diag.push(name + ": " + ((e && e.message) || e)); }
-    if (got) {
-      if (name !== memo && !AUTH_FALLBACK_PROVIDERS.has(name)) writeAuthModeMemo(name);
-      got.profile = profile;
-      if (name === "cache-md") {
-        if (!process.env.E10_DATA_QUIET) {
-          console.error("[e10-data][warn] 凭据来源＝" + got.source + "；正常应由 e10-login 提供凭据，请检查 `e10-login whoami` 是否能输出 cookies。");
-        }
-      } else {
-        syncCacheMd(got);   // 凭据来自 e10-login → 顺便把镜像刷新到最新
-      }
-      return got;
-    }
-    if (lastLoginDiag) diag.push(name + ": " + lastLoginDiag);
-  }
-
-  throw new Error(
-    "未取得登录凭据（解密由 e10-login 负责，本 CLI 不参与）。请依次检查：\n" +
-    "  ① e10-login 是否可用：`e10-login --version`（缺失 → `npm i -g e10-login`）；`e10-login whoami` 应能输出 cookies\n" +
-    "  ② 是否已登录 / 登录态是否失效：`e10-login oidc` 重新登录（当前 profile: " + profile + "）\n" +
-    "  ③ auth 文件：" + (fs.existsSync(file) ? "存在" : "不存在") + "（" + file + "）—— 其加解密由 e10-login 负责\n" +
-    (diag.length ? "  探测诊断：" + diag.join(" ｜ ") + "\n" : "")
-  );
-}
-
-// ---------------- 凭据进程间 TTL 缓存（v0.1.17 新增，不落明文）----------------
-// 目的：避免每次调用都重新拉起 e10-login 取凭据（去掉 shell 后仍约 0.22s/次）。
-// 形态：一个 detached 的「持有者」进程把凭据**只保存在内存**里，监听本机命名管道
-//   （Windows）/ Unix 域套接字（0600），供后续同用户·同 profile 的 e10-data 调用取用，
-//   TTL（默认 300s）到期自动退出。**不写任何文件、不涉及网络。**
-// 边界：
-//   · 任何异常（连不上/超时/JSON 坏/过期/profile 不符）一律静默回落正常取凭据路径；
-//   · 兜底出口（明文镜像）的凭据不会写入缓存，避免把过期凭据固化；
-//   · E10_DATA_NO_CRED_CACHE=1 整体关闭；E10_DATA_AUTH_MODE / E10_DATA_AUTH_PROBE 存在时绕过缓存；
-//   · 缓存通道名含「主目录+用户名+profile」哈希 → 不同用户/不同 profile 互不可见。
-const CRED_CACHE_TTL = (() => {
-  const n = Number(process.env.E10_DATA_CRED_TTL);
-  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 300;
-})();
-
-/** 缓存通道地址（只有 e10-data 与 e10-cred-helper 使用；由父进程算好后以 argv 传给持有者） */
-function credCachePath() {
-  const { profile } = authFilePath();
-  const tag = crypto.createHash("sha1")
-    .update([os.homedir(), process.env.USERNAME || process.env.USER || "", profile].join("|"))
-    .digest("hex").slice(0, 16);
-  if (process.platform === "win32") return "\\\\.\\pipe\\e10-data-cred-" + tag;
-  const uid = typeof process.getuid === "function" ? process.getuid() : "n";
-  const dir = process.env.XDG_RUNTIME_DIR || path.join(os.homedir(), ".e10-cli");
-  return path.join(dir, "e10-data-cred-" + tag + "-" + uid + ".sock");
-}
-
-/** 读缓存：命中返回 auth（结构同 loadAuth 的返回值）；未命中/超时/任何异常 → null */
-function credCacheGet() {
-  const { profile } = authFilePath();
-  return new Promise((resolve) => {
-    let done = false, buf = "", sock;
-    const finish = (v) => {
-      if (done) return;
-      done = true;
-      clearTimeout(timer);
-      try { sock.destroy(); } catch {}
-      resolve(v);
-    };
-    const timer = setTimeout(() => finish(null), 1500);   // 取缓存必须快；超时即当未命中
-    try { sock = net.connect(credCachePath()); } catch { return finish(null); }
-    sock.setEncoding("utf-8");
-    sock.on("connect", () => { try { sock.write("GET\n"); } catch { finish(null); } });
-    sock.on("data", (d) => {
-      buf += d;
-      if (!buf.includes("\n")) return;
-      try {
-        const j = JSON.parse(buf.split("\n")[0]);
-        if (!j || j.v !== 1 || Number(j.exp) < Date.now()) return finish(null);
-        if ((j.profile || "default") !== profile) return finish(null);
-        const a = normalizeAuth(Object.assign({}, j.auth, { source: "进程间凭据缓存（e10-data cred-cache）" }));
-        return finish(a || null);
-      } catch { return finish(null); }
-    });
-    sock.on("error", () => finish(null));
-    sock.on("close", () => finish(null));
-  });
-}
-
-/** 写缓存：拉起 detached 持有者，凭据经 stdin 传入（不经 argv，避免出现在进程列表里） */
-function credCachePublish(auth) {
-  return new Promise((resolve) => {
-    let child;
-    try {
-      const helper = path.join(__dirname, "e10-cred-helper.mjs");
-      if (!fs.existsSync(helper)) return resolve();
-      child = spawn(process.execPath, [helper, credCachePath(), String(CRED_CACHE_TTL)], {
-        detached: true, stdio: ["pipe", "ignore", "ignore"], windowsHide: true,
-      });
-    } catch { return resolve(); }
-    const payload = JSON.stringify({
-      exp: Date.now() + CRED_CACHE_TTL * 1000,
-      profile: auth.profile || "default",
-      auth: {
-        baseUrl: auth.baseUrl, eteamsid: auth.eteamsid, cookie: auth.cookie,
-        userId: auth.userId, tenantKey: auth.tenantKey, source: auth.source,
-      },
-    });
-    let settled = false;
-    const done = () => { if (settled) return; settled = true; try { child.unref(); } catch {} resolve(); };
-    child.on("error", done);
-    child.stdin.on("error", done);
-    child.stdin.end(payload, done);
-    setTimeout(done, 1000);   // 兜底：不让发布环节拖住主命令
-  });
-}
-// ---------------- login（唯一"不需要已有凭据"的命令族：xiaoe-env，2026-09-17 移植）----------------
-// 来源：e10-login 1.6.4-xiaoe 的 `e10-login xiaoe-env [--domain <url>]`
-//   （lib/xiaoe.js 命令定义 + lib/login-flow.js 收尾 + scripts/xiaoe_env.py 换 token）。
-//   原实现是「Node 里 spawn python scripts/xiaoe_env.py 换 ETEAMSID」，而本 CLI 是零依赖 Node，
-//   **不需要 python**：换 token 本身就是一次 POST，此处原生复刻（逐字段对齐：URL 拼接、请求头
-//   authorization、body {domain}、code 判定 '0000'/200、取 data.eteamId、错误信息取 msg）。
-// 分工（与本 CLI 既有的认证边界一致，不越界）：
-//   ① 换 token      → 本 CLI 原生实现（无 python 依赖）；
-//   ② 落 profile    → 仍交 e10-login `set --eteamsid --base-url`（auth 文件由它的密钥体系加密，
-//                     只有它解得开；`set` 与原命令的收尾 finishLoginByEteamsId 是同一条路径：
-//                     teamsCheck 解析用户信息 + 写 auth/config + 切换 active profile）。
-// ⚠️ 本段必须在 loadAuth() 之前执行 —— 该命令存在的意义就是"还没有凭据时把凭据造出来"，
-//    因此它在 main() 之前拦截（见下方拦截块），不走常规 main() 分发。
-const LOGIN_DEFAULT_BASE_URL = "https://www.e-cology.com.cn";
-const XIAOE_ENV_ETEAMID_PATH = "/spec-apps/api/app/rpachat/skill/extend/eteamId";
-const ETEAMSID_SAFE_RE = /^[A-Za-z0-9_.\-]+$/; // 透传给 e10-login 的参数白名单（该调用走 shell，防注入）
-
-/** --domain → 当前 profile 的 config.json.baseUrl → 默认平台地址（对齐 e10-login 的 resolveBaseUrl；
- *  config.json 是明文，读它不涉及任何解密） */
-function resolveLoginBaseUrl(optDomain) {
-  if (optDomain !== undefined && typeof optDomain !== "string") throw new Error("--domain 需要跟一个平台地址，如 --domain https://www.e-cology.com.cn");
-  let cfgBase = "";
-  try {
-    const cfgFile = path.join(path.dirname(authFilePath().file), "config.json");
-    if (fs.existsSync(cfgFile)) cfgBase = String(JSON.parse(fs.readFileSync(cfgFile, "utf-8")).baseUrl || "").trim();
-  } catch {}
-  return String(optDomain || cfgBase || LOGIN_DEFAULT_BASE_URL).trim().replace(/\/+$/, "");
-}
-
-/** 复刻 scripts/xiaoe_env.py：POST {XIAOE_DOMAIN}/spec-apps/api/app/rpachat/skill/extend/eteamId
- *  请求头 authorization=<XIAOE_USER_TOKEN>；body {"domain": <目标平台域名>} → 取 data.eteamId */
-async function xiaoeEnvFetchEteamsId(domain) {
-  const token = String(process.env.XIAOE_USER_TOKEN || "").trim();
-  const erpa = String(process.env.XIAOE_DOMAIN || "").trim();
-  if (!token || !erpa) {
-    throw new Error("缺少环境变量 XIAOE_USER_TOKEN / XIAOE_DOMAIN（请先设置后重试，如 export XIAOE_USER_TOKEN=<token> XIAOE_DOMAIN=<erpa域名>）");
-  }
-  const url = erpa.replace(/\/+$/, "") + XIAOE_ENV_ETEAMID_PATH;
-  let resp, text;
-  try {
-    resp = await fetch(url, {
-      method: "POST",
-      headers: { authorization: token, "content-type": "application/json", accept: "application/json" },
-      body: JSON.stringify({ domain }),
-    });
-    text = await resp.text();
-  } catch (e) {
-    throw new Error("请求 XiaoE 换 token 接口失败（" + url + "）：" + ((e && e.message) || e));
-  }
-  let j = null;
-  try { j = JSON.parse(text); } catch {}
-  if (!j) throw new Error("XiaoE 接口返回非 JSON（HTTP " + resp.status + "）：" + text.slice(0, 200));
-  const code = j.code;
-  const eteamId = String((j.data && j.data.eteamId) || "").trim();
-  if (!(code === "0000" || code === 200 || code === "200") || !eteamId) {
-    throw new Error("XiaoE 换取失败：" + (j.msg || ("HTTP " + resp.status + " code=" + code)));
-  }
-  return eteamId;
-}
-
-/** e10-data login xiaoe-env：环境变量全局 token → ETEAMSID → 写 profile（走 e10-login set 收尾） */
-async function cmdLoginXiaoeEnv(args, json) {
-  const say = json ? console.error : console.log; // --json 时人读信息一律走 stderr，保持 stdout 只有 JSON
-  const baseUrl = resolveLoginBaseUrl(args.domain);
-  say("ℹ️  目标平台: " + baseUrl + (args.domain ? "（--domain）" : baseUrl === LOGIN_DEFAULT_BASE_URL ? "（默认平台地址）" : "（当前 profile 的 config.json）"));
-
-  const eteamsId = await xiaoeEnvFetchEteamsId(baseUrl);
-  say("✅ 已取得 ETEAMSID（来源: env，不回显）");
-
-  if (!ETEAMSID_SAFE_RE.test(eteamsId)) throw new Error("换回的 ETEAMSID 含异常字符，已拒绝透传 e10-login（安全防护）");
-  // v0.1.17：改为数组直传 + shell:false（不再手工拼 shell 字符串、不再需要 shq 转义），
-  //   既省掉 cmd.exe 那一层开销，也彻底消除 shell 注入面。ETEAMSID_SAFE_RE 仍作为二道防线保留。
-  const r = spawnLoginCli(["set", "--eteamsid", eteamsId, "--base-url", baseUrl], 60000);
-  const out = (r.stdout || "").trim(), err = (r.stderr || "").trim();
-  if (r.error || r.status !== 0) {
-    throw new Error("换 token 成功，但 e10-login 写 profile 失败（auth 文件的加密写入只有 e10-login 能做）："
-      + (err || out || (r.error && r.error.message) || ("exit=" + r.status)));
-  }
-  for (const line of (out + (err ? "\n" + err : "")).split(/\r?\n/)) if (line.trim()) say("   [e10-login] " + line.trim());
-
-  const profile = authFilePath().profile;
-  // 自检：立刻用取数链路（loadAuth）把凭据读回来，确认"真能读到"而不是"只写了文件"
-  //   （历史坑：e10-login 旧版 whoami 不带 cookies → 登录成功但 e10-data 取不到凭据；此处必须报出来）
-  //   强制重新探测（E10_DATA_AUTH_PROBE），并拒绝把"明文镜像兜底"当成自检通过 —— 镜像可能是旧环境的
-  let readBack = "";
-  try {
-    process.env.E10_DATA_AUTH_PROBE = "1";
-    const a = loadAuth();
-    const viaMirror = /镜像/.test(String(a.source || ""));
-    readBack = (viaMirror ? "⚠️ 仅命中明文镜像：" : "ok（") + (a.source || "?") + "；baseUrl: " + a.baseUrl + (a.userId ? "；userId: " + a.userId : "") + (viaMirror ? "" : "）");
-    if (viaMirror) throw new Error("凭据来自明文镜像而非新写入的 profile（镜像可能是旧环境/已过期）");
-    say("✅ 凭据自检通过：" + readBack);
-  } catch (e) {
-    if (!readBack) readBack = "失败: " + String((e && e.message) || e).split(/\r?\n/)[0];
-    throw new Error("profile 已写入 ~/.e10-cli/profiles/" + profile + "/auth，但本 CLI 读不回凭据（" + readBack
-      + "）—— 取数仍会失败。请确认 `e10-login whoami` 能输出 cookies（缺则升级 e10-login），或改用 `e10-login oidc`。");
-  }
-  return {
-    ok: true,
-    baseUrl,
-    profile,
-    credentialSource: "env(XIAOE_USER_TOKEN + XIAOE_DOMAIN)",
-    writtenBy: "e10-login set",
-    eteamsId: "(已写入，不回显)",
-    readback: readBack,
-  };
-}
-
-// ---- 拦截（必须早于 loadAuth()）：login 族 = 唯一不需要已有凭据的命令族 ----
-{
-  const a2 = process.argv[2] || "";
-  const bare = a2 === "xiaoe-env";                     // 别名：与 e10-login 同名命令保持一致的肌肉记忆
-  if (a2 === "login" || bare) {
-    const sub = bare ? a2 : process.argv[3] || "";
-    const { args } = parseArgs(process.argv.slice(bare ? 3 : 4));
-    const json = !!args.json;
-    try {
-      if (sub !== "xiaoe-env") throw new Error("未知子命令 `login " + (sub || "(空)") + "`（当前仅移植 xiaoe-env）");
-      const r = await cmdLoginXiaoeEnv(args, json);
-      if (json) console.log(JSON.stringify(r, null, 1));
-      process.exit(0);
-    } catch (e) {
-      console.error("ERROR: " + ((e && e.message) || e));
-      process.exit(1);
-    }
-  }
-}
-
-// ---- 命令白名单（早期校验用；必须与下方 main() 的分发表保持一致）----
-// 返回 true = 该命令存在、可以继续（可能还需要凭据）；false = 未知命令，直接给用法提示。
-// 为什么需要：loadAuth() 写在模块顶层，过去"未知命令"也要先付一整笔取凭据的开销
-// （Windows 上 ~1.0s，去 shell 后 ~0.22s）才打印用法。v0.1.17 起提前判定。
-const CMD_SUBS = {
-  ds: ["tables", "fields", "list", "chart", "stat", "count"],
-  doc: ["count", "list"],
-  noun: ["list"],
-  field: ["id2name", "name2id"],
-  conf: ["get", "batch", "batch-file", "group", "group-file", "resolve", "resolve-file", "add", "add-file", "update", "delete"],
-  exp: ["status", "manifest", "commits", "file", "pull", "init", "commit", "lock", "release", "rollback"],
-  attend: ["statis"],
-  eb: ["perm-page"],
-};
-function commandIsKnown(pos) {
-  const family = pos[0], sub = pos[1];
-  if (!family) return false;                                   // 无命令 → 用法
-  if (family === "query") return true;                         // query 无子命令（cmdQuery 自行处理入参）
-  if (family === "login" || family === "xiaoe-env") return true; // 已由上方拦截块接管
-  const subs = CMD_SUBS[family];
-  if (!subs) return false;
-  return subs.includes(sub);
-}
-
-// ---- 拦截（必须早于 loadAuth()）：免凭据命令族 ----
-// ① 版本 / ② 帮助 / ③ 未知命令 —— 这三类都不需要凭据，故在取凭据之前 return。
-// （login 族由上方独立拦截块处理；exp release/rollback 的 --version 是版本号参数、长度 >1 不受影响）
-{
-  const rawArgv = process.argv.slice(2);
-  const { args: earlyArgs, pos: earlyPos } = parseArgs(rawArgv);
-
-  // ① --version / -v：仅顶层单参数
-  if (rawArgv.length === 1 && (rawArgv[0] === "--version" || rawArgv[0] === "-v")) {
-    console.log("e10-data " + cliVersion());
-    process.exit(0);
-  }
-
-  // ② --help / -h：显式求帮助 → 用法 + 退出码 0（区别于"用错了"的退出码 1）
-  //    只认「裸开关」（值为 true），避免把 --value --help 这类取值误判为求助；
-  //    -h 是单短横线、parseArgs 不识别，单独按顶层单参数处理
-  if (earlyArgs.help === true || (rawArgv.length === 1 && rawArgv[0] === "-h")) {
-    usage();
-    process.exit(0);
-  }
-
-  // ③ 未知命令族 / 未知子命令 / 缺子命令 → 用法提示，退出码 1
-  if (!commandIsKnown(earlyPos)) {
-    usage();
-    process.exit(1);
-  }
-}
-
-// ---- 取凭据（v0.1.17：先试进程间缓存，未命中再走 e10-login，并把结果发布给后续调用）----
-let auth = null;
-const CRED_CACHE_ON = !process.env.E10_DATA_NO_CRED_CACHE
-  && !process.env.E10_DATA_AUTH_MODE && !process.env.E10_DATA_AUTH_PROBE;
-if (CRED_CACHE_ON) auth = await credCacheGet();
-if (!auth) {
-  auth = loadAuth();
-  // 兜底出口（明文镜像）的凭据不写入缓存 —— 避免把可能已过期的凭据固化整个 TTL
-  if (CRED_CACHE_ON && !/镜像/.test(String(auth.source || ""))) await credCachePublish(auth);
-}
-const BASE = auth.baseUrl.replace(/\/+$/, "");
-const USER = { id: auth.userId || "", tenantKey: auth.tenantKey || "" };
-
-// ---------------- HTTP ----------------
-function checkAuthFail(resp, text, j) {
-  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) {
-    const from = (auth && auth.source) || "未知";
-    const hint = /镜像/.test(from)
-      ? "当前用的是明文镜像兜底凭据（可能已过期），请先确认 `e10-login whoami` 能正常导出 cookies，或执行 `e10-login oidc` 重新登录"
-      : "凭据由 e10-login 提供，请执行 `e10-login oidc` 重新登录";
-    throw new Error("登录态失效(" + (j.msg || resp.status) + ")：凭据来源＝" + from + "；" + hint);
-  }
-}
-async function postJson(endpoint, bodyObj, extraHeaders = {}) {
-  const resp = await fetch(BASE + endpoint, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json;charset=UTF-8",
-      "accept": "application/json, text/plain, */*",
-      "langType": "zh_CN",
-      "cookie": auth.cookie,
-      "eteamsid": auth.eteamsid,
-      "ebbusinessid": EB_BIZ_ID,
-      "user-agent": UA,
-      "timezoneoffset": "-480",
-      ...extraHeaders,
-    },
-    body: JSON.stringify(bodyObj),
-  });
-  const text = await resp.text();
-  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
-  checkAuthFail(resp, text, j);
-  return j;
-}
-async function getUrl(url) {
-  const resp = await fetch(BASE + url, {
-    method: "GET",
-    headers: {
-      "accept": "application/json, text/plain, */*",
-      "langType": "zh_CN",
-      "cookie": auth.cookie,
-      "eteamsid": auth.eteamsid,
-      "ebbusinessid": EB_BIZ_ID,
-      "user-agent": UA,
-    },
-  });
-  const text = await resp.text();
-  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
-  checkAuthFail(resp, text, j);
-  return j;
-}
-async function postMultipart(endpoint, formObj) {
-  const fd = new FormData();
-  for (const [k, v] of Object.entries(formObj)) fd.append(k, typeof v === "string" ? v : JSON.stringify(v));
-  const resp = await fetch(BASE + endpoint, {
-    method: "POST",
-    headers: {
-      "accept": "application/json, text/plain, */*",
-      "langType": "zh_CN",
-      "cookie": auth.cookie,
-      "eteamsid": auth.eteamsid,
-      "ebbusinessid": EB_BIZ_ID,
-      "user-agent": UA,
-      "timezoneoffset": "-480",
-      "referer": BASE + "/sp/ebddesigner/1282331905881874436",
-    },
-    body: fd,
-  });
-  const text = await resp.text();
-  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
-  checkAuthFail(resp, text, j);
-  return j;
-}
-
-// ---------------- 参数解析 ----------------
-function parseArgs(argv) {
-  const args = {};
-  const pos = [];
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a.startsWith("--")) {
-      const key = a.slice(2);
-      const v = argv[i + 1];
-      if (v === undefined || v.startsWith("--")) { args[key] = true; }
-      else { args[key] = v; i++; }
-    } else pos.push(a);
-  }
-  return { args, pos };
-}
-// ⚠️ 大整数精度保护（2026-09-03）：E10 主键/ID 多为 19 位大整数，超过 JS 安全整数 2^53-1
-// （9007199254740991）。JSON.parse 会将其舍入为近似 double（如 1297901170990161977 → ...1920），
-// 导致 DSL 条件查不到数据（静默空结果）或返回 ID 失真。此处把 JSON 中 >2^53 的裸数字字面量
-// 加引号转字符串（后端实测接受字符串形式做 = / IN / BETWEEN 数值比较），请求与响应两侧统一保护。
-function protectBigInts(raw) {
-  // 逐字符扫描：跟踪 JSON 字符串状态（含转义），仅在引号外的结构层把 >2^53 的裸整数加引号，
-  // 避免误伤字符串内容（如 avatar JSON、文档正文里含 ",大数字" 片段）。
-  let out = "", inStr = false, esc = false;
-  for (let i = 0; i < raw.length; i++) {
-    const ch = raw[i];
-    if (inStr) {
-      out += ch;
-      if (esc) esc = false;
-      else if (ch === "\\") esc = true;
-      else if (ch === '"') inStr = false;
-      continue;
-    }
-    if (ch === '"') { inStr = true; out += ch; continue; }
-    if (ch === "-" || (ch >= "0" && ch <= "9")) {
-      let j = i + 1;
-      while (j < raw.length && raw[j] >= "0" && raw[j] <= "9") j++;  // 纯整数 token（无小数点/指数）
-      let k = i - 1;
-      while (k >= 0 && /\s/.test(raw[k])) k--;
-      const prev = k < 0 ? "" : raw[k];
-      let n = j;
-      while (n < raw.length && /\s/.test(raw[n])) n++;
-      const next = n < raw.length ? raw[n] : "";
-      const token = raw.slice(i, j);
-      if ((prev === ":" || prev === "," || prev === "[") && (next === "," || next === "}" || next === "]")) {
-        try {
-          const bi = BigInt(token);
-          if (bi > 9007199254740991n || bi < -9007199254740991n) { out += '"' + token + '"'; i = j - 1; continue; }
-        } catch { /* 非纯整数不转换 */ }
-      }
-      out += raw.slice(i, j);
-      i = j - 1;
-      continue;
-    }
-    out += ch;
-  }
-  return out;
-}
-function parseJsonSafe(raw, label) {
-  try { return JSON.parse(protectBigInts(raw)); }
-  catch (e) { throw new Error((label || "JSON") + " 解析失败: " + e.message); }
-}
-function readJsonArg(val, label) {
-  let raw = val;
-  if (val.startsWith("@")) raw = fs.readFileSync(val.slice(1), "utf-8");
-  return parseJsonSafe(raw, label);
-}
-function need(arg, args) { if (!args[arg]) throw new Error("缺少必填参数 --" + arg); return args[arg]; }
-// 文件/JSON 参数取值：兼容 --flag <v> 与位置参数 <v>（如 conf add-file @items.json / --add-file @items.json）
-function flagOrPos(args, flag, keys) {
-  if (args[flag] !== undefined) return args[flag];
-  return keys && keys.length ? keys[0] : undefined;
-}
-
-// ---------------- 展示 ----------------
-function fmt(v) {
-  if (v === null || v === undefined) return "";
-  if (typeof v === "object") { const s = JSON.stringify(v); return s.length > 80 ? s.slice(0, 80) + "…" : s; }
-  return String(v);
-}
-function printHuman(title, rows, cols) {
-  if (title) console.log("== " + title + " ==");
-  if (!rows || !rows.length) { console.log("(空)"); return; }
-  if (cols) {
-    console.log(cols.join("\t"));
-    for (const r of rows) console.log(cols.map((c) => fmt(r[c])).join("\t"));
-  } else {
-    for (const r of rows.slice(0, 100)) console.log(JSON.stringify(r));
-    if (rows.length > 100) console.log("... 共 " + rows.length + " 行（--json 取全量）");
-  }
-}
-
-// ---------------- query：DSL 查询 ----------------
-async function cmdQuery(args, json) {
-  const conn = need("conn", args), model = need("model", args), schema = need("schema", args);
-  const tableId = args["table-id"] || "";
-  const dslVal = need("dsl", args);
-  const dslQuery = dslVal.startsWith("@") ? readJsonArg(dslVal, "--dsl") : parseJsonSafe(dslVal, "--dsl");
-  const body = { connId: conn, model, schema, tableId, dslQuery };
-  if (args.debug !== undefined) {  // --debug true|false，与 conn/model 同层级
-    const dbg = String(args.debug).toLowerCase();
-    if (dbg === "true" || dbg === "1") body.debug = true;
-    else if (dbg === "false" || dbg === "0") body.debug = false;
-    else throw new Error("--debug 值必须为 true 或 false（当前: " + args.debug + "）");
-  }
-  const r = await postJson("/api/dw/dsl/executeQueryDsl", body);
-  if (json) return r;
-  if (String(r.code) !== "200" && r.code !== undefined && String(r.code) !== "0") {
-    console.log("code=" + r.code + " msg=" + (r.msg || ""));
-    if (/没有权限|无权限|权限不足|未授权|无权访问|无查询权限/i.test(String(r.msg || ""))) {
-      throw new Error("当前用户对该数据无查询权限，请检查 ETEAMSID 是否有效或联系管理员开通");
-    }
-    return;
-  }
-  const d = r.data;
-  // debug=true 时 data 为 { sql, records }；否则为行数组
-  const rows = Array.isArray(d) ? d : (d && Array.isArray(d.records) ? d.records : []);
-  if (d && !Array.isArray(d) && d.sql) console.log("SQL: " + d.sql);
-  if (!rows.length) { console.log("(空：0 行)"); return; }
-  printHuman("结果 " + rows.length + " 行", rows);
-}
-
-// ---------------- ds：数据源 ----------------
-function dyn() {
-  return { eteamsId: auth.eteamsid, userId: auth.userId || "", tenantKey: auth.tenantKey || "", langId: 7, formatDate: "yyyy-MM-dd HH:mm:ss", isPublic: false };
-}
-function baseDto(tableId, groupId, pageNo, pageSize, queryType) {
-  return { tableId: String(tableId), groupId, pageNo, pageSize, queryType, containDetailTable: false, needFormat: true, dynamicParams: dyn() };
-}
-// 条件树（conditionTrees）协议：根/组节点 { key, relationship("1"=AND|"0"=OR), isParent:true, parentNode, conditionList:[...] }
-// 叶子节点 { key, relationship:"1", isParent:false, parentNode, conditionId, conditionType, compareType, conditionValue, ... }
-// v0.1.8 起 parseWhere 支持递归树（OR）；向后兼容：数组=AND 根、叶子键 fieldId 优先（conditionId 兼容兜底）
-function normRel(r) { return (r === "0" || r === 0 || r === false) ? "0" : "1"; }
-function isCondGroup(c) { return !!c && Array.isArray(c.conditionList) && c.conditionList.length > 0; }
-function buildCondNode(c, key, parentKey) {
-  if (isCondGroup(c)) {
-    return {
-      key, relationship: normRel(c.relationship), isParent: true, parentNode: parentKey,
-      mainField: c.mainField !== false,
-      conditionList: c.conditionList.map((k, i) => buildCondNode(k, key + "_" + i, key)),
-    };
-  }
-  const fid = (c && (c.fieldId || c.conditionId)) || "";
-  if (!fid) throw new Error("--where 条件缺少字段：叶子须提供 fieldId（或 conditionId），条件组须提供非空 conditionList");
-  return {
-    key, relationship: "1", isParent: false, parentNode: parentKey,
-    objId: c.objId || "", conditionId: fid, fieldName: c.fieldName || fid,
-    conditionType: c.conditionType || "", compareType: c.compareType, conditionValue: c.conditionValue ?? "",
-    fieldValue: c.fieldValue || "", mainField: c.mainField !== false, ignoreCaseMark: c.ignoreCaseMark || false,
-  };
-}
-function parseWhere(val) {
-  if (!val) return null;
-  const raw = readJsonArg(val, "--where");
-  if (!raw) return null;
-  const ts = Date.now(), rootKey = "root_" + ts;
-  if (Array.isArray(raw)) { // 数组 → AND 根（元素可为叶子或内嵌条件组，组自带 relationship）
-    const kids = [];
-    raw.forEach((c, i) => { if (c && typeof c === "object") kids.push(buildCondNode(c, rootKey + "_" + i, rootKey)); });
-    if (!kids.length) return null;
-    return { key: rootKey, relationship: "1", isParent: true, parentNode: "", mainField: true, conditionList: kids };
-  }
-  if (typeof raw !== "object") throw new Error("--where 须为条件数组或条件树对象");
-  // 对象形态 = 完整条件树（{relationship, conditionList:[...]}，缺省 AND）；无 conditionList 视为无条件
-  if (!Array.isArray(raw.conditionList) || !raw.conditionList.length) return null;
-  return buildCondNode(raw, rootKey, "");
-}
-function parseStat(val) {
-  const arr = readJsonArg(val, "--stat");
-  const list = Array.isArray(arr) ? arr : [arr];
-  return list.map((s) => ({ fieldId: s.fieldId, fieldName: s.fieldId, objId: "", mainField: true, aggregator: s.aggregator || "SUM", ...(s.fieldAlias ? { fieldAlias: s.fieldAlias } : {}) }));
-}
-function parseOrder(val) {
-  if (!val) return [];
-  return val.split(",").map((s) => {
-    const [f, dir] = s.trim().split(/\s+/);
-    return { fieldId: f, fieldName: f, objId: "", isAsc: (dir || "asc").toLowerCase() !== "desc", mainField: true };
-  });
-}
-// ---------------- ds appId：一律显式传入（v0.1.14，2026-09-11 用户确认调整）----------------
-// 背景：ChatBI 数据源取数接口（getListDatas / getChartDatas / getStatDatas / getCountData）
-// 对部分 EB 应用（独立部署）的数据集必须携带 queryDto.appId，否则后端一律返回 code=500。
-// 设计：appId 属「权限校验」的产物 —— 调用方先查 dw.chat_bi_eb_config_map 判权限（无权限即终止），
-//   同一条记录的 app_id 即本次取数必须携带的 appId，再显式传入本 CLI：
-//   → CLI 不再自行反查 appId（v0.1.13 的「chat_bi_eb_config_map → ebdf_obj 自动解析」已整体移除），
-//     避免把权限表当普通字典使用、也避免 appId 来源不可见；
-//   → 仅 EB 建模表单（groupId = weaver-ebuilder-form-service）需要 appId，其它数据集可不传；
-//   → 不传也**不做拦截**，由后端按原样报错。
-function dsFieldsForm(gid, tid, st) {
-  return { groupId: gid, sourceId: tid, sourceType: st, detailFieldsGroup: "true", enableMerge: "true", needTableName: "true", params: "[]" };
-}
-// ds 取数统一入口：appId 只认显式 --app-id <id>
-// （--app-id auto / --no-app-id 一律视为未传：v0.1.14 起不再自动解析，也不做缺失拦截）
-async function dsDto(args, tid, gid, pageNo, pageSize, queryType) {
-  const dto = baseDto(tid, gid, pageNo, pageSize, queryType);
-  const appId = args["app-id"];
-  if (typeof appId === "string" && appId !== "" && appId !== "auto") dto.appId = appId;
-  return dto;
-}
-async function cmdTables(args, json) {
-  const gid = need("group", args);
-  const form = { name: args.name || "", pageNo: args.page || "1", pageSize: args.size || "100", groupId: gid, sourceType: args["source-type"] || "LOGIC", dataUsage: "" };
-  if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/listByPage", form);
-  if (json) return r;
-  const recs = ((r.data || {}).records) || [];
-  printHuman("分组表清单 (total=" + ((r.data || {}).total) + ")", recs, ["id", "name", "appId", "tableText", "detailTable", "usage"]);
-}
-async function cmdFields(args, json) {
-  const gid = need("group", args), tid = need("table", args);
-  const form = dsFieldsForm(gid, tid, args["source-type"] || "LOGIC");
-  if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
-  const r = await postMultipart("/api/ebuilder/common/ds/fields", form);
-  if (json) return r;
-  for (const d of (r.data || [])) {
-    console.log("== 表: " + d.name + " (id=" + d.id + ") 字段 " + (d.fields || []).length + " 个 ==");
-    for (const f of (d.fields || [])) console.log([f.name, f.text, f.type, f.mainPrimaryKey ? "PK" : ""].filter(Boolean).join("\t"));
-  }
-}
-async function cmdList(args, json) {
-  const gid = need("group", args), tid = need("table", args), fld = need("fields", args);
-  const fields = fld.split(",").map((f) => ({ fieldId: f, fieldName: f, objId: String(tid), mainField: true }));
-  const dto = await dsDto(args, tid, gid, parseInt(args.page || "1", 10), parseInt(args.size || "20", 10), "getListData");
-  dto.queryFields = fields;
-  dto.orderFields = parseOrder(args.order);
-  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
-  dto.queryCount = true;
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getListDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
-  if (json) return r;
-  const data = r.data || {};
-  console.log("== 数据列表 count=" + data.count + " 行=" + (data.list || []).length + " ==");
-  printHuman("", data.list || [], fields.map((f) => f.fieldId));
-}
-async function cmdChart(args, json) {
-  const gid = need("group", args), tid = need("table", args), gb = need("group-by", args);
-  const dto = await dsDto(args, tid, gid, parseInt(args.page || "1", 10), parseInt(args.size || "100", 10), "getChartData");
-  dto.groupFields = gb.split(",").map((f) => ({ fieldId: f, fieldName: f, objId: String(tid), mainField: true }));
-  dto.groupStatFields = parseStat(need("stat", args)).map((s) => ({ ...s, objId: String(tid) }));
-  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getChartDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
-  if (json) return r;
-  printHuman("分组聚合 rows=" + (r.data || []).length, r.data || []);
-}
-async function cmdStat(args, json) {
-  const gid = need("group", args), tid = need("table", args);
-  const dto = await dsDto(args, tid, gid, 1, 10, "getStatData");
-  dto.statFields = parseStat(need("stat", args)).map((s) => ({ ...s, objId: String(tid) }));
-  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getStatDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
-  if (json) return r;
-  const data = r.data || {};
-  if (data.fields && data.fields.length) { for (const f of data.fields) console.log(JSON.stringify(f)); }
-  else console.log("(无统计结果)");
-}
-async function cmdCount(args, json) {
-  const gid = need("group", args), tid = need("table", args);
-  const dto = await dsDto(args, tid, gid, 1, 10, "getCountData");
-  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
-  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getCountData", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
-  if (json) return r;
-  const data = r.data || {};
-  console.log("totalCount = " + (data.totalCount ?? "-"));
-}
-
-// ---------------- eb：EB 建模表单权限校验 ----------------
-// chatBi EB 配置映射分页查询：EB 表权限前置校验的 CLI 通道
-// （替代原「DSL 查 dw.chat_bi_eb_config_map + 客户端拼 (all_scop=1 OR target_id=本人)」写法）
-// 服务端已按登录人过滤：有权限 → total>=1 且行内回带 appId；无权限 / 表不存在 → total=0
-const EB_PERM_PAGE_PATH = "/api/dw/newetl/chatBi/getChatBiEbConfigMapByPage";
-async function cmdEbPermPage(args, json) {
-  // ⚠️ obj-id / app-id 为 19 位大整数：必须原样字符串传递。
-  //    经 JS Number 会舍入（840360795890851856 → 840360795890851840），实测后端接受字符串，
-  //    但吃下舍入后的数字会返回 total=0 —— 把「有权限」静默伪装成「无权限」。
-  const objId = String(need("obj-id", args));
-  const formTable = String(need("form-table", args));
-  // ⚠️ obj-id / form-table 缺失时后端不是报错，而是 HTTP 200 + 无 actionMsg + data 空，
-  //    外观与「无权限」完全一致 → 必须用 need() 在本地拦掉（need 对空串同样报错）。
-  const body = {
-    objId,
-    formTable,
-    pageNum: parseInt(args.page || "1", 10),
-    pageSize: parseInt(args.size || "10", 10),
-  };
-  if (typeof args["app-id"] === "string" && args["app-id"] !== "") body.app_id = String(args["app-id"]);
-  const r = await postJson(EB_PERM_PAGE_PATH, body);
-  if (json) return r;
-  // ⚠️ 失败判定：非法入参时 actionMsg 缺失（code=undefined），业务失败时 code!==0 → 一并按失败输出
-  const am = r.actionMsg || {};
-  if (am.code !== 0) { console.log("code=" + am.code + " msg=" + (am.message || "")); return; }
-  const d = r.data || {};
-  const recs = d.records || [];
-  const total = d.total === undefined || d.total === null ? 0 : d.total;
-  const first = recs[0] || null;
-  console.log("total = " + total);
-  printHuman("", recs, ["id", "objId", "formTable", "appId", "allScop", "targetId", "enabled", "deleteType"]);
-  console.log(total >= 1
-    ? (first
-      ? "结论: 有权限（appId=" + first.appId + "）"
-      : "结论: 有权限（total>=1；当前页无记录，appId 请用 --page 1 获取）")
-    : "结论: 无权限（total=0）");
-  if (args.require && total < 1) throw new Error("没有查询该 EB 表的权限（total=0）");
-}
-
-// ---------------- doc：文档查询 ----------------
-function docBaseBody(pageNo, pageSize) {
-  return {
-    curMenuType: "", limitedFolderIncludeSub: "", limitedFolderIds: "", docAppConsole: "",
-    viewType: "DOC_PAGINATION", pageNo, pageSize, morePageId: "", dimension: "ALL", includeBelongFolders: true,
-    order: { property: "default", direction: "DESC" }, searchType: "all", conditions: [], customConditions: [],
-    userId: auth.userId || "", current: pageNo,
-    columnOrders: [{ orderKey: "default", orderType: "" }], getColumn: false, quickSearchType: "normal",
-    withFullSearch: false, fetchFullSearchParam: true,
-  };
-}
-function buildDocConditions(args) {
-  const conds = [];
-  if (args.name) conds.push({ id: "name", type: "string", value: args.name });
-  if (args.creator) conds.push({ id: "creator", operate: args["creator-neq"] ? "neq" : "eq", type: "array", value: args.creator });
-  if (args.author) conds.push({ id: "author", operate: args["author-neq"] ? "neq" : "eq", type: "array", value: args.author });
-  if (args["content-type"]) conds.push({ id: "contentType", operate: "eq", type: "array", value: args["content-type"] });
-  if (args.time) conds.push({ id: "create_time", type: "date", value: args.time });
-  if (args["last-time"]) conds.push({ id: "last_update_time", type: "date", value: args["last-time"] });
-  if (args.folder) conds.push({ id: "folder", operate: "eq", type: "folder", value: args.folder });
-  if (args["folder-neq"]) conds.push({ id: "folder", operate: "neq", type: "folder", value: args["folder-neq"] });
-  return conds;
-}
-async function cmdDocCount(args, json) {
-  const body = docBaseBody(1, parseInt(args.size || "20", 10));
-  body.conditions = buildDocConditions(args);
-  const r = await postJson("/api/doc/documents/documentListCount", body);
-  if (json) return r;
-  const data = r.data || {};
-  console.log("total = " + (data.total ?? "-"));
-}
-async function cmdDocList(args, json) {
-  const pageSize = parseInt(args.size || "100", 10);
-  const body = docBaseBody(1, pageSize);
-  body.conditions = buildDocConditions(args);
-  const r1 = await postJson("/api/doc/documents/documentListCount", body);
-  if (json) return r1;
-  const total = (r1.data || {}).total || 0;
-  if (!total) { console.log("total = 0（未查询到符合条件的文档）"); return; }
-  const totalPages = Math.ceil(total / pageSize);
-  const maxPages = args.all ? totalPages : Math.min(parseInt(args.page || "1", 10), totalPages);
-  const startPage = args.all ? 1 : parseInt(args.page || "1", 10);
-  const allRows = [];
-  for (let pno = startPage; pno <= maxPages; pno++) {
-    const b = docBaseBody(pno, pageSize);
-    b.conditions = buildDocConditions(args);
-    const rr = await postJson("/api/doc/documents/documentList", b);
-    const rows = ((rr.data || {}).data) || [];
-    for (const row of rows) if (!allRows.some((x) => x.id === row.id)) allRows.push(row);
-    if (!args.all && pno === maxPages) break;
-  }
-  console.log("== 文档列表 total=" + total + " 本批=" + allRows.length + " 行 ==");
-  printHuman("", allRows, ["id", "name", "docCreatorName", "createTime", "folder"]);
-}
-
-// ---------------- noun：词库 ----------------
-async function cmdNoun(args, json) {
-  const skill = need("skill", args);
-  const q = new URLSearchParams({ skillKey: skill });
-  if (args["source-type"]) q.append("sourceType", args["source-type"]);
-  if (args["source-group"]) q.append("sourceGroupId", args["source-group"]);
-  if (args["source-table"]) q.append("sourceTableId", args["source-table"]);
-  const r = await getUrl("/api/dw/newetl/chatBi/skill/getChatDocsBySkillKey?" + q.toString());
-  if (json) return r;
-  const data = r.data;
-  if (!data || !data.nouns) {
-    console.log("(该 skill 词库不存在或为空) msg=" + (r.msg || ""));
-    return;
-  }
-  console.log("== 名词解释 " + data.nouns.length + " 条 (skill=" + skill + ") ==");
-  for (const n of data.nouns) {
-    console.log("【" + (n.keyword || "") + "】" + (n.synonyms ? " 同义:" + n.synonyms : ""));
-    if (n.wordExplain) console.log("  " + String(n.wordExplain).replace(/\n/g, " "));
-  }
-}
-
-// ---------------- field：关联字段翻译 ----------------
-function customParamFromArgs(args) {
-  if (args["form-param"]) return { formParam: args["form-param"] };
-  if (args["eb-browser-param"]) return { ebBrowserForEditParam: readJsonArg(args["eb-browser-param"], "--eb-browser-param") };
-  if (args["property-type"]) return { propertyType: args["property-type"] };
-  return {};
-}
-function extractRemoteRows(r, browserType) {
-  const remote = r.remote || {};
-  const keys = Object.keys(remote);
-  const out = [];
-  for (const k of keys) {
-    if (Array.isArray(remote[k])) for (const it of remote[k]) out.push({ key: k, id: it.id, content: it.content ?? it.name ?? "" });
-  }
-  return out;
-}
-async function cmdFieldId2name(args, json) {
-  const module = need("module", args), type = need("type", args), idsVal = need("ids", args);
-  const dataIds = idsVal.split(",").map((s) => s.trim()).filter(Boolean);
-  const body = [{ module, browserType: type, dataIds, user: USER, customParam: customParamFromArgs(args) }];
-  const r = await postJson("/api/bcw/test/testRemoteBrowser", body);
-  if (json) return r;
-  const rows = extractRemoteRows(r, type);
-  if (!rows.length) {
-    const nf = (r.notFound || {});
-    const list = nf && nf[module + "_" + type] && nf[module + "_" + type].ids ? nf[module + "_" + type].ids : [];
-    console.log("(未翻译到名称) notFound ids: " + (list.join(",") || "全部"));
-    return;
-  }
-  printHuman("id→name (" + rows.length + "/" + dataIds.length + ")", rows, ["id", "content"]);
-}
-async function cmdFieldName2id(args, json) {
-  const module = need("module", args), type = need("type", args), name = need("name", args);
-  const body = { newly: 1, searchValue: name, ...customParamFromArgs(args) };
-  const url = "/api/" + module + "/common/browser/complete/" + type;
-  const r = await postJson(url, body);
-  if (json) return r;
-  const rows = ((r.data || {}).data) || [];
-  if (!rows.length) { console.log("(未匹配到名称对应 ID)"); return; }
-  printHuman("name→id 候选 " + rows.length + " 条", rows.map((x) => ({ id: x.id, name: x.name ?? x.title ?? "" })), ["id", "name"]);
-}
-
-// ---------------- conf：环境参数配置中心（chatBi config map） ----------------
-// 覆盖 config-resolve 原 resolve_config.py 的 URL 直连调用：get/batch/batch-file/group/group-file/resolve/resolve-file
-// 与管理 add/add-file/update/delete。认证复用进程内登录缓存（完整 Cookie + eteamsid，同 query/ds/doc），
-// 无内置令牌；baseUrl 取登录缓存（与 executeQueryDsl 同域）。confType 默认由 key 前缀推导
-// （CONN_→conn / DS_→ds / WF_→wf / API_→api），可用 --type 显式指定任意大类（如 data-source-query / system-config）。
-//
-// v0.1.9 confGroup（配置分组，可选）：
-//   后端在 confType=api 时支持按分组二次分层（如 api/workflow、api/hr），定位维度变为
-//   「confType + confGroup + confKey」。本 CLI 统一用 --group 传分组：
-//     · confType 为 api（或显式传了 --group）时，新增/更新/删除/单查 才下发 confGroup 字段，
-//       其他 confType 一律不带该字段，避免污染既有（无分组列）的配置类型。
-//     · conf group <confType> <confGroup> 走 batchGetChatBiConfigMapByTypeAndGroup 按类型+分组批量取回。
-const CONF_PREFIX_TYPE = [["CONN_", "conn"], ["DS_", "ds"], ["WF_", "wf"], ["API_", "api"]];
-const CONF_GET_PATH = "/api/dw/newetl/chatBi/getChatBiConfigMap";
-const CONF_BATCH_PATH = "/api/dw/newetl/chatBi/batchGetChatBiConfigMap";
-const CONF_BATCH_GROUP_PATH = "/api/dw/newetl/chatBi/batchGetChatBiConfigMapByTypeAndGroup";
-const CONF_ADD_PATH = "/api/dw/newetl/chatBi/batchAddChatBiConfigMap";
-const CONF_UPDATE_PATH = "/api/dw/newetl/chatBi/updateChatBiConfigMap";
-const CONF_DELETE_PATH = "/api/dw/newetl/chatBi/deleteChatBiConfigMap";
-const CONF_TOKEN_RE = /#\{([A-Z][A-Z0-9_]{2,})\}/g;
-function confKeyType(key, explicitType) {
-  if (explicitType) return explicitType;
-  for (const [p, t] of CONF_PREFIX_TYPE) if (key.startsWith(p)) return t;
-  throw new Error("无法由 confKey 推导 confType（需 CONN_/DS_/WF_/API_ 前缀或显式 --type）: " + key);
-}
-// confGroup 仅在 confType=api 或调用方显式指定时下发（见上方说明）
-function confUseGroup(ctype, group) {
-  return ctype === "api" || (group !== undefined && group !== null && group !== "");
-}
-function confPutGroup(body, ctype, group) {
-  if (confUseGroup(ctype, group)) body.confGroup = group === undefined || group === null ? "" : String(group);
-  return body;
-}
-function confGroupSuffix(ctype, group) { // GET/DELETE 用的 query 后缀
-  return confUseGroup(ctype, group) ? "&confGroup=" + encodeURIComponent(group === undefined || group === null ? "" : String(group)) : "";
-}
-function confItemId(it) { // 同 confKey 可分布在多个 confGroup，带分组时用「组|键」做映射键，避免互相覆盖
-  const g = it && it.confGroup;
-  return g ? g + "|" + (it.confKey || "") : ((it && it.confKey) || "");
-}
-function confLookup(map, it) { // 兼容后端回包是否带 confGroup：先按「组|键」取，再退化到 confKey
-  return map[confItemId(it)] || map[it.confKey];
-}
-function confFail(j, url) {
-  const m = (j && (j.msg || (j.actionMsg && j.actionMsg.message))) || "";
-  throw new Error("配置服务请求失败 [" + url + "]" + (m ? ": " + m : ""));
-}
-async function confRequest(method, url, bodyObj) {
-  const resp = await fetch(BASE + url, {
-    method,
-    headers: {
-      "accept": "application/json, text/plain, */*",
-      "langType": "zh_CN",
-      "cookie": auth.cookie,
-      "eteamsid": auth.eteamsid,
-      "ebbusinessid": EB_BIZ_ID,
-      "user-agent": UA,
-      ...(bodyObj !== undefined ? { "Content-Type": "application/json;charset=UTF-8" } : {}),
-    },
-    ...(bodyObj !== undefined ? { body: JSON.stringify(bodyObj) } : {}),
-  });
-  const text = await resp.text();
-  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
-  checkAuthFail(resp, text, j);
-  return j;
-}
-async function confGetData(ctype, key, silent, group) {
-  const url = CONF_GET_PATH + "?confType=" + encodeURIComponent(ctype) + "&confKey=" + encodeURIComponent(key) + confGroupSuffix(ctype, group);
-  let r;
-  try { r = await confRequest("GET", url); }
-  catch (e) { if (silent) return null; throw e; }
-  const data = (r && r.data) || null;
-  if (!silent && (!data || data.confValue === undefined || data.confValue === null || data.confValue === "")) {
-    throw new Error("配置不存在或为空: confType=" + ctype + (group ? " confGroup=" + group : "") + " confKey=" + key);
-  }
-  return data;
-}
-function confNormalizeBatch(payload) {
-  const data = (payload && payload.data) || null;
-  const out = {};
-  const put = (row, fallbackKey) => {
-    if (!row || typeof row !== "object") return;
-    const k = row.confKey || row.conf_key || fallbackKey;
-    if (!k) return;
-    if (row.confGroup === undefined) { const g = row.conf_group; if (g !== undefined && g !== null && g !== "") row.confGroup = g; }
-    out[confItemId({ confGroup: row.confGroup, confKey: k })] = row;
-  };
-  if (Array.isArray(data)) for (const row of data) put(row);
-  else if (data && typeof data === "object") for (const [k, v] of Object.entries(data)) put(v, k);
-  return out;
-}
-// 按类型+分组批量取回（batchGetChatBiConfigMapByTypeAndGroup），payload = [{confType, confGroup}...]
-async function confBatchByTypeAndGroup(pairs) {
-  const payload = pairs.map((p) => ({ confType: p.confType, confGroup: p.confGroup === undefined || p.confGroup === null ? "" : String(p.confGroup) }));
-  const r = await confRequest("POST", CONF_BATCH_GROUP_PATH, payload);
-  return confNormalizeBatch(r);
-}
-async function cmdConfGet(args, json, keys) {
-  const key = keys[0];
-  if (!key) throw new Error("conf get 缺少 confKey（用法: conf get <key> [--type t] [--group g]）");
-  const ctype = confKeyType(key, args.type);
-  let data;
-  try {
-    data = await confGetData(ctype, key, false, args.group);
-  } catch (e) {
-    if (ctype === "api" && !args.group) {
-      throw new Error(e.message + "（confType=api 建议用 --group 指定分组，如 --group workflow；或用 conf group api <分组> 查看该分组下全部配置）");
-    }
-    throw e;
-  }
-  if (json) return data;
-  console.log(JSON.stringify(data, null, 1));
-}
-async function cmdConfBatch(args, json, keys) {
-  if (!keys.length) throw new Error("conf batch 缺少 confKey 列表（用法: conf batch <key1> [key2 ...] [--type t] [--group g]）");
-  const items = keys.map((k) => { const t = confKeyType(k, args.type); return confPutGroup({ confType: t, confKey: k }, t, args.group); });
-  let map = {};
-  try {
-    const r = await confRequest("POST", CONF_BATCH_PATH, items);
-    map = confNormalizeBatch(r);
-    for (const it of items) {
-      const c = confLookup(map, it);
-      if (!c || c.confValue === undefined || c.confValue === null || c.confValue === "") {
-        throw new Error("批量响应缺失 confKey=" + it.confKey);
-      }
-    }
-  } catch (e) {
-    if (String(e.message).indexOf("批量响应缺失") === 0) throw e;
-    console.error("[config-resolve] 批量接口不可用，降级逐条单查: " + e.message);
-    map = {};
-    for (const it of items) map[confItemId(it)] = await confGetData(it.confType, it.confKey, false, it.confGroup);
-  }
-  if (json) return map;
-  printHuman("配置 " + items.length + " 条", keys.map((k) => {
-    const it = items.find((x) => x.confKey === k);
-    const c = confLookup(map, it) || {};
-    return { key: k, confType: it.confType, confGroup: it.confGroup ?? "", confValue: c.confValue ?? "", confName: c.confName ?? "" };
-  }), ["key", "confType", "confGroup", "confValue", "confName"]);
-}
-async function cmdConfBatchFile(args, json, keys) {
-  const val = flagOrPos(args, "batch-file", keys);
-  if (val === undefined) throw new Error("conf batch-file 缺少参数（用法: conf batch-file @items.json）");
-  const items = readJsonArg(String(val), "--batch-file");
-  const list = Array.isArray(items) ? items : [items];
-  const map = {};
-  const meta = {};
-  for (const it of list) {
-    if (!it.confKey || !it.confType) continue;
-    const id = confItemId(it);
-    map[id] = await confGetData(it.confType, it.confKey, false, it.confGroup);
-    meta[id] = it;
-  }
-  if (json) return map;
-  printHuman("配置 " + Object.keys(map).length + " 条", Object.keys(map).map((id) => ({ key: meta[id].confKey, confGroup: meta[id].confGroup ?? "", confValue: (map[id] || {}).confValue ?? "", confName: (map[id] || {}).confName ?? "" })), ["key", "confGroup", "confValue", "confName"]);
-}
-// 按类型+分组批量查（batchGetChatBiConfigMapByTypeAndGroup）：pairs = [{confType, confGroup}...]
-async function cmdConfGroup(args, json, keys) {
-  const ctype = keys[0] || args.type;
-  const group = keys[1] !== undefined ? keys[1] : args.group;
-  if (!ctype) throw new Error("conf group 缺少 confType（用法: conf group <confType> <confGroup> | --type api --group workflow）");
-  if (group === undefined) throw new Error("conf group 缺少 confGroup（用法: conf group <confType> <confGroup>）");
-  const map = await confBatchByTypeAndGroup([{ confType: ctype, confGroup: group }]);
-  const rows = Object.values(map);
-  const onlyKey = args.key;
-  const filtered = onlyKey ? rows.filter((r) => (r.confKey || r.conf_key) === onlyKey) : rows;
-  if (json) return onlyKey ? (filtered[0] ?? null) : filtered;
-  if (onlyKey && !filtered.length) throw new Error("配置不存在: confType=" + ctype + " confGroup=" + group + " confKey=" + onlyKey);
-  printHuman("confType=" + ctype + " confGroup=" + group + " 配置 " + filtered.length + " 条",
-    filtered.map((r) => ({ confKey: r.confKey || r.conf_key || "", confValue: r.confValue ?? "", confName: r.confName ?? "", confAttrs: r.confAttrs ?? "" })),
-    ["confKey", "confValue", "confName", "confAttrs"]);
-  return filtered;
-}
-async function cmdConfGroupFile(args, json, keys) {
-  const val = flagOrPos(args, "group-file", keys);
-  if (val === undefined) throw new Error("conf group-file 缺少参数（用法: conf group-file @items.json，形如 [{\"confType\":\"api\",\"confGroup\":\"workflow\"}]）");
-  const pairs = readJsonArg(String(val), "--group-file");
-  const list = (Array.isArray(pairs) ? pairs : [pairs]).filter((p) => p && p.confType);
-  if (!list.length) throw new Error("conf group-file 内容为空或缺少 confType");
-  const map = await confBatchByTypeAndGroup(list);
-  const rows = Object.values(map);
-  if (json) return map;
-  printHuman("批量分组配置 " + rows.length + " 条",
-    rows.map((r) => ({ confType: r.confType ?? "", confGroup: r.confGroup ?? "", confKey: r.confKey || r.conf_key || "", confValue: r.confValue ?? "", confName: r.confName ?? "" })),
-    ["confType", "confGroup", "confKey", "confValue", "confName"]);
-  return map;
-}
-async function confResolveAll(keys, group) {
-  // 多占位符：先批量预取一轮（失败降级逐条单查），返回 {key: data}
-  const items = keys.map((k) => confPutGroup({ confType: confKeyType(k, ""), confKey: k }, confKeyType(k, ""), group));
-  const map = {};
-  try {
-    const r = await confRequest("POST", CONF_BATCH_PATH, items);
-    const got = confNormalizeBatch(r);
-    for (const it of items) {
-      const c = confLookup(got, it);
-      if (!c || c.confValue === undefined || c.confValue === null || c.confValue === "") throw new Error("缺失 " + it.confKey);
-      map[it.confKey] = c;
-    }
-  } catch {
-    for (const it of items) map[it.confKey] = await confGetData(it.confType, it.confKey, false, it.confGroup);
-  }
-  return map;
-}
-async function confResolveText(text, json, group) {
-  const found = [...new Set([...text.matchAll(CONF_TOKEN_RE)].map((m) => m[1]))];
-  const map = found.length ? await confResolveAll(found, group) : {};
-  const out = text.replace(CONF_TOKEN_RE, (m0, k) => {
-    const cfg = map[k];
-    if (!cfg) throw new Error("配置不存在或为空: " + k);
-    return cfg.confValue ?? "";
-  });
-  if (json) return { input: text, output: out, resolved: Object.fromEntries(Object.entries(map).map(([k, v]) => [k, v.confValue ?? ""])) };
-  return out;
-}
-async function cmdConfResolve(args, json, keys) {
-  let text = keys[0];
-  if (!text) throw new Error("conf resolve 缺少文本（用法: conf resolve '<含#{KEY}文本>' | @file.txt [--group g]）");
-  if (text.startsWith("@")) text = fs.readFileSync(text.slice(1), "utf-8");
-  const out = await confResolveText(text, json, args.group);
-  if (json) { console.log(JSON.stringify(out, null, 1)); return out; }
-  process.stdout.write(out + "\n");
-}
-async function cmdConfResolveFile(args, json, keys) {
-  const p = flagOrPos(args, "resolve-file", keys);
-  if (!p) throw new Error("conf resolve-file 缺少文件路径（用法: conf resolve-file <文件路径> [--group g]）");
-  if (!fs.existsSync(p)) throw new Error("文件不存在: " + p);
-  const text = fs.readFileSync(p, "utf-8");
-  const out = await confResolveText(text, json, args.group);
-  if (json) { console.log(JSON.stringify(out, null, 1)); return out; }
-  process.stdout.write(out + "\n");
-}
-async function cmdConfAdd(args, json, keys) {
-  const key = keys[0];
-  if (!key || args.value === undefined) throw new Error("conf add 缺少 confKey/confValue（用法: conf add <key> --value <真实值> [--name] [--attrs] [--type] [--group] [--force]）");
-  const ctype = confKeyType(key, args.type);
-  if (!args.force && await confGetData(ctype, key, true, args.group)) {
-    console.error("[config-resolve] 配置已存在，跳过新增（如需修改请用 conf update；确需重建可先 conf delete）: " + key);
-    return null;
-  }
-  const item = confPutGroup({ confType: ctype, confKey: key, confValue: String(args.value), confAttrs: args.attrs || "", confName: args.name || "" }, ctype, args.group);
-  const r = await confRequest("POST", CONF_ADD_PATH, [item]);
-  if (json) return r;
-  console.log("新增成功: " + (item.confGroup ? item.confGroup + "/" : "") + key + " = " + item.confValue);
-}
-async function cmdConfAddFile(args, json, keys) {
-  const val = flagOrPos(args, "add-file", keys);
-  if (val === undefined) throw new Error("conf add-file 缺少参数（用法: conf add-file @items.json，元素形如 {confType,confGroup,confKey,confValue,confName,confAttrs}）");
-  const items = readJsonArg(String(val), "--add-file");
-  const list = Array.isArray(items) ? items : [items];
-  const toAdd = [];
-  for (const it of list) {
-    if (!it.confKey || it.confValue === undefined) continue;
-    const ctype = it.confType || confKeyType(it.confKey, args.type);
-    const group = it.confGroup !== undefined ? it.confGroup : args.group;
-    const dup = await confGetData(ctype, it.confKey, true, group);
-    if (dup) { console.error("[config-resolve] 已存在跳过: " + it.confKey); continue; }
-    toAdd.push(confPutGroup({ confType: ctype, confKey: it.confKey, confValue: String(it.confValue), confAttrs: it.confAttrs || "", confName: it.confName || "" }, ctype, group));
-  }
-  if (!toAdd.length) { console.log("全部已存在，无新增"); return null; }
-  const r = await confRequest("POST", CONF_ADD_PATH, toAdd);
-  if (json) return r;
-  console.log("批量新增 " + toAdd.length + " 条成功");
-}
-async function cmdConfUpdate(args, json, keys) {
-  const key = keys[0];
-  if (!key) throw new Error("conf update 缺少 confKey（用法: conf update <key> [--value v] [--name n] [--attrs a] [--type t] [--group g]）");
-  if (args.value === undefined && args.name === undefined && args.attrs === undefined) {
-    throw new Error("conf update 至少需提供 --value / --name / --attrs 之一");
-  }
-  const ctype = confKeyType(key, args.type);
-  const body = confPutGroup({ confType: ctype, confKey: key }, ctype, args.group);
-  if (args.value !== undefined) body.confValue = String(args.value);
-  if (args.name !== undefined) body.confName = args.name;
-  if (args.attrs !== undefined) body.confAttrs = args.attrs;
-  const r = await confRequest("POST", CONF_UPDATE_PATH, body);
-  if (json) return r;
-  console.log("更新成功: " + (body.confGroup ? body.confGroup + "/" : "") + key);
-}
-async function cmdConfDelete(args, json, keys) {
-  const key = keys[0];
-  if (!key) throw new Error("conf delete 缺少 confKey（用法: conf delete <key> [--type t] [--group g]）");
-  const ctype = confKeyType(key, args.type);
-  const url = CONF_DELETE_PATH + "?confType=" + encodeURIComponent(ctype) + "&confKey=" + encodeURIComponent(key) + confGroupSuffix(ctype, args.group);
-  const r = await confRequest("DELETE", url);
-  if (json) return r;
-  console.log("删除成功: " + (confUseGroup(ctype, args.group) && args.group ? args.group + "/" : "") + key);
-}
-async function cmdConf(sub, args, json, pos) {
-  const keys = pos.slice(2);
-  switch (sub) {
-    case "get": return cmdConfGet(args, json, keys);
-    case "batch": return cmdConfBatch(args, json, keys);
-    case "batch-file": return cmdConfBatchFile(args, json, keys);
-    case "group": return cmdConfGroup(args, json, keys);
-    case "group-file": return cmdConfGroupFile(args, json, keys);
-    case "resolve": return cmdConfResolve(args, json, keys);
-    case "resolve-file": return cmdConfResolveFile(args, json, keys);
-    case "add": return cmdConfAdd(args, json, keys);
-    case "add-file": return cmdConfAddFile(args, json, keys);
-    case "update": return cmdConfUpdate(args, json, keys);
-    case "delete": return cmdConfDelete(args, json, keys);
-    default: usage(); process.exit(1);
-  }
-}
-
-// ---------------- attend：考勤 REST 接口 ----------------
-// 2026-09-07：封装 /api/attend/web/attendInfoV2/getAttendInfoStatis（假期余额统计，hr-attendance 场景六病假/事假）。
-// 请求参数 {beginDate, endDate, userId}；返回 data.vacationBalanceList[]：{id,title,data:[{name,value,key}]}，
-// key 含 lastRemaining(历年可请)/remaining(今年可请)/total(总计可请)。
-function defaultMonthRange() {
-  const now = new Date();
-  const y = now.getFullYear();
-  const m = now.getMonth() + 1;
-  const lastDay = new Date(y, m, 0).getDate();
-  const p = (n) => String(n).padStart(2, "0");
-  return { begin: y + "-" + p(m) + "-01", end: y + "-" + p(m) + "-" + p(lastDay) };
-}
-async function cmdAttendStatis(args, json) {
-  const user = args.user || auth.userId || "";
-  if (!user) throw new Error("缺少查询人员：--user <人员ID>（查本人可不传，默认当前登录用户）");
-  const def = defaultMonthRange();
-  const body = { beginDate: args.begin || def.begin, endDate: args.end || def.end, userId: user };
-  const r = await postJson("/api/attend/web/attendInfoV2/getAttendInfoStatis", body);
-  if (json) return r;
-  if (String(r.code) !== "200") {
-    console.log("code=" + r.code + " msg=" + (r.msg || ""));
-    if (/没有权限|无权限|权限不足|未授权|无权访问|无查询权限/i.test(String(r.msg || ""))) {
-      throw new Error("当前用户对该人员考勤数据无查询权限，请检查 ETEAMSID 或联系管理员开通");
-    }
-    return;
-  }
-  const d = r.data || {};
-  const list = Array.isArray(d.vacationBalanceList) ? d.vacationBalanceList : [];
-  if (!list.length) { console.log("(空：该人员无假期余额数据) userId=" + user + " " + body.beginDate + "~" + body.endDate); return; }
-  console.log("== 考勤假期余额 userId=" + user + "（" + body.beginDate + " ~ " + body.endDate + "）==");
-  for (const item of list) {
-    console.log((item.title || item.id || "?") + (item.id ? " [" + item.id + "]" : ""));
-    if (Array.isArray(item.data) && item.data.length) {
-      console.log("  " + item.data.map((x) => (x.name || x.key) + "=" + (x.value ?? "")).join("  "));
-    }
-  }
-}
-
-// ---------------- exp：专家包版本管理（expert-repository） ----------------
-async function expGet(url) {
-  // 返回 {raw, j}：raw 用于正则提取大整数 id（commitId 19 位超 JS Number 精度，JSON.parse 会丢精度！）
-  const resp = await fetch(BASE + url, {
-    method: "GET",
-    headers: { "accept": "application/json, text/plain, */*", "langType": "zh_CN", "cookie": auth.cookie, "eteamsid": auth.eteamsid, "ebbusinessid": EB_BIZ_ID, "user-agent": UA },
-  });
-  const raw = await resp.text();
-  let j; try { j = parseJsonSafe(raw); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + raw.slice(0, 300)); }
-  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) throw new Error("登录态失效，请重新 e10-login oidc 登录");
-  return { raw, j };
-}
-function rawNum(raw, key) {
-  // 从原始 JSON 文本提取整数字段为精确字符串（避免 JSON.parse 大数丢精度，如 commitId）
-  const m = raw.match(new RegExp('"' + key + '":\\s*(\\d+)'));
-  return m ? m[1] : "";
-}
-function rawNumSeq(raw, key) {
-  // 提取某 key 全部整数序列（按出现顺序），如提交历史里的 commitId
-  const re = new RegExp('"' + key + '":\\s*(\\d+)', "g");
-  const out = []; let m;
-  while ((m = re.exec(raw)) !== null) out.push(m[1]);
-  return out;
-}
-const EXP_ALLOWED_DIRS = [".codebuddy-plugin", "agents", "avatars", "skills"];
-const EXP_SKIP_DIRS = [".git", ".workbuddy", "node_modules", "__pycache__"];
-const EXP_SKIP_FILES = [".sync-state.json"]; // 本地同步状态元文件（含基线 sha），永不随包提交
-function sha256(buf) { return crypto.createHash("sha256").update(buf).digest("hex"); }
-function walkDir(dir, root) {
-  const out = [];
-  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
-    const abs = path.join(dir, entry.name);
-    const rel = path.relative(root, abs).split(path.sep).join("/");
-    if (entry.isDirectory()) {
-      if (EXP_SKIP_DIRS.includes(entry.name)) continue;
-      const top = rel.split("/")[0];
-      if (rel.includes("/") && !EXP_ALLOWED_DIRS.includes(top)) continue; // 仅允许根文件+四大目录
-      walkDir(abs, root).forEach((x) => out.push(x));
-    } else if (entry.isFile()) {
-      if (EXP_SKIP_FILES.includes(entry.name)) continue; // .sync-state.json 不入包
-      const top = rel.split("/")[0];
-      if (!rel.includes("/") || EXP_ALLOWED_DIRS.includes(top)) out.push({ rel, abs });
-    }
-  }
-  return out;
-}
-function collectPackage(dir) {
-  if (!fs.existsSync(dir)) throw new Error("本地专家包目录不存在: " + dir);
-  return walkDir(dir, dir).map(({ rel, abs }) => {
-    const buf = fs.readFileSync(abs);
-    if (buf.length > 10 * 1024 * 1024) throw new Error("文件超 10MB 上限: " + rel);
-    return { relativePath: rel, contentBase64: buf.toString("base64"), sha256: sha256(buf), abs };
-  });
-}
-function localShaMap(dir) {
-  const map = {};
-  for (const f of walkDir(dir, dir)) map[f.rel] = sha256(fs.readFileSync(f.abs));
-  return map;
-}
-function expOk(r) {
-  if (!r) return false;
-  if (r.actionMsg) return String(r.actionMsg.code) === "0";
-  const code = r.code;
-  if (code === undefined) return !r.fail;
-  return String(code) === "0" || String(code) === "200";
-}
-function expFailMsg(r) {
-  if (r && r.actionMsg && String(r.actionMsg.code) !== "0") return r.actionMsg.message;
-  if (r && r.msg) return r.msg;
-  return "请求失败";
-}
-function printExpData(r, title) {
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  if (title) console.log("== " + title + " ==");
-  console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-async function rawGet(url) {
-  const resp = await fetch(BASE + url, {
-    method: "GET",
-    headers: { "accept": "*/*", "langType": "zh_CN", "cookie": auth.cookie, "eteamsid": auth.eteamsid, "ebbusinessid": EB_BIZ_ID, "user-agent": UA },
-  });
-  if (resp.status === 401) throw new Error("登录态失效，请重新 e10-login oidc 登录");
-  return Buffer.from(await resp.arrayBuffer());
-}
-async function expStatus(args, json) {
-  const expert = need("expert", args);
-  const { raw, j: r } = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  const d = r.data || {};
-  console.log("== 仓库状态 " + expert + " ==");
-  console.log("expertCode = " + (d.expertCode ?? ""));
-  console.log("displayName = " + (d.displayName ?? ""));
-  console.log("branchName = " + (d.branchName ?? ""));
-  console.log("headCommitId = " + (rawNum(raw, "headCommitId") || d.headCommitId));
-  console.log("headRevision = " + (d.headRevision ?? ""));
-  for (const k of ["headCommitHash", "headCommitMessage", "headCommitTime", "headAuthor", "protected"]) if (d[k] !== undefined) console.log(k + " = " + d[k]);
-  if (Array.isArray(d.locks) && d.locks.length) { console.log("有效锁:"); for (const l of d.locks) console.log("  " + JSON.stringify(l)); }
-}
-async function expManifest(args, json) {
-  const expert = need("expert", args);
-  let url = "/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main");
-  if (args.commit) url += "&commitId=" + encodeURIComponent(args.commit);
-  const r = await getUrl(url);
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  const items = r.data || [];
-  console.log("== 文件清单 " + items.length + " 项 ==");
-  printHuman("", items, ["relativePath", "sha256", "size", "action"]);
-}
-async function expCommits(args, json) {
-  const expert = need("expert", args);
-  const { raw, j: r } = await expGet("/api/dw/expert-repository/v1/repositories/commits?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  const rows = (r.data || []).map((x, i) => ({ ...x, commitId: (rawNumSeq(raw, "commitId")[i] || x.commitId) }));
-  console.log("== 提交历史 " + rows.length + " 条（commitId 为精确值，可复制用于 file/release/rollback）==");
-  printHuman("", rows, ["commitId", "submitMode", "author", "createTime", "message"]);
-}
-async function expFile(args, json) {
-  const expert = need("expert", args), commit = need("commit", args), rp = need("path", args);
-  const buf = await rawGet("/api/dw/expert-repository/v1/repositories/file?expertCode=" + encodeURIComponent(expert) + "&commitId=" + encodeURIComponent(commit) + "&relativePath=" + encodeURIComponent(rp));
-  if (args.out) { fs.writeFileSync(args.out, buf); console.log("已下载 " + buf.length + " 字节 -> " + args.out); return; }
-  if (json) { console.log(JSON.stringify({ relativePath: rp, size: buf.length, base64: buf.toString("base64") })); return; }
-  process.stdout.write(buf.toString("utf-8"));
-}
-// ---- exp 智能拉取：基线状态文件（三方差异保护，2026-09-04 实现）----
-// .sync-state.json 记录上次成功同步的 commitId/revision 与每文件 sha256（基线）。
-// pull 逐文件三方对比：local(当前本地) vs base(上次同步基线) vs remote(远端 manifest)，
-// 决策：仅远端改→覆盖；仅本地改→保留本地；双方都改→备份本地副本后覆盖（备份目录保留本地版）；
-// 无基线文件/基线无记录→保守备份后覆盖。拉取成功后把 .sync-state.json 更新为新 head。
-function syncStatePath(dir) { return path.join(dir, ".sync-state.json"); }
-function readSyncState(dir) {
-  const p = syncStatePath(dir);
-  if (!fs.existsSync(p)) return null;
-  try {
-    const j = JSON.parse(fs.readFileSync(p, "utf-8"));
-    const files = {};
-    for (const [rel, v] of Object.entries(j.files || {})) files[rel] = (typeof v === "string") ? v : (v.sha256 || "");
-    return { commitId: String(j.commitId || ""), headRevision: j.headRevision, files };
-  } catch { return null; }
-}
-function writeSyncState(dir, commitId, headRevision, fileShaMap) {
-  const files = {};
-  for (const [rel, sha] of Object.entries(fileShaMap)) files[rel] = { sha256: sha };
-  const obj = { commitId: String(commitId), headRevision, files, updateTime: new Date().toISOString() };
-  fs.writeFileSync(syncStatePath(dir), JSON.stringify(obj, null, 1), "utf-8");
-}
-async function expPull(args, json) {
-  const expert = need("expert", args), dir = need("dir", args);
-  const dry = !!args["dry-run"];
-  const force = !!args["force"]; // --force = 一律以远端覆盖（放弃本地修改）
-  const st = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-  if (!expOk(st.j)) throw new Error(expFailMsg(st.j));
-  const headId = rawNum(st.raw, "headCommitId") || String((st.j.data || {}).headCommitId);
-  const headRev = (st.j.data || {}).headRevision;
-  const mf = await expGet("/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-  if (!expOk(mf.j)) throw new Error(expFailMsg(mf.j));
-  const items = (mf.j.data || []).filter((f) => f.relativePath && f.relativePath !== "DELETE");
-  const local = fs.existsSync(dir) ? localShaMap(dir) : {};
-  const base = readSyncState(dir); // 基线：上次同步后的文件 sha（无则 null）
-  const baseCommit = (base && base.commitId) || "";
-  // 基线有效判定：上次同步 commitId 须在提交历史上（取不到历史就保守按无基线处理）
-  let backupRoot = "";
-  let downloaded = 0, unchanged = 0, preserved = 0, backed = 0, missing = 0;
-  const plan = []; // {rel, action, reason}
-  const mkBackupRoot = () => {
-    if (backupRoot) return backupRoot;
-    const absDir = path.resolve(dir);
-    const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
-    backupRoot = path.join(path.dirname(absDir), path.basename(absDir) + ".pull-backup-" + ts);
-    fs.mkdirSync(backupRoot, { recursive: true });
-    return backupRoot;
-  };
-  for (const it of items) {
-    const lp = path.join(dir, it.relativePath.split("/").join(path.sep));
-    const ls = local[it.relativePath];
-    const baseSha = (base && base.files) ? base.files[it.relativePath] : undefined;
-    if (ls === it.sha256) { unchanged++; continue; }
-    if (ls === undefined) { // 本地缺失 → 直接下载（新增/恢复）
-      missing++; plan.push({ rel: it.relativePath, action: dry ? "待下载" : "已下载", reason: "本地缺失" });
-    } else if (!force && baseSha !== undefined && ls === baseSha && baseSha !== it.sha256) {
-      // 仅远端改（本地未动，与基线一致）→ 覆盖
-      plan.push({ rel: it.relativePath, action: dry ? "待下载" : "已下载", reason: "远端更新（本地未动）" });
-    } else if (!force && baseSha !== undefined && baseSha === it.sha256) {
-      // 仅本地改（远端=基线，本地≠基线）→ 保留本地，不覆盖
-      preserved++; plan.push({ rel: it.relativePath, action: "保留本地", reason: "本地修改（远端未动）" });
-      continue;
-    } else { // 双方都改 / 无基线可判 / --force → 先备份本地副本再覆盖
-      backed++;
-      if (!dry && !force) {
-        const bdir = path.join(mkBackupRoot(), it.relativePath.split("/").join(path.sep));
-        fs.mkdirSync(path.dirname(bdir), { recursive: true });
-        fs.copyFileSync(lp, bdir);
-      }
-      plan.push({ rel: it.relativePath, action: dry ? "待下载(将备份本地)" : (force ? "已下载(force覆盖)" : "已下载(本地已备份)"), reason: (force ? "force 覆盖" : (baseSha === undefined ? "无基线记录" : "双方都改")) });
-    }
-    if (dry) continue;
-    fs.mkdirSync(path.dirname(lp), { recursive: true });
-    const buf = await rawGet("/api/dw/expert-repository/v1/repositories/file?expertCode=" + encodeURIComponent(expert) + "&commitId=" + encodeURIComponent(headId) + "&relativePath=" + encodeURIComponent(it.relativePath));
-    fs.writeFileSync(lp, buf);
-    downloaded++;
-  }
-  // 拉取成功后更新基线状态文件（记录新 head + 本地最终文件 sha）
-  if (!dry) {
-    const finalLocal = localShaMap(dir);
-    writeSyncState(dir, headId, headRev, finalLocal);
-  }
-  const out = { expert, headCommitId: headId, headRevision: headRev, total: items.length, unchanged, downloaded, preserved, backed, missing, dryRun: !!dry, backupDir: backupRoot || undefined };
-  if (json) { console.log(JSON.stringify(out)); return; }
-  console.log("== pull " + expert + "@" + headId + (dry ? " (dry-run)" : "") + " ==");
-  console.log("清单 " + out.total + " 项 | 未变 " + unchanged + " | 已下载 " + downloaded + " | 保留本地 " + preserved + " | 覆盖前备份 " + backed + " | 缺失 " + missing);
-  for (const p of plan.slice(0, 40)) console.log("  [" + p.action + "] " + p.rel + (p.reason ? "（" + p.reason + "）" : ""));
-  if (plan.length > 40) console.log("  ... 共 " + plan.length + " 个文件");
-  if (backupRoot && !dry) console.log("本地修改副本备份于: " + backupRoot);
-  if (preserved > 0 && !dry) console.log("⚠️ " + preserved + " 个文件因含本地修改被保留（远端未改）；如需强制覆盖请加 --force");
-}
-async function expInit(args, json) {
-  const expert = need("expert", args), dir = need("dir", args);
-  const files = collectPackage(dir);
-  const body = { expertCode: expert, displayName: args["display-name"] || expert, branchName: args.branch || "main",
-    description: args.description || "", initialCommitMessage: args.message || "初始化导入", files };
-  const r = await postJson("/api/dw/expert-repository/v1/repositories", body);
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  console.log("== 仓库已创建 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-async function expCommit(args, json) {
-  const expert = need("expert", args), dir = need("dir", args), msg = need("message", args);
-  const mode = (args.mode || "FULL_SNAPSHOT").toUpperCase();
-  const st = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-  if (!expOk(st.j)) throw new Error("无法获取基线: " + expFailMsg(st.j));
-  const base = st.j.data || {};
-  const body = {
-    branchName: base.branchName || "main",
-    baseCommitId: rawNum(st.raw, "headCommitId") || String(base.headCommitId), // 精确字符串，避免大数丢精度
-    baseRevision: base.headRevision,
-    commitMessage: msg,
-  };
-  if (mode === "FILE_PATCH") {
-    const mf = await expGet("/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
-    if (!expOk(mf.j)) throw new Error("无法获取 manifest: " + expFailMsg(mf.j));
-    const remoteSha = {}; for (const f of (mf.j.data || [])) remoteSha[f.relativePath] = f.sha256;
-    const local = collectPackage(dir);
-    const localSha = {}; for (const f of local) localSha[f.relativePath] = f.sha256;
-    const changes = [];
-    for (const f of local) {
-      const rs = remoteSha[f.relativePath];
-      if (rs === undefined) changes.push({ operation: "ADD", relativePath: f.relativePath, contentBase64: f.contentBase64, sha256: f.sha256, baseFileSha256: "" });
-      else if (rs !== f.sha256) changes.push({ operation: "MODIFY", relativePath: f.relativePath, contentBase64: f.contentBase64, sha256: f.sha256, baseFileSha256: rs });
-    }
-    for (const rp of Object.keys(remoteSha)) if (localSha[rp] === undefined) changes.push({ operation: "DELETE", relativePath: rp, baseFileSha256: remoteSha[rp] });
-    if (!changes.length) throw new Error("本地与远端一致，无变更可提交");
-    body.submitMode = "FILE_PATCH"; body.changes = changes;
-  } else {
-    body.submitMode = "FULL_SNAPSHOT"; body.files = collectPackage(dir);
-  }
-  const r = await postJson("/api/dw/expert-repository/v1/repositories/commits?expertCode=" + encodeURIComponent(expert), body);
-  if (json) return r;
-  if (!expOk(r)) {
-    const m = expFailMsg(r);
-    if (/基线|过期|revision|冲突/i.test(m)) throw new Error("提交冲突: " + m + " —— 请先 exp pull 拉取最新并合并后重试");
-    throw new Error("提交失败: " + m);
-  }
-  // 提交成功后把本地 .sync-state.json 基线刷新到新 head（与本地文件 sha 一致），保证后续 pull 三方判定准确
-  const rj = r.data || {};
-  const newHead = rawNum(JSON.stringify(r), "headCommitId") || rawNum(JSON.stringify(r), "commitId") || rj.headCommitId || rj.commitId || "";
-  if (newHead && fs.existsSync(dir)) {
-    try { writeSyncState(dir, newHead, rj.headRevision ?? rj.revision ?? 0, localShaMap(dir)); } catch {}
-  }
-  console.log("== 提交成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-async function expLock(args, json) {
-  const expert = need("expert", args);
-  const act = (args.action || "").toLowerCase();
-  const branch = args.branch || "main";
-  if (act === "query") {
-    const r = await getUrl("/api/dw/expert-repository/v1/repositories/locks?expertCode=" + encodeURIComponent(expert) + "&branchName=" + encodeURIComponent(branch));
-    if (json) return r;
-    if (!expOk(r)) throw new Error(expFailMsg(r));
-    printExpData(r, "有效锁");
-    return;
-  }
-  if (act === "heartbeat") {
-    const token = need("lock-token", args);
-    const r = await postJson("/api/dw/expert-repository/v1/repositories/locks/heartbeat?lockToken=" + encodeURIComponent(token), {});
-    if (json) return r;
-    if (!expOk(r)) throw new Error(expFailMsg(r));
-    console.log("锁已续期: " + JSON.stringify(r.data ?? {}));
-    return;
-  }
-  if (act === "release") {
-    const token = need("lock-token", args);
-    const req = new Request(BASE + "/api/dw/expert-repository/v1/repositories/locks?lockToken=" + encodeURIComponent(token), { method: "DELETE" });
-    const resp = await fetch(req, { headers: { "cookie": auth.cookie, "eteamsid": auth.eteamsid, "accept": "application/json" } });
-    const text = await resp.text();
-    let r; try { r = JSON.parse(text); } catch { r = { data: { raw: text } }; }
-    if (json) return r;
-    if (!expOk(r)) throw new Error(expFailMsg(r));
-    console.log("锁已释放");
-    return;
-  }
-  // acquire（默认）
-  const body = { branchName: branch, componentKey: args.component || "ROOT", ttlMinutes: parseInt(args.ttl || "30", 10) };
-  const r = await postJson("/api/dw/expert-repository/v1/repositories/locks?expertCode=" + encodeURIComponent(expert), body);
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  console.log("== 锁已获取（记录 lockToken 供 heartbeat/release/commit 使用）==");
-  console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-async function expRelease(args, json) {
-  const expert = need("expert", args);
-  const r = await postJson("/api/dw/expert-repository/v1/repositories/releases?expertCode=" + encodeURIComponent(expert),
-    { commitId: need("commit", args), versionTag: need("version", args), releaseNote: args.note || "" });
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  console.log("== 发布成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-async function expRollback(args, json) {
-  const expert = need("expert", args);
-  const r = await postJson("/api/dw/expert-repository/v1/repositories/releases/rollback?expertCode=" + encodeURIComponent(expert) + "&versionTag=" + encodeURIComponent(need("version", args)), {});
-  if (json) return r;
-  if (!expOk(r)) throw new Error(expFailMsg(r));
-  console.log("== 回滚成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
-}
-
-// ---------------- main ----------------
-function usage() {
-  console.log(`e10-data CLI（data-assistant 数据接口统一命令行，2026-09-03 扩展）
-用法: node e10-data.mjs <族> <子命令> [--参数]   通用 --json 原样输出
-
-login   登录（**唯一不需要已有凭据**的命令族；其余命令都要求先有登录态）
-  login xiaoe-env [--domain <url>]   # 用环境变量 XIAOE_USER_TOKEN + XIAOE_DOMAIN（XiaoE 全局 token）
-                                     # 换 ETEAMSID 并写入 profile（免浏览器；不依赖 python）
-                                     # --domain 缺省 = 当前 profile 的 config.json.baseUrl → 默认平台地址
-                                     # 依赖环境变量：XIAOE_USER_TOKEN（XiaoE token）、XIAOE_DOMAIN（erpa 域名）
-                                     # 别名 e10-data xiaoe-env（与 e10-login 同名命令一致）
-                                     # 说明：换 token 由本 CLI 原生完成；写 profile（auth 加密）仍交 e10-login set
-                                     #       成功后自动用取数链路自检读回凭据，读不回即报错（不假成功）
-
-query   DSL 数据查询 executeQueryDsl
-  query  --conn <connId> --model <ebuilder|flow|eteams|attend|hr|document|dw|blog> --schema <数据库> [--table-id <流程ID>] [--debug true|false] --dsl @file.json|'{...}'
-ds      数据源（业务模块）取数与元数据
-  ds tables  --group <gid> [--name 关键词] [--app-id <id>]
-  ds fields  --group <gid> --table <tid> [--app-id <id>]
-  ds list    --group <gid> --table <tid> --fields a,b [--where @f|json] [--order "f asc"] [--page N] [--size N] [--app-id <id>]
-  ds chart   --group <gid> --table <tid> --group-by g1,g2 --stat @f.json [--where ...] [--app-id <id>]
-  ds stat    --group <gid> --table <tid> --stat @f.json [--where ...] [--app-id <id>]
-  ds count   --group <gid> --table <tid> [--where ...] [--app-id <id>]
-  （ds 通用 --source-type LOGIC|ETEAMS，默认 LOGIC）
-  （ds 取数的 appId：一律**显式传入** --app-id <id>（v0.1.14 起 CLI 不再自动反查）。
-     EB 建模表单（groupId=weaver-ebuilder-form-service）必须带：该值取自 chat_bi_eb_config_map 的权限校验查询
-     ——调用方先查权限（无权限即终止、不取数），同一条记录的 app_id 即本次必带的 appId；
-     其他数据集可不传，CLI 不拦截、以接口报错为准；--app-id auto / --no-app-id 已废弃，等同不传）
-  --where 过滤条件（v0.1.8 起支持树形 OR，递归）：
-    数组 = AND 根： [{"fieldId":"f1","conditionType":"Date","compareType":"range","conditionValue":"2026-09~2026-10"},{"fieldId":"f2",...}]
-    对象 = 完整树： {"relationship":"0","conditionList":[{"fieldId":"f1",...},{"fieldId":"f2",...}]}   # "0"=OR、"1"=AND，缺省 AND
-    数组元素可内嵌条件组 {"relationship":"0","conditionList":[...]} 实现 (A AND B) OR (C AND D)
-    叶子键 fieldId/conditionId 均可（fieldId 优先）；缺少字段的叶子会直接报错（不再静默当全表）
-doc     文档查询
-  doc count  [--name 关键词] [--creator id1,id2] [--author id1,id2] [--content-type office] [--time "起~止"] [--last-time "起~止"] [--folder id,id|--folder-neq id,id]
-  doc list   [同上条件] [--all 翻页到底] [--page N] [--size 100]
-noun    词库查询
-  noun list --skill <skillKey> [--source-type LOGIC] [--source-group gid] [--source-table tid]（数据源场景带三参数）
-field   关联字段翻译
-  field id2name  --module <m> --type <t> --ids id1,id2 [--form-param '{"fieldId":"..","module":"ebuilderform"}'|--eb-browser-param '{..}'|--property-type x]
-  field name2id  --module <m> --type <t> --name 名称 [同上附加参数]
-conf    环境参数配置中心（chatBi config map，替代 config-resolve 脚本 URL 直连；confType 默认由 CONN_/DS_/WF_/API_ 前缀推导，可 --type 显式）
-        confGroup（配置分组，v0.1.9 新增，可选）：confType=api 时后端支持二级分层（如 api/workflow），
-        定位维度 = confType+confGroup+confKey；仅 confType=api（或显式传 --group）时才下发 confGroup，其他类型不带该字段
-  conf get <key> [--type t] [--group g]           # 单查（confValue/confAttrs/confName 全量 JSON）
-  conf batch <key1> [key2 ...] [--type t] [--group g]   # 批量查（批量接口异常自动降级逐条单查）
-  conf batch-file @items.json                     # 按 [{confType,confGroup,confKey}..] 显式批量查（支持任意 confType）
-  conf group <confType> <confGroup> [--key k]     # 按类型+分组批量查（batchGetChatBiConfigMapByTypeAndGroup）
-  conf group-file @items.json                     # 按 [{"confType":"api","confGroup":"workflow"}..] 多分组批量查
-  conf resolve '<含#{KEY}文本>'|@file.txt [--group g]   # 文本占位符替换为真实值（含中文建议 @file）
-  conf resolve-file <文件路径> [--group g]          # 读文件替换全部占位符并打印（不改写原文件）
-  conf add <key> --value <真实值> [--name 说明] [--attrs '{"request":..,"response":..}'] [--type t] [--group g] [--force]  # 新增（默认判重，已存在跳过）
-  conf add-file @items.json                       # JSON 数组批量新增（逐条判重，元素可带 confGroup）
-  conf update <key> [--value v] [--name n] [--attrs a] [--type t] [--group g]   # 更新（confType+confGroup+confKey 定位，传哪个字段更哪个）
-  conf delete <key> [--type t] [--group g]        # 删除
-  示例: conf group api workflow | conf add GET_WORKFLOW_LIST --type api --group workflow --value /api/workflow/getList --name 查询流程列表
-exp     专家包版本管理（expert-repository/v1，响应以 data.actionMsg.code=0 判成功）
-  exp status    --expert <code> [--branch main]                       # 仓库状态（headCommitId/headRevision=提交基线）
-  exp manifest  --expert <code> [--commit <id>]                       # 文件清单（sha256）
-  exp commits   --expert <code>                                       # 提交历史
-  exp file      --expert <code> --commit <id> --path <相对路径> [--out 本地文件]
-  exp pull      --expert <code> --dir <本地专家包目录> [--dry-run] [--force]   # 智能拉取：基线三方对比（仅远端改→覆盖/仅本地改→保留/双方都改→备份后覆盖；--force 一律覆盖），成功后更新 .sync-state.json 基线
-  exp init      --expert <code> --dir <本地目录> [--display-name X] [--message 初始化导入]
-  exp commit    --expert <code> --dir <本地目录> --message "..." [--mode FULL_SNAPSHOT|FILE_PATCH]
-  exp lock      --expert <code> --action query|acquire(默认)|heartbeat|release --component ROOT --ttl 30 --lock-token <token>
-  exp release   --expert <code> --commit <id> --version vX.Y.Z [--note 说明]
-  exp rollback  --expert <code> --version vX.Y.Z
-attend  考勤 REST 接口（2026-09-07 新增，hr-attendance 病假/事假等假期余额）
-  attend statis [--user <人员ID>] [--begin 2026-09-01] [--end 2026-09-30]   # getAttendInfoStatis 假期余额统计；--user 默认当前登录用户，--begin/--end 默认当月
-eb      EB 建模表单权限校验（chatBi EB 配置映射分页查询，替代 DSL 查 chat_bi_eb_config_map）
-  eb perm-page --obj-id <id> --form-table <物理表名> [--page N] [--size N] [--app-id <id>] [--require]
-      # obj-id / form-table 必填（本地强校验；缺失后端只回空、不报错）
-      # obj-id / app-id 必须字符串传参（19 位大整数，Number 舍入 → 静默 total=0）
-      # total>=1 = 有权限，并回带该行 appId；--require 时 total=0 直接报错退出
-认证: 加解密由 e10-login 负责（本 CLI 不参与）；凭据出口 = e10-login auth/whoami（自动同步镜像）；皆无请先 e10-login oidc
-      （无浏览器/无 python 环境：login xiaoe-env 用环境变量 token 直接登录）`);
-}
-
-async function main() {
-  const rawArgv = process.argv.slice(2);
-  // 仅当顶层显式 -v/--version（无子命令）时打印版本；exp release/rollback 的 --version 是版本号参数、conf 文本可能含 version 字样，一律放行
-  if (rawArgv.length === 1 && (rawArgv[0] === "--version" || rawArgv[0] === "-v")) {
-    console.log("e10-data " + cliVersion());
-    process.exit(0);
-  }
-  const { args, pos } = parseArgs(rawArgv);
-  if (!pos.length) { usage(); process.exit(1); }
-  const family = pos[0], sub = pos[1], json = !!args.json;
-  let result;
-  if (family === "ds") {
-    if (!sub) { usage(); process.exit(1); }
-    switch (sub) {
-      case "tables": result = await cmdTables(args, json); break;
-      case "fields": result = await cmdFields(args, json); break;
-      case "list": result = await cmdList(args, json); break;
-      case "chart": result = await cmdChart(args, json); break;
-      case "stat": result = await cmdStat(args, json); break;
-      case "count": result = await cmdCount(args, json); break;
-      default: usage(); process.exit(1);
-    }
-  } else if (family === "query") {
-    result = await cmdQuery(args, json);
-  } else if (family === "doc") {
-    if (sub === "count") result = await cmdDocCount(args, json);
-    else if (sub === "list") result = await cmdDocList(args, json);
-    else { usage(); process.exit(1); }
-  } else if (family === "noun") {
-    if (sub === "list") result = await cmdNoun(args, json);
-    else { usage(); process.exit(1); }
-  } else if (family === "field") {
-    if (sub === "id2name") result = await cmdFieldId2name(args, json);
-    else if (sub === "name2id") result = await cmdFieldName2id(args, json);
-    else { usage(); process.exit(1); }
-  } else if (family === "conf") {
-    if (!sub) { usage(); process.exit(1); }
-    result = await cmdConf(sub, args, json, pos);
-  } else if (family === "exp") {
-    if (!sub) { usage(); process.exit(1); }
-    switch (sub) {
-      case "status": result = await expStatus(args, json); break;
-      case "manifest": result = await expManifest(args, json); break;
-      case "commits": result = await expCommits(args, json); break;
-      case "file": result = await expFile(args, json); break;
-      case "pull": result = await expPull(args, json); break;
-      case "init": result = await expInit(args, json); break;
-      case "commit": result = await expCommit(args, json); break;
-      case "lock": result = await expLock(args, json); break;
-      case "release": result = await expRelease(args, json); break;
-      case "rollback": result = await expRollback(args, json); break;
-      default: usage(); process.exit(1);
-    }
-  } else if (family === "attend") {
-    if (sub === "statis") result = await cmdAttendStatis(args, json);
-    else { usage(); process.exit(1); }
-  } else if (family === "eb") {
-    if (!sub) { usage(); process.exit(1); }
-    switch (sub) {
-      case "perm-page": result = await cmdEbPermPage(args, json); break;
-      default: usage(); process.exit(1);
-    }
-  } else { usage(); process.exit(1); }
-  if (json && result !== undefined) console.log(JSON.stringify(result, null, 1));
-}
-main().catch((e) => { console.error("ERROR: " + e.message); process.exit(1); });
+#!/usr/bin/env node
+// -*- coding: utf-8 -*-
+/**
+ * e10-data CLI —— data-assistant 专家统一数据接口命令行（2026-09-03 扩展）
+ *
+ * 覆盖（数据查询链路全部家族；登录/HRM 复用 e10-login / hrm-cli，checkEbModulePermission 已废弃不提供）：
+ *   e10-data login  xiaoe-env [--domain <url>]   **无凭据时**用环境变量 XIAOE_USER_TOKEN + XIAOE_DOMAIN
+ *                   （XiaoE 全局 token）换 ETEAMSID 并落 profile（免浏览器/免 python；2026-09-17 移植）
+ *   e10-data query    DSL 查询 executeQueryDsl（conn/model/schema/tableId/dslQuery/debug）
+ *   e10-data ds     groups|find|describe|tables|fields|fields-dsl|list|chart|stat|count
+ *                   数据源（业务模块）取数与元数据
+ *                   groups  内置分组清单（仅作 find 的默认扫描集）
+ *                   find    跨分组找表（进程内并发扇出；产物=候选表清单 + 路由建议，不取数）
+ *                   describe 一次并发取回「字段 + 词库」（不做权限校验，EB 权限仍走 eb perm-page）
+ *                   appId 一律由调用方显式传入（v0.1.14 起 CLI 不再自动反查）：
+ *                   EB 建模表单（groupId=weaver-ebuilder-form-service）取数必须带 --app-id <id>，
+ *                   该值只能来自 chat_bi_eb_config_map 的权限校验查询（同一次查询给出权限与 appId）；
+ *                   不带 appId 时按原样发送，由后端报错（CLI 不做拦截）
+ *   e10-data doc    count|list   文档查询 documentListCount / documentList
+ *   e10-data noun   list         词库 getChatDocsBySkillKey
+ *   e10-data field  id2name|name2id  关联字段翻译 testRemoteBrowser / complete
+ *   e10-data conf   get|batch|batch-file|group|group-file|resolve|resolve-file|add|add-file|update|delete
+ *                              环境参数配置中心（chatBi config map，替代 config-resolve 脚本 URL 直连；
+ *                              confType=api 时支持 confGroup 分组二级定位，见 --group）
+ *   e10-data attend statis     考勤假期余额统计 getAttendInfoStatis（hr-attendance 病假/事假，2026-09-07）
+ *
+ * 通用：--json 原样输出；复杂 JSON 参数支持 @文件 或 内联（中文走 @文件 更稳）
+ * 认证：凭据**唯一来源 = weaver-work-cli**（本 CLI 不实现任何加解密，**不设 e10-login 回退**）：
+ *   weaver-work-cli auth export-weaver-env —— 解析 WEAVER_BASE_URL / WEAVER_ETEAMSID / WEAVER_COOKIE
+ *   e10-login 系出口 / 明文镜像已于 2026-09-24 停用；未登录时提示 `weaver-work-cli auth login`
+ *   例外：`login xiaoe-env` 在"还没有任何凭据"时可独立完成登录（换 token 自己算，落 profile 仍交 e10-login）
+ *
+ * 用法示例：
+ *   node e10-data.mjs query  --conn 1144919996804022272 --model dw --schema dw --dsl @q.json
+ *   node e10-data.mjs ds count --group weaver-project-servicetask --table 715738355537494016
+ *   node e10-data.mjs doc count --name 测试
+ *   node e10-data.mjs noun list --skill rd-department
+ *   node e10-data.mjs field id2name --module ebuilder/form --type ebuilder \
+ *        --ids 3194494277170470571 --form-param '{"fieldId":"966849910772850766","module":"ebuilderform"}'
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import crypto from "node:crypto";
+import net from "node:net";
+import { spawn, spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+function cliVersion() {
+  try { return JSON.parse(fs.readFileSync(path.join(__dirname, "..", "package.json"), "utf-8")).version; }
+  catch { return "dev"; }
+}
+
+const UA = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36";
+const EB_BIZ_ID = "10000000000000000";
+
+// ---------------- 认证（加解密全部交由 e10-login，本 CLI 不再实现任何加解密）----------------
+// 背景：auth 文件由 e10-login 自己的密钥体系加密 —— e10-login 1.5.0 起为「每机随机密钥 + OS keychain
+//   （@napi-rs/keyring，service=e10-cli / account=auth-key；keychain 不可用才落 ~/.e10-cli/.key）」，
+//   早期版本为固定 seed。**只有 e10-login 解得开**，所以本 CLI 只负责「向 e10-login 要明文凭据」，
+//   不再自行解密 —— e10-login 以后更换密钥体系 / 算法 / profile 机制，本 CLI 都无需改动。
+// 凭据出口优先级（命中即返回；命中的"模式名"会记入 ~/.e10-cli/.e10-data-auth-mode，只存模式、不存凭据）：
+//   ① e10-login auth --json      正式契约（推荐 e10-login 侧新增；一旦可用自动优先）
+//   ② e10-login whoami --json    其 JSON 输出带 cookies 字段时可用
+//   ③ e10-login whoami           文本输出解析（当前 e10-login 1.5.0 的实际可用路径）
+//   ④ ~/.workbuddy/e10-login-cache.md 明文镜像 —— 最后兜底，命中时打印告警（该文件可能已过期）
+// 环境变量：E10_DATA_AUTH_PROBE=1 强制重新探测优先级；E10_DATA_AUTH_MODE=<模式名> 手动指定；
+//   E10_DATA_QUIET=1 抑制告警输出（告警一律走 stderr，不污染 --json 的 stdout）。
+const AUTH_MODE_FILE = path.join(os.homedir(), ".e10-cli", ".e10-data-auth-mode");
+
+/** 定位当前 profile 的 auth 文件（仅用于"是否已登录"的判断与报错提示，本 CLI 不读其内容做解密） */
+function authFilePath() {
+  const home = os.homedir();
+  let profile = "default";
+  try {
+    const activeFile = path.join(home, ".e10-cli", "profile");
+    if (fs.existsSync(activeFile)) { const n = fs.readFileSync(activeFile, "utf-8").trim(); if (n) profile = n; }
+  } catch {}
+  return { profile, file: path.join(home, ".e10-cli", "profiles", profile, "auth") };
+}
+
+// ---------------- e10-login 入口解析（v0.1.17：去掉 shell:true，这是最大的性能改动）----------------
+// 背景（2026-09-20 实测）：`spawnSync("e10-login", …, { shell: true })` 在 Windows 上会先起一层
+//   cmd.exe；该层**单独**耗时 ~0.98~1.04s（杀软对每个新进程的实时扫描所致），而 e10-login 自身
+//   的活（读 profile + 解密 auth + 打印）只花 ~0.1s。改为「定位 e10-login 的 JS 入口，用
+//   process.execPath 直接拉起」后，实测 **1.0s → 0.22s**（每调用省 ~0.78s）。
+// ⚠️ 不能直接 spawn `e10-login.cmd`：Node ≥18.20/20.12 起为修 CVE-2024-27980，禁止在 shell:false
+//   下执行 .cmd/.bat（抛 EINVAL）。因此必须解析到 .cmd shim 背后**真正的 .js 入口**。
+// 解析顺序：① 环境变量 E10_LOGIN_ENTRY → ② Node 模块解析（与 e10-data 同 prefix 时命中）
+//   → ③ 沿 PATH 找 shim，再取 <shimDir>/node_modules/e10-login → ④ 常见全局前缀兜底。
+//   全部失败 → 返回 null，调用方退化回 shell:true（保持旧行为可用，只慢不错）。
+let _loginEntry;          // 进程内缓存解析结果；null 表示"已尝试但未找到"
+let _loginEntryDone = false;
+
+function resolveLoginEntry() {
+  if (_loginEntryDone) return _loginEntry;
+  _loginEntryDone = true;
+  const tried = [];
+  const isFile = (p) => { try { return !!p && fs.statSync(p).isFile(); } catch { return false; } };
+
+  /** 读 <dir>/package.json 的 bin 字段定位入口文件；非 e10-login 包返回 null */
+  const entryFromPkgDir = (dir) => {
+    try {
+      const pj = path.join(dir, "package.json");
+      if (!isFile(pj)) return null;
+      const j = JSON.parse(fs.readFileSync(pj, "utf-8"));
+      if (j.name !== "e10-login") return null;
+      let b = j.bin;
+      if (typeof b === "string") b = { "e10-login": b };
+      const rel = b && b["e10-login"];
+      if (!rel) return null;
+      const entry = path.resolve(dir, rel);
+      return isFile(entry) ? entry : null;
+    } catch { return null; }
+  };
+
+  // ① 环境变量显式指定（排障与特殊安装方式用）
+  const envEntry = (process.env.E10_LOGIN_ENTRY || "").trim();
+  if (envEntry) {
+    if (isFile(envEntry)) { _loginEntry = envEntry; return _loginEntry; }
+    tried.push("E10_LOGIN_ENTRY 指向的文件不存在: " + envEntry);
+  }
+
+  // ② Node 模块解析（e10-data 与 e10-login 装在同一个 prefix 时命中）
+  try {
+    const pj = createRequire(import.meta.url).resolve("e10-login/package.json");
+    const e = entryFromPkgDir(path.dirname(pj));
+    if (e) { _loginEntry = e; return _loginEntry; }
+    tried.push("模块解析命中 " + pj + " 但 bin 入口不可用");
+  } catch (e) { tried.push("模块解析: " + ((e && e.message) || e)); }
+
+  // ③ 沿 PATH 找 shim，再取 shim 同级的 node_modules/e10-login
+  //    （npm 全局安装的常规布局：<prefix>/e10-login.cmd + <prefix>/node_modules/e10-login）
+  const pathDirs = String(process.env.PATH || "").split(path.delimiter).filter(Boolean);
+  const shimNames = process.platform === "win32"
+    ? ["e10-login.cmd", "e10-login.exe", "e10-login"]
+    : ["e10-login"];
+  for (const d of pathDirs) {
+    for (const n of shimNames) {
+      const shim = path.join(d, n);
+      if (!isFile(shim)) continue;
+      const e = entryFromPkgDir(path.join(d, "node_modules", "e10-login"));
+      if (e) { _loginEntry = e; return _loginEntry; }
+      tried.push("找到 shim " + shim + "，但其同级 node_modules/e10-login 不可用");
+    }
+  }
+
+  // ④ 常见全局前缀兜底
+  const home = os.homedir();
+  const prefixes = [
+    path.join(path.dirname(process.execPath), "node_modules"),
+    path.join(path.dirname(process.execPath), "..", "lib", "node_modules"),
+    path.join(home, ".npm-global", "lib", "node_modules"),
+    process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules") : null,
+    process.env.ProgramFiles ? path.join(process.env.ProgramFiles, "nodejs", "node_modules") : null,
+  ].filter(Boolean);
+  for (const p of prefixes) {
+    const e = entryFromPkgDir(path.join(p, "e10-login"));
+    if (e) { _loginEntry = e; return _loginEntry; }
+  }
+  tried.push("常见全局前缀均未命中: " + prefixes.join(" | "));
+
+  if (!process.env.E10_DATA_QUIET) {
+    console.error("[e10-data][warn] 未定位到 e10-login 的 JS 入口，本次退化为 shell 调用（较慢，且 Windows 上多花约 1 秒）。"
+      + "可用 E10_LOGIN_ENTRY=<e10-login/bin/e10-login.js 绝对路径> 显式指定。诊断：" + tried.join(" ｜ "));
+  }
+  _loginEntry = null;
+  return null;
+}
+
+let lastLoginDiag = "";
+/** 底层调用 e10-login，返回 spawnSync 结果（供需要看 stderr/status 的调用方使用）。
+ *  优先 shell:false 直连 JS 入口；解析失败才退化为 shell:true。 */
+function spawnLoginCli(args, timeout = 20000) {
+  const entry = resolveLoginEntry();
+  if (entry) return spawnSync(process.execPath, [entry, ...args], { encoding: "utf-8", timeout, windowsHide: true });
+  return spawnSync("e10-login", args, { shell: true, encoding: "utf-8", timeout, windowsHide: true });
+}
+
+/** 调用 e10-login（凭据的唯一来源）；失败返回 null，并把诊断信息留在 lastLoginDiag */
+function runLoginCli(args) {
+  try {
+    const r = spawnLoginCli(args);
+    const out = (r.stdout || "").trim();
+    if (r.error || r.status !== 0) {
+      lastLoginDiag = ((r.stderr || "") + out).trim().split(/\r?\n/).slice(0, 2).join(" / ") || (r.error ? String(r.error.message) : "exit=" + r.status);
+      return null;
+    }
+    return out || null;
+  } catch (e) { lastLoginDiag = String((e && e.message) || e); return null; }
+}
+
+/** 归一化 + 校验（缺 baseUrl / eteamsid / cookie 一律视为该出口不可用，继续下一个出口） */
+function normalizeAuth(o) {
+  if (!o) return null;
+  const baseUrl = String(o.baseUrl || "").trim().replace(/\/+$/, "");
+  const eteamsid = String(o.eteamsid || "").trim();
+  const cookie = String(o.cookie || "").trim();
+  if (!baseUrl || !eteamsid || !cookie) return null;
+  if (/^\((未知|空)\)$/.test(eteamsid) || /^\((未知|空)\)$/.test(cookie)) return null;
+  return { baseUrl, eteamsid, cookie, userId: String(o.userId || "").trim(), tenantKey: String(o.tenantKey || "").trim(), source: o.source };
+}
+
+/** ① e10-login auth --json（正式契约：{v,baseUrl,eteamsId,cookie,userAgent,userId,tenantKey,agentType,profile}） */
+function providerAuthJson() {
+  const out = runLoginCli(["auth", "--json"]);
+  if (!out) return null;
+  let j; try { j = JSON.parse(out); } catch { return null; }
+  if (!j || typeof j !== "object" || Array.isArray(j)) return null;
+  return normalizeAuth({
+    baseUrl: j.baseUrl || j.base_url,
+    eteamsid: j.eteamsId || j.eteamsid,
+    cookie: typeof j.cookie === "string" ? j.cookie : "",
+    userId: j.userId || j.employeeId,
+    tenantKey: j.tenantKey,
+    source: "e10-login auth --json",
+  });
+}
+
+/** ② e10-login whoami --json（需其 JSON 带 cookies 字符串；当前 1.5.0 未带 → 自动落到 ③） */
+function providerWhoamiJson() {
+  const out = runLoginCli(["whoami", "--json"]);
+  if (!out) return null;
+  let j; try { j = JSON.parse(out); } catch { return null; }
+  if (!j || typeof j !== "object" || Array.isArray(j)) return null;
+  const cookie = typeof j.cookies === "string" ? j.cookies : (typeof j.cookie === "string" ? j.cookie : "");
+  return normalizeAuth({
+    baseUrl: j.baseUrl,
+    eteamsid: j.eteamsId || j.eteamsid,
+    cookie,
+    userId: j.employeeId || j.userId,
+    tenantKey: j.tenantKey,
+    source: "e10-login whoami --json",
+  });
+}
+
+/** ③ e10-login whoami（文本输出解析：employeeId / tenantKey / baseUrl / ETEAMSID / cookies / User-Agent） */
+function providerWhoamiText() {
+  const out = runLoginCli(["whoami"]);
+  if (!out) return null;
+  const m = {};
+  for (const line of out.split(/\r?\n/)) {
+    const x = line.match(/^\s*([A-Za-z][A-Za-z0-9_-]*)\s*:\s*(.+?)\s*$/);
+    if (x) m[x[1].toLowerCase()] = x[2];
+  }
+  return normalizeAuth({
+    baseUrl: m["baseurl"],
+    eteamsid: m["eteamsid"],
+    cookie: m["cookies"],
+    userId: m["employeeid"] || m["userid"],
+    tenantKey: m["tenantkey"],
+    source: "e10-login whoami（文本）",
+  });
+}
+
+/** ④ 明文镜像（最后兜底：不涉及任何解密，但可能已过期 → 命中时告警） */
+function providerCacheMd() {
+  const p = path.join(os.homedir(), ".workbuddy", "e10-login-cache.md");
+  if (!fs.existsSync(p)) return null;
+  const txt = fs.readFileSync(p, "utf-8");
+  const get = (key) => {
+    const mm = txt.match(new RegExp("\\*\\*" + key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&") + "\\*\\*\\s*[:：]\\s*`?([^`\\n]+)`?"));
+    return mm ? mm[1].trim() : "";
+  };
+  const eteamsid = get("ETEAMSID");
+  let cookie = get("完整 Cookie 串");
+  if (!cookie && eteamsid) cookie = "langType=zh_CN; ETEAMSID=" + eteamsid + "; agentType=workbuddy; isAgent=true";
+  return normalizeAuth({
+    baseUrl: get("baseUrl"), eteamsid, cookie,
+    userId: get("userId") || get("employeeId"), tenantKey: get("tenantKey"),
+    source: "明文镜像 ~/.workbuddy/e10-login-cache.md（可能已过期）",
+  });
+}
+
+// ---------------- weaver-work-cli 凭据出口（首选来源）----------------
+// 背景：本包要求 e10-data 的凭据**优先取自 weaver-work-cli**（与连接器无关的用户级登录体系）。
+//   weaver-work-cli 的登录态存于 ~/.weaver-work-cli/（@napi-rs/keyring 加密），与 e10-login 完全独立、
+//   互不通用；它提供 `auth export-weaver-env` 输出 WEAVER_* 变量，其中
+//   WEAVER_BASE_URL / WEAVER_ETEAMSID / WEAVER_COOKIE 正好对应本 CLI 需要的三要素。
+// 安全边界：**只在进程内存中解析** —— 不经 shell、不落盘、不打印、不写入任何日志/报告/错误信息；
+//   凭据随进程结束即释放（后续调用仍走 v0.1.17 的内存 TTL 缓存，不落明文）。
+// 定位策略：与 e10-login 相同的四段式（WEAVER_WORK_CLI_ENTRY → 模块解析 → PATH shim → 常见全局前缀）。
+const WEAVER_PROVIDER_NAME = "weaver-work-cli";
+const WEAVER_CLI_ENTRY_ENV = "WEAVER_WORK_CLI_ENTRY";
+
+let _weaverEntry;
+let _weaverEntryDone = false;
+
+function resolveWeaverEntry() {
+  if (_weaverEntryDone) return _weaverEntry;
+  _weaverEntryDone = true;
+  const isFile = (p) => { try { return !!p && fs.statSync(p).isFile(); } catch { return false; } };
+
+  const entryFromPkgDir = (dir) => {
+    try {
+      const pj = path.join(dir, "package.json");
+      if (!isFile(pj)) return null;
+      const j = JSON.parse(fs.readFileSync(pj, "utf-8"));
+      if (j.name !== "weaver-work-cli") return null;
+      let b = j.bin;
+      if (typeof b === "string") b = { "weaver-work-cli": b };
+      const rel = b && b["weaver-work-cli"];
+      if (!rel) return null;
+      const entry = path.resolve(dir, rel);
+      return isFile(entry) ? entry : null;
+    } catch { return null; }
+  };
+
+  const envEntry = (process.env[WEAVER_CLI_ENTRY_ENV] || "").trim();
+  if (envEntry && isFile(envEntry)) { _weaverEntry = envEntry; return _weaverEntry; }
+
+  try {
+    const pj = createRequire(import.meta.url).resolve("weaver-work-cli/package.json");
+    const e = entryFromPkgDir(path.dirname(pj));
+    if (e) { _weaverEntry = e; return _weaverEntry; }
+  } catch {}
+
+  const pathDirs = String(process.env.PATH || "").split(path.delimiter).filter(Boolean);
+  const shimNames = process.platform === "win32"
+    ? ["weaver-work-cli.cmd", "weaver-work-cli.exe", "weaver-work-cli"]
+    : ["weaver-work-cli"];
+  for (const d of pathDirs) {
+    for (const n of shimNames) {
+      if (!isFile(path.join(d, n))) continue;
+      const e = entryFromPkgDir(path.join(d, "node_modules", "weaver-work-cli"));
+      if (e) { _weaverEntry = e; return _weaverEntry; }
+    }
+  }
+
+  const home = os.homedir();
+  const prefixes = [
+    path.join(path.dirname(process.execPath), "node_modules"),
+    path.join(path.dirname(process.execPath), "..", "lib", "node_modules"),
+    path.join(home, ".npm-global", "lib", "node_modules"),
+    process.env.APPDATA ? path.join(process.env.APPDATA, "npm", "node_modules") : null,
+    process.env.ProgramFiles ? path.join(process.env.ProgramFiles, "nodejs", "node_modules") : null,
+  ].filter(Boolean);
+  for (const p of prefixes) {
+    const e = entryFromPkgDir(path.join(p, "weaver-work-cli"));
+    if (e) { _weaverEntry = e; return _weaverEntry; }
+  }
+
+  _weaverEntry = null;
+  return null;
+}
+
+/** 调用 weaver-work-cli（失败返回 null，诊断留在 lastLoginDiag 供 loadAuth 汇总） */
+function runWeaverCli(args, timeout = 20000) {
+  try {
+    const entry = resolveWeaverEntry();
+    const r = entry
+      ? spawnSync(process.execPath, [entry, ...args], { encoding: "utf-8", timeout, windowsHide: true })
+      : spawnSync("weaver-work-cli", args, { shell: true, encoding: "utf-8", timeout, windowsHide: true });
+    const out = (r.stdout || "").trim();
+    if (r.error || r.status !== 0) {
+      lastLoginDiag = ((r.stderr || "") + out).trim().split(/\r?\n/).slice(0, 2).join(" / ") || (r.error ? String(r.error.message) : "exit=" + r.status);
+      return null;
+    }
+    return out || null;
+  } catch (e) { lastLoginDiag = String((e && e.message) || e); return null; }
+}
+
+/** 去掉 shell 引号包装（兼容 POSIX 单/双引号与 PowerShell 双引号） */
+function unquoteShellValue(raw) {
+  const s = String(raw || "").trim();
+  if (s.length >= 2 && s.startsWith("'") && s.endsWith("'")) return s.slice(1, -1).replace(/'\\''/g, "'");
+  if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) return s.slice(1, -1).replace(/\\(["\\$`])/g, "$1");
+  return s;
+}
+
+/** 解析 KEY=VALUE 行（POSIX `export K='V'` / PowerShell `$env:K = "V"`） */
+function parseShellExports(text) {
+  const env = {};
+  for (const line of String(text || "").split(/\r?\n/)) {
+    const s = line.trim();
+    if (!s) continue;
+    let m = s.match(/^export\s+([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!m) m = s.match(/^\$env:([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);
+    if (m) env[m[1]] = unquoteShellValue(m[2]);
+  }
+  return env;
+}
+
+/** ⓪ weaver-work-cli auth export-weaver-env（唯一凭据来源） */
+function providerWeaverWorkCli() {
+  const out = runWeaverCli(["auth", "export-weaver-env", "--shell", "posix"]);
+  if (!out) return null;
+  const env = parseShellExports(out);
+  const auth = normalizeAuth({
+    baseUrl: env.WEAVER_BASE_URL,
+    eteamsid: env.WEAVER_ETEAMSID,
+    cookie: env.WEAVER_COOKIE,
+    source: "weaver-work-cli auth export-weaver-env",
+  });
+  if (!auth) return null;
+  // export-weaver-env 不导出 userId / tenantKey，需另向 auth status 取。
+  // 二者均为「非凭据」的身份字段：userId 会被部分命令用作"当前登录用户"默认值（如 attend statis 的 --user），
+  // 缺失会导致这些命令报「缺少查询人员」。取不到不影响凭据本身的可用性。
+  try {
+    const st = runWeaverCli(["--json", "auth", "status", "--no-check"]);
+    if (st) {
+      const j = JSON.parse(st);
+      if (j && j.loggedIn) {
+        auth.userId = String(j.userId || "").trim();
+        auth.tenantKey = String(j.tenantKey || "").trim();
+      }
+    }
+  } catch {}
+  return auth;
+}
+
+// ⚠️ 2026-09-24：凭据**唯一来源 = weaver-work-cli**，不再回退 e10-login。
+// providerAuthJson / providerWhoamiJson / providerWhoamiText / providerCacheMd 保留函数定义但不挂载
+// （如需恢复回退，把对应条目加回本数组即可）。
+const AUTH_PROVIDERS = [
+  ["weaver-work-cli", providerWeaverWorkCli],
+];
+/** 预留：登记"命中后不进记忆"的出口（当前为空——唯一出口需要被记忆） */
+const AUTH_FALLBACK_PROVIDERS = new Set();
+
+function readAuthModeMemo() {
+  try {
+    const s = fs.readFileSync(AUTH_MODE_FILE, "utf-8").trim();
+    return AUTH_PROVIDERS.some(([n]) => n === s) ? s : null;
+  } catch { return null; }
+}
+function writeAuthModeMemo(name) {
+  try { fs.mkdirSync(path.dirname(AUTH_MODE_FILE), { recursive: true }); fs.writeFileSync(AUTH_MODE_FILE, name, "utf-8"); } catch {}
+}
+
+/** 取凭据：按优先级依次尝试各出口；命中的模式会被记住（下次优先尝试它，省一次进程调用） */
+function loadAuth() {
+  const { profile, file } = authFilePath();
+  const override = (process.env.E10_DATA_AUTH_MODE || "").trim();
+  const memo = override || (process.env.E10_DATA_AUTH_PROBE ? null : readAuthModeMemo());
+  const order = memo
+    ? AUTH_PROVIDERS.filter(([n]) => n === memo).concat(AUTH_PROVIDERS.filter(([n]) => n !== memo))
+    : AUTH_PROVIDERS.slice();
+  // 首选来源固定为 weaver-work-cli：无论 memo 指向谁，都把它提到最前再依次尝试
+  // （仅当未用 E10_DATA_AUTH_MODE 显式指定时；它取不到凭据会自动回落后续出口）
+  if (!override) {
+    const wi = order.findIndex(([n]) => n === WEAVER_PROVIDER_NAME);
+    if (wi > 0) order.unshift(order.splice(wi, 1)[0]);
+  }
+
+  const diag = [];
+  for (const [name, fn] of order) {
+    let got = null;
+    lastLoginDiag = "";
+    try { got = fn(); } catch (e) { diag.push(name + ": " + ((e && e.message) || e)); }
+    if (got) {
+      if (name !== memo && !AUTH_FALLBACK_PROVIDERS.has(name)) writeAuthModeMemo(name);
+      got.profile = profile;
+      if (name === "cache-md") {
+        if (!process.env.E10_DATA_QUIET) {
+          console.error("[e10-data][warn] 凭据来源＝" + got.source + "；正常应由 e10-login 提供凭据，请检查 `e10-login whoami` 是否能输出 cookies。");
+        }
+      }
+      return got;
+    }
+    if (lastLoginDiag) diag.push(name + ": " + lastLoginDiag);
+  }
+
+  throw new Error(
+    "未取得登录凭据（唯一来源 = weaver-work-cli，**不设回退**）。请按顺序检查：\n" +
+    "  ① 命令是否可用：`weaver-work-cli --version`（缺失 → 安装 weaver-work-cli）\n" +
+    "  ② 是否已登录：`weaver-work-cli auth status --no-check`\n" +
+    "  ③ 未登录 / 登录态失效 → 执行 `weaver-work-cli auth login --base-url <域名>` 重新登录（当前 profile: " + profile + "）\n" +
+    (diag.length ? "  探测诊断：" + diag.join(" ｜ ") + "\n" : "")
+  );
+}
+
+// ---------------- 凭据进程间 TTL 缓存（v0.1.17 新增，不落明文）----------------
+// 目的：避免每次调用都重新拉起 e10-login 取凭据（去掉 shell 后仍约 0.22s/次）。
+// 形态：一个 detached 的「持有者」进程把凭据**只保存在内存**里，监听本机命名管道
+//   （Windows）/ Unix 域套接字（0600），供后续同用户·同 profile 的 e10-data 调用取用，
+//   TTL（默认 300s）到期自动退出。**不写任何文件、不涉及网络。**
+// 边界：
+//   · 任何异常（连不上/超时/JSON 坏/过期/profile 不符）一律静默回落正常取凭据路径；
+//   · 兜底出口（明文镜像）的凭据不会写入缓存，避免把过期凭据固化；
+//   · E10_DATA_NO_CRED_CACHE=1 整体关闭；E10_DATA_AUTH_MODE / E10_DATA_AUTH_PROBE 存在时绕过缓存；
+//   · 缓存通道名含「主目录+用户名+profile」哈希 → 不同用户/不同 profile 互不可见。
+const CRED_CACHE_TTL = (() => {
+  const n = Number(process.env.E10_DATA_CRED_TTL);
+  return Number.isFinite(n) && n > 0 ? Math.floor(n) : 300;
+})();
+
+/** 缓存通道地址（只有 e10-data 与 e10-cred-helper 使用；由父进程算好后以 argv 传给持有者） */
+function credCachePath() {
+  const { profile } = authFilePath();
+  const tag = crypto.createHash("sha1")
+    .update([os.homedir(), process.env.USERNAME || process.env.USER || "", profile].join("|"))
+    .digest("hex").slice(0, 16);
+  if (process.platform === "win32") return "\\\\.\\pipe\\e10-data-cred-" + tag;
+  const uid = typeof process.getuid === "function" ? process.getuid() : "n";
+  const dir = process.env.XDG_RUNTIME_DIR || path.join(os.homedir(), ".e10-cli");
+  return path.join(dir, "e10-data-cred-" + tag + "-" + uid + ".sock");
+}
+
+/** 读缓存：命中返回 auth（结构同 loadAuth 的返回值）；未命中/超时/任何异常 → null */
+function credCacheGet() {
+  const { profile } = authFilePath();
+  return new Promise((resolve) => {
+    let done = false, buf = "", sock;
+    const finish = (v) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      try { sock.destroy(); } catch {}
+      resolve(v);
+    };
+    const timer = setTimeout(() => finish(null), 1500);   // 取缓存必须快；超时即当未命中
+    try { sock = net.connect(credCachePath()); } catch { return finish(null); }
+    sock.setEncoding("utf-8");
+    sock.on("connect", () => { try { sock.write("GET\n"); } catch { finish(null); } });
+    sock.on("data", (d) => {
+      buf += d;
+      if (!buf.includes("\n")) return;
+      try {
+        const j = JSON.parse(buf.split("\n")[0]);
+        if (!j || j.v !== 1 || Number(j.exp) < Date.now()) return finish(null);
+        if ((j.profile || "default") !== profile) return finish(null);
+        const a = normalizeAuth(Object.assign({}, j.auth, { source: "进程间凭据缓存（e10-data cred-cache）" }));
+        return finish(a || null);
+      } catch { return finish(null); }
+    });
+    sock.on("error", () => finish(null));
+    sock.on("close", () => finish(null));
+  });
+}
+
+/** 写缓存：拉起 detached 持有者，凭据经 stdin 传入（不经 argv，避免出现在进程列表里） */
+function credCachePublish(auth) {
+  return new Promise((resolve) => {
+    let child;
+    try {
+      const helper = path.join(__dirname, "e10-cred-helper.mjs");
+      if (!fs.existsSync(helper)) return resolve();
+      child = spawn(process.execPath, [helper, credCachePath(), String(CRED_CACHE_TTL)], {
+        detached: true, stdio: ["pipe", "ignore", "ignore"], windowsHide: true,
+      });
+    } catch { return resolve(); }
+    const payload = JSON.stringify({
+      exp: Date.now() + CRED_CACHE_TTL * 1000,
+      profile: auth.profile || "default",
+      auth: {
+        baseUrl: auth.baseUrl, eteamsid: auth.eteamsid, cookie: auth.cookie,
+        userId: auth.userId, tenantKey: auth.tenantKey, source: auth.source,
+      },
+    });
+    let settled = false;
+    const done = () => { if (settled) return; settled = true; try { child.unref(); } catch {} resolve(); };
+    child.on("error", done);
+    child.stdin.on("error", done);
+    child.stdin.end(payload, done);
+    setTimeout(done, 1000);   // 兜底：不让发布环节拖住主命令
+  });
+}
+// ---------------- login（唯一"不需要已有凭据"的命令族：xiaoe-env，2026-09-17 移植）----------------
+// 来源：e10-login 1.6.4-xiaoe 的 `e10-login xiaoe-env [--domain <url>]`
+//   （lib/xiaoe.js 命令定义 + lib/login-flow.js 收尾 + scripts/xiaoe_env.py 换 token）。
+//   原实现是「Node 里 spawn python scripts/xiaoe_env.py 换 ETEAMSID」，而本 CLI 是零依赖 Node，
+//   **不需要 python**：换 token 本身就是一次 POST，此处原生复刻（逐字段对齐：URL 拼接、请求头
+//   authorization、body {domain}、code 判定 '0000'/200、取 data.eteamId、错误信息取 msg）。
+// 分工（与本 CLI 既有的认证边界一致，不越界）：
+//   ① 换 token      → 本 CLI 原生实现（无 python 依赖）；
+//   ② 落 profile    → 仍交 e10-login `set --eteamsid --base-url`（auth 文件由它的密钥体系加密，
+//                     只有它解得开；`set` 与原命令的收尾 finishLoginByEteamsId 是同一条路径：
+//                     teamsCheck 解析用户信息 + 写 auth/config + 切换 active profile）。
+// ⚠️ 本段必须在 loadAuth() 之前执行 —— 该命令存在的意义就是"还没有凭据时把凭据造出来"，
+//    因此它在 main() 之前拦截（见下方拦截块），不走常规 main() 分发。
+const LOGIN_DEFAULT_BASE_URL = "https://www.e-cology.com.cn";
+const XIAOE_ENV_ETEAMID_PATH = "/spec-apps/api/app/rpachat/skill/extend/eteamId";
+const ETEAMSID_SAFE_RE = /^[A-Za-z0-9_.\-]+$/; // 透传给 e10-login 的参数白名单（该调用走 shell，防注入）
+
+/** --domain → 当前 profile 的 config.json.baseUrl → 默认平台地址（对齐 e10-login 的 resolveBaseUrl；
+ *  config.json 是明文，读它不涉及任何解密） */
+function resolveLoginBaseUrl(optDomain) {
+  if (optDomain !== undefined && typeof optDomain !== "string") throw new Error("--domain 需要跟一个平台地址，如 --domain https://www.e-cology.com.cn");
+  let cfgBase = "";
+  try {
+    const cfgFile = path.join(path.dirname(authFilePath().file), "config.json");
+    if (fs.existsSync(cfgFile)) cfgBase = String(JSON.parse(fs.readFileSync(cfgFile, "utf-8")).baseUrl || "").trim();
+  } catch {}
+  return String(optDomain || cfgBase || LOGIN_DEFAULT_BASE_URL).trim().replace(/\/+$/, "");
+}
+
+/** 复刻 scripts/xiaoe_env.py：POST {XIAOE_DOMAIN}/spec-apps/api/app/rpachat/skill/extend/eteamId
+ *  请求头 authorization=<XIAOE_USER_TOKEN>；body {"domain": <目标平台域名>} → 取 data.eteamId */
+async function xiaoeEnvFetchEteamsId(domain) {
+  const token = String(process.env.XIAOE_USER_TOKEN || "").trim();
+  const erpa = String(process.env.XIAOE_DOMAIN || "").trim();
+  if (!token || !erpa) {
+    throw new Error("缺少环境变量 XIAOE_USER_TOKEN / XIAOE_DOMAIN（请先设置后重试，如 export XIAOE_USER_TOKEN=<token> XIAOE_DOMAIN=<erpa域名>）");
+  }
+  const url = erpa.replace(/\/+$/, "") + XIAOE_ENV_ETEAMID_PATH;
+  let resp, text;
+  try {
+    resp = await fetch(url, {
+      method: "POST",
+      headers: { authorization: token, "content-type": "application/json", accept: "application/json" },
+      body: JSON.stringify({ domain }),
+    });
+    text = await resp.text();
+  } catch (e) {
+    throw new Error("请求 XiaoE 换 token 接口失败（" + url + "）：" + ((e && e.message) || e));
+  }
+  let j = null;
+  try { j = JSON.parse(text); } catch {}
+  if (!j) throw new Error("XiaoE 接口返回非 JSON（HTTP " + resp.status + "）：" + text.slice(0, 200));
+  const code = j.code;
+  const eteamId = String((j.data && j.data.eteamId) || "").trim();
+  if (!(code === "0000" || code === 200 || code === "200") || !eteamId) {
+    throw new Error("XiaoE 换取失败：" + (j.msg || ("HTTP " + resp.status + " code=" + code)));
+  }
+  return eteamId;
+}
+
+/** e10-data login xiaoe-env：环境变量全局 token → ETEAMSID → 写 profile（走 e10-login set 收尾） */
+async function cmdLoginXiaoeEnv(args, json) {
+  const say = json ? console.error : console.log; // --json 时人读信息一律走 stderr，保持 stdout 只有 JSON
+  const baseUrl = resolveLoginBaseUrl(args.domain);
+  say("ℹ️  目标平台: " + baseUrl + (args.domain ? "（--domain）" : baseUrl === LOGIN_DEFAULT_BASE_URL ? "（默认平台地址）" : "（当前 profile 的 config.json）"));
+
+  const eteamsId = await xiaoeEnvFetchEteamsId(baseUrl);
+  say("✅ 已取得 ETEAMSID（来源: env，不回显）");
+
+  if (!ETEAMSID_SAFE_RE.test(eteamsId)) throw new Error("换回的 ETEAMSID 含异常字符，已拒绝透传 e10-login（安全防护）");
+  // v0.1.17：改为数组直传 + shell:false（不再手工拼 shell 字符串、不再需要 shq 转义），
+  //   既省掉 cmd.exe 那一层开销，也彻底消除 shell 注入面。ETEAMSID_SAFE_RE 仍作为二道防线保留。
+  const r = spawnLoginCli(["set", "--eteamsid", eteamsId, "--base-url", baseUrl], 60000);
+  const out = (r.stdout || "").trim(), err = (r.stderr || "").trim();
+  if (r.error || r.status !== 0) {
+    throw new Error("换 token 成功，但 e10-login 写 profile 失败（auth 文件的加密写入只有 e10-login 能做）："
+      + (err || out || (r.error && r.error.message) || ("exit=" + r.status)));
+  }
+  for (const line of (out + (err ? "\n" + err : "")).split(/\r?\n/)) if (line.trim()) say("   [e10-login] " + line.trim());
+
+  const profile = authFilePath().profile;
+  // 自检：立刻用取数链路（loadAuth）把凭据读回来，确认"真能读到"而不是"只写了文件"
+  //   （历史坑：e10-login 旧版 whoami 不带 cookies → 登录成功但 e10-data 取不到凭据；此处必须报出来）
+  //   强制重新探测（E10_DATA_AUTH_PROBE），并拒绝把"明文镜像兜底"当成自检通过 —— 镜像可能是旧环境的
+  let readBack = "";
+  try {
+    process.env.E10_DATA_AUTH_PROBE = "1";
+    const a = loadAuth();
+    const viaMirror = /镜像/.test(String(a.source || ""));
+    readBack = (viaMirror ? "⚠️ 仅命中明文镜像：" : "ok（") + (a.source || "?") + "；baseUrl: " + a.baseUrl + (a.userId ? "；userId: " + a.userId : "") + (viaMirror ? "" : "）");
+    if (viaMirror) throw new Error("凭据来自明文镜像而非新写入的 profile（镜像可能是旧环境/已过期）");
+    say("✅ 凭据自检通过：" + readBack);
+  } catch (e) {
+    if (!readBack) readBack = "失败: " + String((e && e.message) || e).split(/\r?\n/)[0];
+    throw new Error("profile 已写入 ~/.e10-cli/profiles/" + profile + "/auth，但本 CLI 读不回凭据（" + readBack
+      + "）—— 取数仍会失败。请确认 `e10-login whoami` 能输出 cookies（缺则升级 e10-login），或改用 `e10-login oidc`。");
+  }
+  return {
+    ok: true,
+    baseUrl,
+    profile,
+    credentialSource: "env(XIAOE_USER_TOKEN + XIAOE_DOMAIN)",
+    writtenBy: "e10-login set",
+    eteamsId: "(已写入，不回显)",
+    readback: readBack,
+  };
+}
+
+// ---- 拦截（必须早于 loadAuth()）：login 族 = 唯一不需要已有凭据的命令族 ----
+{
+  const a2 = process.argv[2] || "";
+  const bare = a2 === "xiaoe-env";                     // 别名：与 e10-login 同名命令保持一致的肌肉记忆
+  if (a2 === "login" || bare) {
+    const sub = bare ? a2 : process.argv[3] || "";
+    const { args } = parseArgs(process.argv.slice(bare ? 3 : 4));
+    const json = !!args.json;
+    try {
+      if (sub !== "xiaoe-env") throw new Error("未知子命令 `login " + (sub || "(空)") + "`（当前仅移植 xiaoe-env）");
+      const r = await cmdLoginXiaoeEnv(args, json);
+      if (json) console.log(JSON.stringify(r, null, 1));
+      process.exit(0);
+    } catch (e) {
+      console.error("ERROR: " + ((e && e.message) || e));
+      process.exit(1);
+    }
+  }
+}
+
+// ---- 命令白名单（早期校验用；必须与下方 main() 的分发表保持一致）----
+// 返回 true = 该命令存在、可以继续（可能还需要凭据）；false = 未知命令，直接给用法提示。
+// 为什么需要：loadAuth() 写在模块顶层，过去"未知命令"也要先付一整笔取凭据的开销
+// （Windows 上 ~1.0s，去 shell 后 ~0.22s）才打印用法。v0.1.17 起提前判定。
+const CMD_SUBS = {
+  ds: ["groups", "find", "describe", "tables", "fields", "fields-dsl", "list", "chart", "stat", "count"],
+  doc: ["count", "list"],
+  noun: ["list"],
+  field: ["id2name", "name2id"],
+  conf: ["get", "batch", "batch-file", "group", "group-file", "resolve", "resolve-file", "add", "add-file", "update", "delete"],
+  exp: ["status", "manifest", "commits", "file", "pull", "init", "commit", "lock", "release", "rollback"],
+  attend: ["statis"],
+  eb: ["perm-page"],
+};
+function commandIsKnown(pos) {
+  const family = pos[0], sub = pos[1];
+  if (!family) return false;                                   // 无命令 → 用法
+  if (family === "query") return true;                         // query 无子命令（cmdQuery 自行处理入参）
+  if (family === "login" || family === "xiaoe-env") return true; // 已由上方拦截块接管
+  const subs = CMD_SUBS[family];
+  if (!subs) return false;
+  return subs.includes(sub);
+}
+
+// ---- 拦截（必须早于 loadAuth()）：免凭据命令族 ----
+// ① 版本 / ② 帮助 / ③ 未知命令 —— 这三类都不需要凭据，故在取凭据之前 return。
+// （login 族由上方独立拦截块处理；exp release/rollback 的 --version 是版本号参数、长度 >1 不受影响）
+{
+  const rawArgv = process.argv.slice(2);
+  const { args: earlyArgs, pos: earlyPos } = parseArgs(rawArgv);
+
+  // ① --version / -v：仅顶层单参数
+  if (rawArgv.length === 1 && (rawArgv[0] === "--version" || rawArgv[0] === "-v")) {
+    console.log("e10-data " + cliVersion());
+    process.exit(0);
+  }
+
+  // ② --help / -h：显式求帮助 → 用法 + 退出码 0（区别于"用错了"的退出码 1）
+  //    只认「裸开关」（值为 true），避免把 --value --help 这类取值误判为求助；
+  //    -h 是单短横线、parseArgs 不识别，单独按顶层单参数处理
+  if (earlyArgs.help === true || (rawArgv.length === 1 && rawArgv[0] === "-h")) {
+    usage();
+    process.exit(0);
+  }
+
+  // ③ 未知命令族 / 未知子命令 / 缺子命令 → 用法提示，退出码 1
+  if (!commandIsKnown(earlyPos)) {
+    usage();
+    process.exit(1);
+  }
+}
+
+// ---- 取凭据（v0.1.17：先试进程间缓存，未命中再走 e10-login，并把结果发布给后续调用）----
+let auth = null;
+const CRED_CACHE_ON = !process.env.E10_DATA_NO_CRED_CACHE
+  && !process.env.E10_DATA_AUTH_MODE && !process.env.E10_DATA_AUTH_PROBE;
+if (CRED_CACHE_ON) auth = await credCacheGet();
+if (!auth) {
+  auth = loadAuth();
+  // 兜底出口（明文镜像）的凭据不写入缓存 —— 避免把可能已过期的凭据固化整个 TTL
+  if (CRED_CACHE_ON && !/镜像/.test(String(auth.source || ""))) await credCachePublish(auth);
+}
+const BASE = auth.baseUrl.replace(/\/+$/, "");
+const USER = { id: auth.userId || "", tenantKey: auth.tenantKey || "" };
+
+// ---------------- HTTP ----------------
+function checkAuthFail(resp, text, j) {
+  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) {
+    const from = (auth && auth.source) || "未知";
+    const hint = "凭据由 weaver-work-cli 提供，请执行 `weaver-work-cli auth login --base-url <域名>` 重新登录";
+    throw new Error("登录态失效(" + (j.msg || resp.status) + ")：凭据来源＝" + from + "；" + hint);
+  }
+}
+async function postJson(endpoint, bodyObj, extraHeaders = {}) {
+  const resp = await fetch(BASE + endpoint, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json;charset=UTF-8",
+      "accept": "application/json, text/plain, */*",
+      "langType": "zh_CN",
+      "cookie": auth.cookie,
+      "eteamsid": auth.eteamsid,
+      "ebbusinessid": EB_BIZ_ID,
+      "user-agent": UA,
+      "timezoneoffset": "-480",
+      ...extraHeaders,
+    },
+    body: JSON.stringify(bodyObj),
+  });
+  const text = await resp.text();
+  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
+  checkAuthFail(resp, text, j);
+  return j;
+}
+async function getUrl(url) {
+  const resp = await fetch(BASE + url, {
+    method: "GET",
+    headers: {
+      "accept": "application/json, text/plain, */*",
+      "langType": "zh_CN",
+      "cookie": auth.cookie,
+      "eteamsid": auth.eteamsid,
+      "ebbusinessid": EB_BIZ_ID,
+      "user-agent": UA,
+    },
+  });
+  const text = await resp.text();
+  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
+  checkAuthFail(resp, text, j);
+  return j;
+}
+async function postMultipart(endpoint, formObj) {
+  const fd = new FormData();
+  for (const [k, v] of Object.entries(formObj)) fd.append(k, typeof v === "string" ? v : JSON.stringify(v));
+  const resp = await fetch(BASE + endpoint, {
+    method: "POST",
+    headers: {
+      "accept": "application/json, text/plain, */*",
+      "langType": "zh_CN",
+      "cookie": auth.cookie,
+      "eteamsid": auth.eteamsid,
+      "ebbusinessid": EB_BIZ_ID,
+      "user-agent": UA,
+      "timezoneoffset": "-480",
+      "referer": BASE + "/sp/ebddesigner/1282331905881874436",
+    },
+    body: fd,
+  });
+  const text = await resp.text();
+  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
+  checkAuthFail(resp, text, j);
+  return j;
+}
+
+// ---------------- 参数解析 ----------------
+function parseArgs(argv) {
+  const args = {};
+  const pos = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const v = argv[i + 1];
+      if (v === undefined || v.startsWith("--")) { args[key] = true; }
+      else { args[key] = v; i++; }
+    } else pos.push(a);
+  }
+  return { args, pos };
+}
+// ⚠️ 大整数精度保护（2026-09-03）：E10 主键/ID 多为 19 位大整数，超过 JS 安全整数 2^53-1
+// （9007199254740991）。JSON.parse 会将其舍入为近似 double（如 1297901170990161977 → ...1920），
+// 导致 DSL 条件查不到数据（静默空结果）或返回 ID 失真。此处把 JSON 中 >2^53 的裸数字字面量
+// 加引号转字符串（后端实测接受字符串形式做 = / IN / BETWEEN 数值比较），请求与响应两侧统一保护。
+function protectBigInts(raw) {
+  // 逐字符扫描：跟踪 JSON 字符串状态（含转义），仅在引号外的结构层把 >2^53 的裸整数加引号，
+  // 避免误伤字符串内容（如 avatar JSON、文档正文里含 ",大数字" 片段）。
+  let out = "", inStr = false, esc = false;
+  for (let i = 0; i < raw.length; i++) {
+    const ch = raw[i];
+    if (inStr) {
+      out += ch;
+      if (esc) esc = false;
+      else if (ch === "\\") esc = true;
+      else if (ch === '"') inStr = false;
+      continue;
+    }
+    if (ch === '"') { inStr = true; out += ch; continue; }
+    if (ch === "-" || (ch >= "0" && ch <= "9")) {
+      let j = i + 1;
+      while (j < raw.length && raw[j] >= "0" && raw[j] <= "9") j++;  // 纯整数 token（无小数点/指数）
+      let k = i - 1;
+      while (k >= 0 && /\s/.test(raw[k])) k--;
+      const prev = k < 0 ? "" : raw[k];
+      let n = j;
+      while (n < raw.length && /\s/.test(raw[n])) n++;
+      const next = n < raw.length ? raw[n] : "";
+      const token = raw.slice(i, j);
+      if ((prev === ":" || prev === "," || prev === "[") && (next === "," || next === "}" || next === "]")) {
+        try {
+          const bi = BigInt(token);
+          if (bi > 9007199254740991n || bi < -9007199254740991n) { out += '"' + token + '"'; i = j - 1; continue; }
+        } catch { /* 非纯整数不转换 */ }
+      }
+      out += raw.slice(i, j);
+      i = j - 1;
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+function parseJsonSafe(raw, label) {
+  try { return JSON.parse(protectBigInts(raw)); }
+  catch (e) { throw new Error((label || "JSON") + " 解析失败: " + e.message); }
+}
+function readJsonArg(val, label) {
+  let raw = val;
+  if (val.startsWith("@")) raw = fs.readFileSync(val.slice(1), "utf-8");
+  return parseJsonSafe(raw, label);
+}
+function need(arg, args) { if (!args[arg]) throw new Error("缺少必填参数 --" + arg); return args[arg]; }
+// 文件/JSON 参数取值：兼容 --flag <v> 与位置参数 <v>（如 conf add-file @items.json / --add-file @items.json）
+function flagOrPos(args, flag, keys) {
+  if (args[flag] !== undefined) return args[flag];
+  return keys && keys.length ? keys[0] : undefined;
+}
+
+// ---------------- 展示 ----------------
+function fmt(v) {
+  if (v === null || v === undefined) return "";
+  if (typeof v === "object") { const s = JSON.stringify(v); return s.length > 80 ? s.slice(0, 80) + "…" : s; }
+  return String(v);
+}
+function printHuman(title, rows, cols) {
+  if (title) console.log("== " + title + " ==");
+  if (!rows || !rows.length) { console.log("(空)"); return; }
+  if (cols) {
+    console.log(cols.join("\t"));
+    for (const r of rows) console.log(cols.map((c) => fmt(r[c])).join("\t"));
+  } else {
+    for (const r of rows.slice(0, 100)) console.log(JSON.stringify(r));
+    if (rows.length > 100) console.log("... 共 " + rows.length + " 行（--json 取全量）");
+  }
+}
+
+// ---------------- query：DSL 查询 ----------------
+async function cmdQuery(args, json) {
+  const conn = need("conn", args), model = need("model", args), schema = need("schema", args);
+  const tableId = args["table-id"] || "";
+  const dslVal = need("dsl", args);
+  const dslQuery = dslVal.startsWith("@") ? readJsonArg(dslVal, "--dsl") : parseJsonSafe(dslVal, "--dsl");
+  const body = { connId: conn, model, schema, tableId, dslQuery };
+  if (args.debug !== undefined) {  // --debug true|false，与 conn/model 同层级
+    const dbg = String(args.debug).toLowerCase();
+    if (dbg === "true" || dbg === "1") body.debug = true;
+    else if (dbg === "false" || dbg === "0") body.debug = false;
+    else throw new Error("--debug 值必须为 true 或 false（当前: " + args.debug + "）");
+  }
+  const r = await postJson("/api/dw/dsl/executeQueryDsl", body);
+  if (json) return r;
+  if (String(r.code) !== "200" && r.code !== undefined && String(r.code) !== "0") {
+    console.log("code=" + r.code + " msg=" + (r.msg || ""));
+    if (/没有权限|无权限|权限不足|未授权|无权访问|无查询权限/i.test(String(r.msg || ""))) {
+      throw new Error("当前用户对该数据无查询权限，请检查 ETEAMSID 是否有效或联系管理员开通");
+    }
+    return;
+  }
+  const d = r.data;
+  // debug=true 时 data 为 { sql, records }；否则为行数组
+  const rows = Array.isArray(d) ? d : (d && Array.isArray(d.records) ? d.records : []);
+  if (d && !Array.isArray(d) && d.sql) console.log("SQL: " + d.sql);
+  if (!rows.length) { console.log("(空：0 行)"); return; }
+  printHuman("结果 " + rows.length + " 行", rows);
+}
+
+// ---------------- ds：数据源 ----------------
+function dyn() {
+  return { eteamsId: auth.eteamsid, userId: auth.userId || "", tenantKey: auth.tenantKey || "", langId: 7, formatDate: "yyyy-MM-dd HH:mm:ss", isPublic: false };
+}
+function baseDto(tableId, groupId, pageNo, pageSize, queryType) {
+  return { tableId: String(tableId), groupId, pageNo, pageSize, queryType, containDetailTable: false, needFormat: true, dynamicParams: dyn() };
+}
+// 条件树（conditionTrees）协议：根/组节点 { key, relationship("1"=AND|"0"=OR), isParent:true, parentNode, conditionList:[...] }
+// 叶子节点 { key, relationship:"1", isParent:false, parentNode, conditionId, conditionType, compareType, conditionValue, ... }
+// v0.1.8 起 parseWhere 支持递归树（OR）；向后兼容：数组=AND 根、叶子键 fieldId 优先（conditionId 兼容兜底）
+function normRel(r) { return (r === "0" || r === 0 || r === false) ? "0" : "1"; }
+function isCondGroup(c) { return !!c && Array.isArray(c.conditionList) && c.conditionList.length > 0; }
+function buildCondNode(c, key, parentKey) {
+  if (isCondGroup(c)) {
+    return {
+      key, relationship: normRel(c.relationship), isParent: true, parentNode: parentKey,
+      mainField: c.mainField !== false,
+      conditionList: c.conditionList.map((k, i) => buildCondNode(k, key + "_" + i, key)),
+    };
+  }
+  const fid = (c && (c.fieldId || c.conditionId)) || "";
+  if (!fid) throw new Error("--where 条件缺少字段：叶子须提供 fieldId（或 conditionId），条件组须提供非空 conditionList");
+  return {
+    key, relationship: "1", isParent: false, parentNode: parentKey,
+    objId: c.objId || "", conditionId: fid, fieldName: c.fieldName || fid,
+    conditionType: c.conditionType || "", compareType: c.compareType, conditionValue: c.conditionValue ?? "",
+    fieldValue: c.fieldValue || "", mainField: c.mainField !== false, ignoreCaseMark: c.ignoreCaseMark || false,
+  };
+}
+function parseWhere(val) {
+  if (!val) return null;
+  const raw = readJsonArg(val, "--where");
+  if (!raw) return null;
+  const ts = Date.now(), rootKey = "root_" + ts;
+  if (Array.isArray(raw)) { // 数组 → AND 根（元素可为叶子或内嵌条件组，组自带 relationship）
+    const kids = [];
+    raw.forEach((c, i) => { if (c && typeof c === "object") kids.push(buildCondNode(c, rootKey + "_" + i, rootKey)); });
+    if (!kids.length) return null;
+    return { key: rootKey, relationship: "1", isParent: true, parentNode: "", mainField: true, conditionList: kids };
+  }
+  if (typeof raw !== "object") throw new Error("--where 须为条件数组或条件树对象");
+  // 对象形态 = 完整条件树（{relationship, conditionList:[...]}，缺省 AND）；无 conditionList 视为无条件
+  if (!Array.isArray(raw.conditionList) || !raw.conditionList.length) return null;
+  return buildCondNode(raw, rootKey, "");
+}
+function parseStat(val) {
+  const arr = readJsonArg(val, "--stat");
+  const list = Array.isArray(arr) ? arr : [arr];
+  return list.map((s) => ({ fieldId: s.fieldId, fieldName: s.fieldId, objId: "", mainField: true, aggregator: s.aggregator || "SUM", ...(s.fieldAlias ? { fieldAlias: s.fieldAlias } : {}) }));
+}
+function parseOrder(val) {
+  if (!val) return [];
+  return val.split(",").map((s) => {
+    const [f, dir] = s.trim().split(/\s+/);
+    return { fieldId: f, fieldName: f, objId: "", isAsc: (dir || "asc").toLowerCase() !== "desc", mainField: true };
+  });
+}
+// ---------------- ds appId：一律显式传入（v0.1.14，2026-09-11 用户确认调整）----------------
+// 背景：ChatBI 数据源取数接口（getListDatas / getChartDatas / getStatDatas / getCountData）
+// 对部分 EB 应用（独立部署）的数据集必须携带 queryDto.appId，否则后端一律返回 code=500。
+// 设计：appId 属「权限校验」的产物 —— 调用方先查 dw.chat_bi_eb_config_map 判权限（无权限即终止），
+//   同一条记录的 app_id 即本次取数必须携带的 appId，再显式传入本 CLI：
+//   → CLI 不再自行反查 appId（v0.1.13 的「chat_bi_eb_config_map → ebdf_obj 自动解析」已整体移除），
+//     避免把权限表当普通字典使用、也避免 appId 来源不可见；
+//   → 仅 EB 建模表单（groupId = weaver-ebuilder-form-service）需要 appId，其它数据集可不传；
+//   → 不传也**不做拦截**，由后端按原样报错。
+function dsFieldsForm(gid, tid, st) {
+  return { groupId: gid, sourceId: tid, sourceType: st, detailFieldsGroup: "true", enableMerge: "true", needTableName: "true", params: "[]" };
+}
+// ---- ds listByPage 端点（唯一）：/api/dw/newetl/chatBi/ds/listByPage ----
+// ⚠️ 该端点**当前会忽略 name**（传 name/tableName/keyword/title 等任意字段名，都返回该分组全量，实测 8531 条）。
+//    后端后续会升级支持 name 过滤（用户 2026-09-24 确认）——升级后 `ds find` / `ds tables --name` **无需改代码**
+//    即自动恢复服务端过滤能力（本封装与分页逻辑已按「total 为过滤后总数」的语义写好）。
+//    在此之前，`ds find` 走「分页抓取 + 本地过滤」，未命中只代表「未在已扫描窗口内命中」。
+const DS_LB_PATH = "/api/dw/newetl/chatBi/ds/listByPage";
+async function dsListByPage(form) {
+  return postMultipart(DS_LB_PATH, form);
+}
+// ds 取数统一入口：appId 只认显式 --app-id <id>
+// （--app-id auto / --no-app-id 一律视为未传：v0.1.14 起不再自动解析，也不做缺失拦截）
+async function dsDto(args, tid, gid, pageNo, pageSize, queryType) {
+  const dto = baseDto(tid, gid, pageNo, pageSize, queryType);
+  const appId = args["app-id"];
+  if (typeof appId === "string" && appId !== "" && appId !== "auto") dto.appId = appId;
+  return dto;
+}
+async function cmdTables(args, json) {
+  const gid = need("group", args);
+  const form = { name: args.name || "", pageNo: args.page || "1", pageSize: args.size || "100", groupId: gid, sourceType: args["source-type"] || "LOGIC", dataUsage: "" };
+  if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
+  const r = await dsListByPage(form);
+  if (json) return r;
+  const recs = ((r.data || {}).records) || [];
+  printHuman("分组表清单 (total=" + ((r.data || {}).total) + ")", recs, ["id", "name", "appId", "tableText", "detailTable", "usage"]);
+}
+async function cmdFields(args, json) {
+  const gid = need("group", args), tid = need("table", args);
+  const form = dsFieldsForm(gid, tid, args["source-type"] || "LOGIC");
+  if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
+  const r = await postMultipart("/api/ebuilder/common/ds/fields", form);
+  if (json) return r;
+  for (const d of (r.data || [])) {
+    console.log("== 表: " + d.name + " (id=" + d.id + ") 字段 " + (d.fields || []).length + " 个 ==");
+    for (const f of (d.fields || [])) console.log([f.name, f.text, f.type, f.mainPrimaryKey ? "PK" : ""].filter(Boolean).join("\t"));
+  }
+}
+// fieldsForDSL：参数与返回结构同 cmdFields，仅接口换为 /api/dw/newetl/chatBi/ds/fieldsForDSL
+async function cmdFieldsForDSL(args, json) {
+  const gid = need("group", args), tid = need("table", args);
+  const form = dsFieldsForm(gid, tid, args["source-type"] || "LOGIC");
+  if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
+  const r = await postMultipart("/api/dw/newetl/chatBi/ds/fieldsForDSL", form);
+  if (json) return r;
+  for (const d of (r.data || [])) {
+    console.log("== 表: " + d.name + " (id=" + d.id + ") 字段 " + (d.fields || []).length + " 个 ==");
+    for (const f of (d.fields || [])) console.log([f.name, f.text, f.type, f.mainPrimaryKey ? "PK" : ""].filter(Boolean).join("\t"));
+  }
+}
+async function cmdList(args, json) {
+  const gid = need("group", args), tid = need("table", args), fld = need("fields", args);
+  const fields = fld.split(",").map((f) => ({ fieldId: f, fieldName: f, objId: String(tid), mainField: true }));
+  const dto = await dsDto(args, tid, gid, parseInt(args.page || "1", 10), parseInt(args.size || "20", 10), "getListData");
+  dto.queryFields = fields;
+  dto.orderFields = parseOrder(args.order);
+  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
+  dto.queryCount = true;
+  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getListDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
+  if (json) return r;
+  const data = r.data || {};
+  console.log("== 数据列表 count=" + data.count + " 行=" + (data.list || []).length + " ==");
+  printHuman("", data.list || [], fields.map((f) => f.fieldId));
+}
+async function cmdChart(args, json) {
+  const gid = need("group", args), tid = need("table", args), gb = need("group-by", args);
+  const dto = await dsDto(args, tid, gid, parseInt(args.page || "1", 10), parseInt(args.size || "100", 10), "getChartData");
+  dto.groupFields = gb.split(",").map((f) => ({ fieldId: f, fieldName: f, objId: String(tid), mainField: true }));
+  dto.groupStatFields = parseStat(need("stat", args)).map((s) => ({ ...s, objId: String(tid) }));
+  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
+  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getChartDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
+  if (json) return r;
+  printHuman("分组聚合 rows=" + (r.data || []).length, r.data || []);
+}
+async function cmdStat(args, json) {
+  const gid = need("group", args), tid = need("table", args);
+  const dto = await dsDto(args, tid, gid, 1, 10, "getStatData");
+  dto.statFields = parseStat(need("stat", args)).map((s) => ({ ...s, objId: String(tid) }));
+  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
+  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getStatDatas", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
+  if (json) return r;
+  const data = r.data || {};
+  if (data.fields && data.fields.length) { for (const f of data.fields) console.log(JSON.stringify(f)); }
+  else console.log("(无统计结果)");
+}
+async function cmdCount(args, json) {
+  const gid = need("group", args), tid = need("table", args);
+  const dto = await dsDto(args, tid, gid, 1, 10, "getCountData");
+  const ct = parseWhere(args.where); if (ct) dto.conditionTrees = ct;
+  const r = await postMultipart("/api/dw/newetl/chatBi/ds/getCountData", { sourceType: args["source-type"] || "LOGIC", queryDto: dto });
+  if (json) return r;
+  const data = r.data || {};
+  console.log("totalCount = " + (data.totalCount ?? "-"));
+}
+
+// ================= ds 发现层聚合：groups / find / describe（2026-09-24 新增）=================
+// 背景：一次「表单业务词」问数原本要串行跑 5 跳（定分组 → 找表 → 取字段 → 查词库 → 查权限），
+//   每跳都是一次独立 CLI 调用。实测单次调用固定开销 ~5.4s，其中「凭据现取」~4.8s 且
+//   **与请求条数/返回体量无关**（取 48 条 vs 取 1 条：5.5s vs 5.8s）⇒ 5 跳 ≈ 27s；
+//   若逐进程扫 58 个分组，串行累计约 313s。
+//   故把「找表」「字段+词库」各收敛成 1 次 CLI 调用，**在进程内并发发 HTTP**（一次凭据搞定）。
+//   实测同样的全分组扇出：进程内并发 ≈5.3~5.9s（逐进程 47.5s / 逐进程串行 ~313s）。
+//
+// ⚠️ 权限闸门不在本命令范围：`ds/listByPage` 虽然也回带 appId，但**数据源通道不拦权限**
+//   （实测：未授权表在数据源上照样能取到数据）。拿 listByPage 的 appId 跳过校验 = 闸门静默失效。
+//   ⇒ EB 建模表单取数前**必须单独**执行 `e10-data eb perm-page`，appId 只从那次调用取。
+
+// 分组清单（技能文档 data-source-query.md 1.1 的 58 个）。**仅作 ds find 的「默认扫描候选集」**，
+// 不参与任何取数参数推导。分组随环境模块安装情况增减，故支持 --groups 显式覆盖。
+const DS_GROUPS = [
+  [1, "业务表单", "weaver-formreport-service", "form"],
+  [2, "流程", "weaver-workflow-report-serviceworkflowreport", "workflow"],
+  [3, "任务", "weaver-project-servicetask", "task"],
+  [4, "日志", "weaver-elog-service", "elog"],
+  [5, "会议", "weaver-meeting-service", "meeting"],
+  [6, "日报", "weaver-blog-service", "blog"],
+  [7, "OKR", "weaver-wr-goal-service", "goal"],
+  [8, "流程列表", "weaver-workflow-list-service", "workflow"],
+  [9, "考勤", "weaver-attend-service", "attend"],
+  [10, "CRM", "weaver-crm-service", "customer"],
+  [11, "组织画像", "weaver-portrait-service", "portrait"],
+  [12, "工作流报告", "weaver-workflow-report-serviceworkflow_report", "workflow"],
+  [13, "绩效", "weaver-wr-performance-service", "kpi"],
+  [14, "项目", "weaver-project-service", "mainline"],
+  [15, "基础定时模块", "weaver-basic-schedule-service", "escheduler"],
+  [16, "知识画像", "weaver-doc-service", "document"],
+  [17, "HRM", "weaver-hrm-service", "hrm"],
+  [18, "e-builder报表", "weaver-edcreportd-service", null],
+  [19, "e-builder应用", "weaver-ebuilder-app-service", "ebuilder"],
+  [20, "e-builder表单", "weaver-ebuilder-form-service", "ebuilder"],
+  [21, "日程", "weaver-calendar-service", "calendar"],
+  [22, "文档", "weaver-doc-servicedocument", "document"],
+  [23, "文件", "weaver-file-service", "file"],
+  [24, "公文管理", "weaver-odoc-service", "odoc"],
+  [25, "SCRM", "weaver-crm-market-service", "scrm"],
+  [26, "协作区", "weaver-cowork-service", "cowork"],
+  [27, "数据源", "weaver-datasource-service", "datasource"],
+  [28, "计划报告", "weaver-wr-plan-service", "workreport"],
+  [29, "电子签", "weaver-signcenter-service", "signcontract"],
+  [30, "表单加密", "weaver-datasecurity", "datasecurity"],
+  [31, "人事", "weaver-hr-service", null],
+  [32, "动作流", "weaver-esb-setting-serviceesbCustom", "esb"],
+  [33, "发票云", "weaver-inc-biz-service", "inc"],
+  [34, "绩效核算", "weaver-ebuilder-contract-servicecmdatauFJXHS", "ebuilder"],
+  [35, "EB合同管理", "weaver-ebuilder-contract-service", null],
+  [36, "待办事项", "weaver-my-service", null],
+  [37, "签名", "weaver-signature-service", null],
+  [38, "邮件", "weaver-mail-base-service", "email"],
+  [39, "薪酬", "weaver-hrm-salary", "hrmsalary"],
+  [40, "系统安全", "weaver-security-framework-service", "security"],
+  [41, "公文交换中心", "weaver-odocexchange-service", "odocexchange"],
+  [42, "招聘管理", "weaver-recruit-service", "recruit"],
+  [43, "微搜", "weaver-esearch-search-service", null],
+  [44, "统一审批中心", "weaver-intunifytodo-server-config-service", "intunifytodos"],
+  [45, "公共数据源", "weaver-component-web-service", "common"],
+  [46, "数据分析", "weaver-analyze-service", "analyze"],
+  [47, "财务模块", "weaver-fna-expense-servicefexs", "fna"],
+  [48, "ESB连接器", "weaver-esb-setting-serviceesbConnect", "esb"],
+  [49, "AI连接器", "weaver-ai-application-service", "ai"],
+  [50, "外部流程", "weaver-workflow-core-serviceworkflowCoreOuterwf", "workflow"],
+  [51, "绩效考核", "weaver-wr-performance-eb-service", "ebuilder"],
+  [52, "问题定位平台", "weaver-tissot-service", "tissot"],
+  [53, "工作流基础效率", "weaver-workflow-report-serviceworkflowEffReport", "workflow"],
+  [54, "工作流操作者效率", "weaver-workflow-report-serviceworkflowEffOperateReport", "workflow"],
+  [55, "工作流节点效率", "weaver-workflow-report-serviceworkflowEffNodeReport", "workflow"],
+  [56, "规则引擎", "weaver-logicflow-service", "logicflow"],
+  [57, "工作流表单", "weaver-workflow-report-serviceworkflowFormReport", "workflow"],
+  [58, "统一认证中心", "weaver-intunifyauth-server-base-service", null],
+];
+
+// 必探的核心分组（技能文档「分组探查强制范围」：e-builder 表单 + 业务表单 必探；流程类业务词也常落在流程分组）
+const DS_CORE_GROUPS = [
+  "weaver-formreport-service",
+  "weaver-ebuilder-form-service",
+  "weaver-workflow-report-serviceworkflowreport",
+];
+// 语义命中规则：只是「关键词 → 分组名片段」的启发式，命中即并入扫描集（不做任何取数参数推导）
+const DS_FIND_SEMANTIC_RULES = [
+  { tag: "考勤/假期", re: /考勤|打卡|出勤|请假|假期|年假|事假|病假|加班|外勤|工时|调休|补卡|申诉/, groups: ["weaver-attend-service", "weaver-hr-service"] },
+  { tag: "流程/审批", re: /流程|审批|待办|已办|发起|抄送|传阅|征询|签字|节点|报销|申请单/, groups: ["weaver-workflow-report-serviceworkflowreport", "weaver-workflow-list-service"] },
+  { tag: "日报/周报", re: /日报|周报|月报|年报|工作总结/, groups: ["weaver-blog-service", "weaver-wr-plan-service"] },
+  { tag: "文档/附件", re: /文档|附件|文件夹|共享|资料/, groups: ["weaver-doc-servicedocument", "weaver-doc-service", "weaver-file-service"] },
+  { tag: "项目/任务", re: /项目|任务|工时|里程碑|延期|验收/, groups: ["weaver-project-service", "weaver-project-servicetask"] },
+  { tag: "客户/商机", re: /客户|商机|线索|联系人|公海|销售|CRM|营销/i, groups: ["weaver-crm-service", "weaver-crm-market-service"] },
+  { tag: "会议/日程", re: /会议|日程|日历|预约|会议室|预定/, groups: ["weaver-meeting-service", "weaver-calendar-service"] },
+  { tag: "人事/招聘", re: /招聘|入职|离职|offer|人才|员工|人员|通讯录|调岗|组织/i, groups: ["weaver-recruit-service", "weaver-hr-service", "weaver-hrm-service"] },
+  { tag: "薪酬/绩效", re: /薪酬|薪资|工资|社保|公积金|绩效|考核|KPI|OKR/i, groups: ["weaver-hrm-salary", "weaver-wr-performance-service", "weaver-wr-goal-service"] },
+  { tag: "合同/收款", re: /合同|签约|收款|回款|开票|发票|应收/, groups: ["weaver-ebuilder-contract-service", "weaver-ebuilder-contract-servicecmdatauFJXHS", "weaver-inc-biz-service"] },
+  { tag: "邮件/公文", re: /邮件|收件箱|公文|发文|档案|借阅/, groups: ["weaver-mail-base-service", "weaver-odoc-service"] },
+  { tag: "资产/日志", re: /资产|台账|日志|动作流|自动化/, groups: ["weaver-elog-service", "weaver-esb-setting-serviceesbCustom"] },
+];
+
+function dsGroupLabel(gid) { const g = DS_GROUPS.find((x) => x[2] === gid); return g ? g[1] : null; }
+function dsGroupMark(gid) { const g = DS_GROUPS.find((x) => x[2] === gid); return g ? g[3] : null; }
+
+/** 进程内并发闸门：一次凭据、N 个 HTTP 并发（把「N 次 CLI 调用」压成 1 次调用的核心） */
+async function mapLimit(items, limit, fn) {
+  const out = new Array(items.length);
+  let next = 0;
+  const workers = Array.from({ length: Math.max(1, Math.min(limit, items.length)) }, async () => {
+    for (;;) {
+      const i = next++;
+      if (i >= items.length) return;
+      out[i] = await fn(items[i], i);
+    }
+  });
+  await Promise.all(workers);
+  return out;
+}
+
+async function cmdDsGroups(args, json) {
+  const pat = args.pattern ? String(args.pattern) : null;
+  const groups = DS_GROUPS
+    .filter((g) => !pat || String(g[2]).includes(pat) || String(g[1]).includes(pat))
+    .map((g) => ({ groupId: g[2], label: g[1], serviceMark: g[3] }));
+  if (json) {
+    return {
+      count: groups.length,
+      groups,
+      coreGroups: DS_CORE_GROUPS,
+      semanticRules: DS_FIND_SEMANTIC_RULES.map((r) => ({ tag: r.tag, groups: r.groups })),
+      note: "内置分组清单，仅用于 ds find 的默认扫描候选集；分组随环境变动时用 --groups 显式覆盖",
+    };
+  }
+  printHuman("内置分组清单 " + groups.length + " 个", groups, ["groupId", "label", "serviceMark"]);
+}
+
+/** 选扫描集：--groups 显式 > --all-groups 全量 > 核心分组 + 语义命中 */
+function pickFindGroups(args, keyword) {
+  if (args.groups) {
+    return { mode: "explicit", groups: String(args.groups).split(",").map((s) => s.trim()).filter(Boolean) };
+  }
+  if (args["all-groups"]) return { mode: "all", groups: DS_GROUPS.map((g) => g[2]) };
+  const max = Math.max(parseInt(args["max-groups"] || "6", 10) || 6, DS_CORE_GROUPS.length);
+  const picked = [];
+  const push = (gid) => { if (gid && !picked.includes(gid)) picked.push(gid); };
+  for (const gid of DS_CORE_GROUPS) push(gid);
+  for (const r of DS_FIND_SEMANTIC_RULES) if (r.re.test(keyword)) for (const gid of r.groups) push(gid);
+  return { mode: "core", groups: picked.slice(0, max) };
+}
+
+/** 进程内并发扫分组（每分组 1~N 页 listByPage）。
+ *  ⚠️ 端点当前忽略 name ⇒ 抓回来的是「全量窗口」，关键词过滤由调用方在本地做；
+ *     窗口大小 = pageSize × pages，**未命中只代表未落在窗口内**（后端支持 name 后即为精确结果）。
+ *  ⚠️ appId：EB 分组（weaver-ebuilder-form-service）**按应用分域**，需要时透传 */
+async function dsScanGroups(gidList, keyword, sourceType, pageSize, concurrency, appId, pages) {
+  return mapLimit(gidList, concurrency, async (gid) => {
+    const out = { groupId: gid, label: dsGroupLabel(gid), serviceMark: dsGroupMark(gid), records: [], error: null, total: null, pagesFetched: 0 };
+    try {
+      for (let p = 1; p <= pages; p++) {
+        const form = { name: keyword, pageNo: String(p), pageSize: String(pageSize), groupId: gid, sourceType, dataUsage: "" };
+        if (appId) form.appId = String(appId);
+        const r = await dsListByPage(form);
+        const recs = ((r.data || {}).records) || [];
+        if (out.total === null) out.total = (r.data || {}).total ?? null;   // 后端过滤生效时 = 过滤后总数
+        out.records = out.records.concat(recs);
+        out.pagesFetched++;
+        if (recs.length < pageSize) break;                                   // 已到末页
+      }
+    } catch (e) { out.error = String((e && e.message) || e); }
+    return out;
+  });
+}
+
+// 同一实体（如一个流程）会在多个「报表/效率」分组里重复出现 → 归并去重，并保留落选分组做溯源
+function dsGroupPriority(gid) {
+  if (gid === "weaver-ebuilder-form-service") return 100;
+  if (gid === "weaver-formreport-service") return 95;
+  if (gid === "weaver-workflow-report-serviceworkflowreport") return 90;
+  if (/workflowEff|workflowFormReport|workflow_report$/i.test(gid)) return 20;
+  return 50;
+}
+function mergeDsCandidates(scanResults, limit) {
+  const map = new Map();
+  for (const r of scanResults) {
+    for (const rec of r.records) {
+      const gid = rec.groupId || r.groupId;
+      const name = String(rec.originalName || rec.tableText || rec.name || "").trim();
+      const key = name.replace(/\s+/g, "").toLowerCase() || gid + "|" + rec.id;
+      const item = {
+        groupId: gid, groupLabel: r.label, serviceMark: rec.serviceMark ?? r.serviceMark ?? null,
+        tableId: String(rec.id ?? ""), name: String(rec.tableText || rec.name || name), originalName: name,
+        objType: rec.objType ?? null, physicalTable: rec.physicalTable ?? null, appId: rec.appId ?? null,
+        isPhysical: rec.isPhysical ?? null, detailTable: !!rec.detailTable, usage: rec.usage ?? null,
+        sourceType: rec.sourceType ?? null, alsoInGroups: [], _pri: dsGroupPriority(gid),
+      };
+      const prev = map.get(key);
+      if (!prev) { map.set(key, item); continue; }
+      const win = prev._pri >= item._pri ? prev : item;
+      const lose = prev._pri >= item._pri ? item : prev;
+      win.alsoInGroups = win.alsoInGroups.concat(
+        [{ groupId: lose.groupId, groupLabel: lose.groupLabel, tableId: lose.tableId, serviceMark: lose.serviceMark }],
+        lose.alsoInGroups || [],
+      );
+      map.set(key, win);
+    }
+  }
+  const list = [...map.values()].sort((a, b) => b._pri - a._pri || String(a.originalName).localeCompare(String(b.originalName)));
+  const n = parseInt(limit || "0", 10) || 0;
+  return (n > 0 ? list.slice(0, n) : list).map((x) => { const { _pri, ...rest } = x; return rest; });
+}
+// 路由建议：命中所在的分组分布本身就是通道信号（比“先定通道再找表”更先验）
+function dsRouteHint(cands) {
+  const has = (fn) => cands.some(fn);
+  if (has((c) => /workflow/i.test(c.groupId) || c.serviceMark === "workflow")) {
+    return { channel: "WORKFLOW", desc: "WORKFLOW 模块配置通道 —— 流程类问题一律走模块接口，不用 DSL，也不走数据源", reason: "命中流程类分组" };
+  }
+  if (has((c) => c.groupId === "weaver-ebuilder-form-service" || c.serviceMark === "ebuilder")) {
+    return { channel: "DS_EB", desc: "数据源通道（EB 建模表单）—— 取数前必须先过 eb perm-page 权限校验，appId 取自那次校验", reason: "命中 EB 分组" };
+  }
+  if (has((c) => c.serviceMark === "form")) {
+    return { channel: "DS_FORM", desc: "数据源通道（业务表单 / 流程业务表单）", reason: "命中业务表单分组" };
+  }
+  if (has((c) => c.serviceMark === "task" || c.serviceMark === "mainline")) return { channel: "PROJECT/PMO", desc: "项目类：PMO 指标走 business/project-mgmt + DSL；明细/下拉选项走 PROJECT 模块", reason: "命中项目分组" };
+  if (has((c) => c.serviceMark === "attend")) return { channel: "EHR", desc: "EHR 模块配置通道（考勤/人事）", reason: "命中考勤分组" };
+  if (has((c) => c.serviceMark === "blog")) return { channel: "BLOG_DAILY", desc: "BLOG_DAILY 模块配置通道（日报）", reason: "命中日报分组" };
+  if (has((c) => c.serviceMark === "document")) return { channel: "DOCUMENT", desc: "DOCUMENT 模块配置通道（文档）", reason: "命中文档分组" };
+  if (has((c) => c.serviceMark === "customer" || c.serviceMark === "scrm")) return { channel: "CRM", desc: "CRM 模块配置通道（客户/商机/线索）", reason: "命中 CRM 分组" };
+  if (has((c) => c.serviceMark === "esb")) return { channel: "ESB", desc: "动作流（ESB）—— 无标准问数通道，需人工确认", reason: "仅命中动作流分组" };
+  return { channel: "DS", desc: "数据源通道（ds list / chart / stat / count）", reason: "通用" };
+}
+
+async function cmdDsFind(args, json) {
+  const keyword = String(args.name || args.keyword || "").trim();
+  if (!keyword) throw new Error("缺少必填参数 --name <关键词>");
+  const sourceType = args["source-type"] || "LOGIC";
+  // 端点忽略 name ⇒ 抓取窗口 = --size × --pages（后端支持 name 后，total 即为过滤后总数、pages 语义不变）
+  const pageSize = Math.min(Math.max(parseInt(args.size || "100", 10) || 100, 1), 2000);
+  const pages = Math.min(Math.max(parseInt(args.pages || "1", 10) || 1, 1), 50);
+  const concurrency = Math.max(1, parseInt(args.concurrency || "10", 10) || 10);
+  const appId = (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") ? args["app-id"] : null;
+  const picked = pickFindGroups(args, keyword);
+
+  const t0 = Date.now();
+  let scan = await dsScanGroups(picked.groups, keyword, sourceType, pageSize, concurrency, appId, pages);
+  // 后端 name 搜索是宽松的：实测部分分组会忽略 name 直接返回全量、或按描述命中 ⇒ 本地再按「表名包含关键词」过一遍。
+  // ⚠️ 端点忽略 name ⇒ 关键词过滤当前**只能在本地做**（见文件头 DS_LB_PATH 注释）。
+  //    落选项**不静默丢弃**，计数与样例放在 nameFilter 里；--loose 可完全关闭该过滤（保守用法）。
+  const kwNorm = keyword.replace(/\s+/g, "").toLowerCase();
+  const looseSample = [];
+  let looseDropped = 0;
+  let rowsScanned = 0;
+  const applyStrict = (rows) => rows.map((r) => {
+    rowsScanned += r.records.length;
+    if (args.loose) return r;
+    const keep = [], drop = [];
+    for (const rec of r.records) {
+      const nm = String(rec.originalName || rec.tableText || rec.name || "").replace(/\s+/g, "").toLowerCase();
+      (nm.includes(kwNorm) ? keep : drop).push(rec);
+    }
+    looseDropped += drop.length;
+    for (const d of drop.slice(0, 3)) {
+      if (looseSample.length < 6) looseSample.push({ groupId: r.groupId, name: String(d.originalName || d.tableText || d.name || "") });
+    }
+    return { ...r, records: keep };
+  });
+  scan = applyStrict(scan);
+  let escalated = false;
+  // 默认小集合全 miss → 自动升级为全分组扫一次（语义规则没覆盖到时兜底；全扫也是进程内并发）
+  // ⚠️ 端点忽略 name 时「miss」不代表表不存在（只是没落进窗口）⇒ 窗口较大时不再自动全扫，避免 58 组 × N 页的请求风暴
+  const escalateOk = pages * pageSize <= 2000;
+  if (!scan.some((r) => r.records.length) && picked.mode === "core" && !args["no-escalate"] && escalateOk) {
+    escalated = true;
+    const seen = new Set(picked.groups);
+    const extra = DS_GROUPS.map((g) => g[2]).filter((gid) => !seen.has(gid));
+    scan = scan.concat(applyStrict(await dsScanGroups(extra, keyword, sourceType, pageSize, concurrency, appId, pages)));
+  }
+  const elapsedMs = Date.now() - t0;
+
+  const okScan = scan.filter((r) => !r.error);
+  const errs = scan.filter((r) => r.error);
+  // 全部失败且像登录态问题 → 直接抛（不要把 401 伪装成“没找到表”）
+  if (!okScan.length && errs.length && errs.some((e) => /登录态失效|401/.test(e.error))) {
+    throw new Error("登录态失效：请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）后重试（本次未取到任何分组）");
+  }
+  const candidates = mergeDsCandidates(scan, args.limit);
+  const out = {
+    keyword, sourceType, scanMode: picked.mode + (escalated ? "+escalated" : ""),
+    scannedGroups: scan.length, hitGroups: scan.filter((r) => r.records.length).length,
+    escalated, elapsedMs, concurrency,
+    candidates, routeHint: dsRouteHint(candidates),
+    // 端点忽略 name：必须让调用方知道「未命中 ≠ 表不存在」
+    nameFilter: args.loose
+      ? { serverSide: false, filtered: false, pages, pageSize, rowsScanned, note: "--loose：未做本地过滤，直接采用后端返回" }
+      : {
+        serverSide: false, filtered: true, pages, pageSize, rowsScanned, dropped: looseDropped, sample: looseSample,
+        note: "端点 /api/dw/newetl/chatBi/ds/listByPage **当前忽略 name**（后端待升级）⇒ 本次为「抓 " + pages + " 页 × " + pageSize + " 行 + 本地按表名过滤」，共比对 " + rowsScanned + " 行；"
+          + "**未命中只代表未落在该窗口内，不等于该表不存在**（若该分组行数 > " + (pages * pageSize) + " 请调大 --size/--pages）。后端支持 name 后自动恢复精确过滤，无需改调用方式。",
+      },
+    scopeNote: scan.some((r) => r.groupId === "weaver-ebuilder-form-service")
+      ? (appId
+        ? "本次已带 --app-id=" + appId + "（EB 分组按应用分域，用于限定/对齐应用范围）"
+        : "⚠️ 本次未带 --app-id：EB 分组（weaver-ebuilder-form-service）按应用分域，如需限定某个应用请带 --app-id <该应用ID>")
+      : null,
+    errors: errs.map((e) => ({ groupId: e.groupId, error: e.error })),
+  };
+  if (json) return out;
+
+  console.log("== 找表「" + keyword + "」扫描 " + out.scannedGroups + " 组 / 抓取 " + rowsScanned + " 行 / 命中 " + out.hitGroups + " 组 (" + elapsedMs + "ms" + (escalated ? "，已升级全扫" : "") + ") ==");
+  if (!candidates.length) {
+    console.log("(未命中) ⚠️ 端点当前忽略 name，本次是「抓 " + pages + " 页 × " + pageSize + " 行 + 本地过滤」比对 " + rowsScanned + " 行；");
+    console.log("         **未命中 ≠ 该表不存在** —— 该分组行数若超过 " + (pages * pageSize) + "，请调大 --size（≤2000）/--pages（≤50）再试；");
+    console.log("         也可显式指定 --groups a,b / --all-groups；分组清单见 ds groups。");
+  } else {
+    for (const c of candidates) {
+      const extra = c.alsoInGroups && c.alsoInGroups.length ? "  [同实体亦见于: " + c.alsoInGroups.map((x) => x.groupId).join(", ") + "]" : "";
+      console.log([c.groupId, c.tableId, c.originalName || c.name, c.physicalTable ? "物理表=" + c.physicalTable : "", c.appId ? "appId=" + c.appId : ""].filter(Boolean).join("\t") + extra);
+    }
+  }
+  console.log("路由建议: " + out.routeHint.channel + " —— " + out.routeHint.desc);
+  if (out.scopeNote) console.log("范围提示: " + out.scopeNote);
+  if (errs.length) console.log("⚠ 有 " + errs.length + " 个分组请求失败（--json 看详情）");
+}
+
+// describe：一次并发取回「字段 + 词库」（两者入参同为 (groupId, tableId)，彼此无依赖）
+// ⚠️ 本命令**不做权限校验** —— EB 建模表单取数前的权限闸门仍必须**单独**执行 `e10-data eb perm-page`
+//    （appId 只从那次调用取）。原因：数据源通道本身不拦权限，权限判定与取数必须分开。
+function collectFieldNodes(list, out, subName) {
+  for (const f of list || []) {
+    if (!f) continue;
+    if (f.isDetailtable) {
+      const node = { subTableName: f.name, fields: [] };
+      collectFieldNodes(f.fields, node.fields, f.name);
+      out.push({ __detail: true, ...node });
+    } else {
+      out.push({
+        name: f.name, text: f.text ?? null, type: f.type ?? null, dbFieldType: f.dbFieldType ?? null,
+        isPK: !!f.mainPrimaryKey, subTable: subName || null,
+        dataKey: (f.config && f.config.dataKey) || null,
+        formTableId: (f.config && f.config.formTableId) || null,
+      });
+    }
+  }
+}
+function normalizeFieldsResp(r) {
+  const node = (r.data || [])[0] || {};
+  const flat = [];
+  collectFieldNodes(node.fields, flat, null);
+  const main = flat.filter((x) => !x.__detail);
+  const detail = flat.filter((x) => x.__detail).map((x) => ({ subTableName: x.subTableName, fieldCount: x.fields.length, fields: x.fields }));
+  return {
+    tableName: node.name ?? null, tableId: node.id ?? null,
+    mainCount: main.length, detailCount: detail.reduce((a, b) => a + b.fieldCount, 0), main, detail,
+  };
+}
+// 关联字段提取「表来源判定」的预判：groupId/serviceMark 已隐含表来源大类，不必再花 1~6 次 DSL 去反推
+function dsRelatedHint(gid, detailCount) {
+  if (gid === "weaver-ebuilder-form-service") {
+    return { likelyApplicable: true, tableOrigin: "eb", note: "EB 表：按 ebdf_obj ⋈ form_table ⋈ form 三表 JOIN 定位，再用 form_field / form_table_field 提关联字段；明细子表走 sub_form（本表明细字段 " + detailCount + " 个）" };
+  }
+  if (/^weaver-workflow/.test(gid)) return { likelyApplicable: true, tableOrigin: "flow", note: "流程相关表：按 ec_weaver_wfp_fusion 的 form_field / form_table_field 提关联字段" };
+  if (gid === "weaver-formreport-service") {
+    return { likelyApplicable: false, tableOrigin: "form-report", note: "业务表单（formreport）：表名是中文显示名、非物理表名 ⇒ relate-fields-extract 的 ①ETL ②SQL视图 ③④EB ⑤⑥流程 六类判定全部不适用，该跳必然空转，**不要发起**" };
+  }
+  return { likelyApplicable: false, tableOrigin: "unknown", note: "非 EB / 非流程表，关联字段提取通常不适用；如确需先按表名形态（sv_ / uf_ / 系统表名）人工确认" };
+}
+
+async function cmdDsDescribe(args, json) {
+  const gid = need("group", args);
+  const tid = String(need("table", args));
+  const sourceType = args["source-type"] || "LOGIC";
+  const t0 = Date.now();
+
+  const tasks = [
+    (async () => {
+      try {
+        const form = dsFieldsForm(gid, tid, sourceType);
+        if (typeof args["app-id"] === "string" && args["app-id"] !== "" && args["app-id"] !== "auto") form.appId = args["app-id"];
+        return { key: "fields", value: normalizeFieldsResp(await postMultipart("/api/ebuilder/common/ds/fields", form)) };
+      } catch (e) { return { key: "fields", error: String((e && e.message) || e) }; }
+    })(),
+    (async () => {
+      const skillKey = args.skill || "data-source-query";
+      try {
+        const q = new URLSearchParams({ skillKey, sourceType, sourceGroupId: gid, sourceTableId: tid });
+        const r = await getUrl("/api/dw/newetl/chatBi/skill/getChatDocsBySkillKey?" + q.toString());
+        const data = r.data;
+        const missing = !data || !Array.isArray(data.nouns);
+        return {
+          key: "lexicon",
+          value: {
+            skillKey, sourceType, sourceGroupId: gid, sourceTableId: tid,
+            noLexicon: missing, count: missing ? 0 : data.nouns.length,
+            nouns: missing ? [] : data.nouns.map((n) => ({ keyword: n.keyword ?? null, synonyms: n.synonyms ?? null, wordExplain: n.wordExplain ?? null })),
+            note: missing
+              ? "该数据集无词库（后端：" + (r.msg || "未返回 nouns") + "）—— 四参数均取自本次调用，故为**确定结论**；按铁律如实说明『该数据集暂无名词解释』，不自动建库、不新增名词"
+              : "词库命中：须先把每条规则逐条映射到 --where / --fields / --group-by / --stat 并自检无遗漏，再生成查询",
+          },
+        };
+      } catch (e) { return { key: "lexicon", error: String((e && e.message) || e) }; }
+    })(),
+  ];
+
+  const settled = await Promise.all(tasks);
+  const out = { groupId: gid, groupLabel: dsGroupLabel(gid), tableId: tid, sourceType, branches: settled.length };
+  const errors = [];
+  for (const s of settled) {
+    if (s.error) { out[s.key] = { error: s.error }; errors.push({ branch: s.key, error: s.error }); }
+    else out[s.key] = s.value;
+  }
+  out.relatedFields = dsRelatedHint(gid, (out.fields && out.fields.detailCount) || 0);
+  out.channelHint = dsRouteHint([{ groupId: gid, serviceMark: dsGroupMark(gid) }]);
+  // ⚠️ 权限闸门**不在本命令范围**：EB 建模表单取数前必须另行执行 `e10-data eb perm-page`（appId 只从那次校验取）
+  out.permissionNote = gid === "weaver-ebuilder-form-service"
+    ? "该分组是 EB 建模表单：取数前必须另行执行 `e10-data eb perm-page --obj-id <tableId> --form-table <物理表名>` 判权限并取 appId（--form-table 用 ds find / ds tables 返回的 physicalTable）"
+    : "非 EB 分组，数据源通道无需 eb perm-page 前置校验";
+  out.elapsedMs = Date.now() - t0;
+  if (errors.length && args.require) throw new Error("describe 存在失败分支，--require 下不继续：" + JSON.stringify(errors));
+  if (json) return out;
+
+  const f = out.fields || {};
+  console.log("== describe " + gid + " / " + tid + " (" + out.elapsedMs + "ms，并发 " + settled.length + " 路) ==");
+  if (f.error) console.log("字段: 失败 " + f.error);
+  else console.log("字段: 主表 " + f.mainCount + " 个，明细 " + f.detailCount + " 个（表名 " + (f.tableName ?? "-") + "）");
+  const lx = out.lexicon || {};
+  if (lx.error) console.log("词库: 失败 " + lx.error);
+  else console.log("词库: " + (lx.noLexicon ? "该数据集无词库" : "命中 " + lx.count + " 条（skill=" + lx.skillKey + "）"));
+  console.log("关联字段: " + (out.relatedFields.likelyApplicable ? "适用（" + out.relatedFields.tableOrigin + "）" : "不适用（" + out.relatedFields.tableOrigin + "）") + " —— " + out.relatedFields.note);
+  console.log("通道提示: " + out.channelHint.channel + " —— " + out.channelHint.desc);
+  console.log("权限: 不在本命令范围 —— " + out.permissionNote);
+}
+
+// ---------------- eb：EB 建模表单权限校验 ----------------
+// chatBi EB 配置映射分页查询：EB 表权限前置校验的 CLI 通道
+// （替代原「DSL 查 dw.chat_bi_eb_config_map + 客户端拼 (all_scop=1 OR target_id=本人)」写法）
+// 服务端已按登录人过滤：有权限 → total>=1 且行内回带 appId；无权限 / 表不存在 → total=0
+const EB_PERM_PAGE_PATH = "/api/dw/newetl/chatBi/getChatBiEbConfigMapByPage";
+async function cmdEbPermPage(args, json) {
+  // ⚠️ obj-id / app-id 为 19 位大整数：必须原样字符串传递。
+  //    经 JS Number 会舍入（840360795890851856 → 840360795890851840），实测后端接受字符串，
+  //    但吃下舍入后的数字会返回 total=0 —— 把「有权限」静默伪装成「无权限」。
+  const objId = String(need("obj-id", args));
+  const formTable = String(need("form-table", args));
+  // ⚠️ obj-id / form-table 缺失时后端不是报错，而是 HTTP 200 + 无 actionMsg + data 空，
+  //    外观与「无权限」完全一致 → 必须用 need() 在本地拦掉（need 对空串同样报错）。
+  const body = {
+    objId,
+    formTable,
+    pageNum: parseInt(args.page || "1", 10),
+    pageSize: parseInt(args.size || "10", 10),
+  };
+  if (typeof args["app-id"] === "string" && args["app-id"] !== "") body.app_id = String(args["app-id"]);
+  const r = await postJson(EB_PERM_PAGE_PATH, body);
+  if (json) return r;
+  // ⚠️ 失败判定：非法入参时 actionMsg 缺失（code=undefined），业务失败时 code!==0 → 一并按失败输出
+  const am = r.actionMsg || {};
+  if (am.code !== 0) { console.log("code=" + am.code + " msg=" + (am.message || "")); return; }
+  const d = r.data || {};
+  const recs = d.records || [];
+  const total = d.total === undefined || d.total === null ? 0 : d.total;
+  const first = recs[0] || null;
+  console.log("total = " + total);
+  printHuman("", recs, ["id", "objId", "formTable", "appId", "allScop", "targetId", "enabled", "deleteType"]);
+  console.log(total >= 1
+    ? (first
+      ? "结论: 有权限（appId=" + first.appId + "）"
+      : "结论: 有权限（total>=1；当前页无记录，appId 请用 --page 1 获取）")
+    : "结论: 无权限（total=0）");
+  if (args.require && total < 1) throw new Error("没有查询该 EB 表的权限（total=0）");
+}
+
+// ---------------- doc：文档查询 ----------------
+function docBaseBody(pageNo, pageSize) {
+  return {
+    curMenuType: "", limitedFolderIncludeSub: "", limitedFolderIds: "", docAppConsole: "",
+    viewType: "DOC_PAGINATION", pageNo, pageSize, morePageId: "", dimension: "ALL", includeBelongFolders: true,
+    order: { property: "default", direction: "DESC" }, searchType: "all", conditions: [], customConditions: [],
+    userId: auth.userId || "", current: pageNo,
+    columnOrders: [{ orderKey: "default", orderType: "" }], getColumn: false, quickSearchType: "normal",
+    withFullSearch: false, fetchFullSearchParam: true,
+  };
+}
+function buildDocConditions(args) {
+  const conds = [];
+  if (args.name) conds.push({ id: "name", type: "string", value: args.name });
+  if (args.creator) conds.push({ id: "creator", operate: args["creator-neq"] ? "neq" : "eq", type: "array", value: args.creator });
+  if (args.author) conds.push({ id: "author", operate: args["author-neq"] ? "neq" : "eq", type: "array", value: args.author });
+  if (args["content-type"]) conds.push({ id: "contentType", operate: "eq", type: "array", value: args["content-type"] });
+  if (args.time) conds.push({ id: "create_time", type: "date", value: args.time });
+  if (args["last-time"]) conds.push({ id: "last_update_time", type: "date", value: args["last-time"] });
+  if (args.folder) conds.push({ id: "folder", operate: "eq", type: "folder", value: args.folder });
+  if (args["folder-neq"]) conds.push({ id: "folder", operate: "neq", type: "folder", value: args["folder-neq"] });
+  return conds;
+}
+async function cmdDocCount(args, json) {
+  const body = docBaseBody(1, parseInt(args.size || "20", 10));
+  body.conditions = buildDocConditions(args);
+  const r = await postJson("/api/doc/documents/documentListCount", body);
+  if (json) return r;
+  const data = r.data || {};
+  console.log("total = " + (data.total ?? "-"));
+}
+async function cmdDocList(args, json) {
+  const pageSize = parseInt(args.size || "100", 10);
+  const body = docBaseBody(1, pageSize);
+  body.conditions = buildDocConditions(args);
+  const r1 = await postJson("/api/doc/documents/documentListCount", body);
+  if (json) return r1;
+  const total = (r1.data || {}).total || 0;
+  if (!total) { console.log("total = 0（未查询到符合条件的文档）"); return; }
+  const totalPages = Math.ceil(total / pageSize);
+  const maxPages = args.all ? totalPages : Math.min(parseInt(args.page || "1", 10), totalPages);
+  const startPage = args.all ? 1 : parseInt(args.page || "1", 10);
+  const allRows = [];
+  for (let pno = startPage; pno <= maxPages; pno++) {
+    const b = docBaseBody(pno, pageSize);
+    b.conditions = buildDocConditions(args);
+    const rr = await postJson("/api/doc/documents/documentList", b);
+    const rows = ((rr.data || {}).data) || [];
+    for (const row of rows) if (!allRows.some((x) => x.id === row.id)) allRows.push(row);
+    if (!args.all && pno === maxPages) break;
+  }
+  console.log("== 文档列表 total=" + total + " 本批=" + allRows.length + " 行 ==");
+  printHuman("", allRows, ["id", "name", "docCreatorName", "createTime", "folder"]);
+}
+
+// ---------------- noun：词库 ----------------
+async function cmdNoun(args, json) {
+  const skill = need("skill", args);
+  const q = new URLSearchParams({ skillKey: skill });
+  if (args["source-type"]) q.append("sourceType", args["source-type"]);
+  if (args["source-group"]) q.append("sourceGroupId", args["source-group"]);
+  if (args["source-table"]) q.append("sourceTableId", args["source-table"]);
+  const r = await getUrl("/api/dw/newetl/chatBi/skill/getChatDocsBySkillKey?" + q.toString());
+  if (json) return r;
+  const data = r.data;
+  if (!data || !data.nouns) {
+    console.log("(该 skill 词库不存在或为空) msg=" + (r.msg || ""));
+    return;
+  }
+  console.log("== 名词解释 " + data.nouns.length + " 条 (skill=" + skill + ") ==");
+  for (const n of data.nouns) {
+    console.log("【" + (n.keyword || "") + "】" + (n.synonyms ? " 同义:" + n.synonyms : ""));
+    if (n.wordExplain) console.log("  " + String(n.wordExplain).replace(/\n/g, " "));
+  }
+}
+
+// ---------------- field：关联字段翻译 ----------------
+function customParamFromArgs(args) {
+  if (args["form-param"]) return { formParam: args["form-param"] };
+  if (args["eb-browser-param"]) return { ebBrowserForEditParam: readJsonArg(args["eb-browser-param"], "--eb-browser-param") };
+  if (args["property-type"]) return { propertyType: args["property-type"] };
+  return {};
+}
+function extractRemoteRows(r, browserType) {
+  const remote = r.remote || {};
+  const keys = Object.keys(remote);
+  const out = [];
+  for (const k of keys) {
+    if (Array.isArray(remote[k])) for (const it of remote[k]) out.push({ key: k, id: it.id, content: it.content ?? it.name ?? "" });
+  }
+  return out;
+}
+async function cmdFieldId2name(args, json) {
+  const module = need("module", args), type = need("type", args), idsVal = need("ids", args);
+  const dataIds = idsVal.split(",").map((s) => s.trim()).filter(Boolean);
+  const body = [{ module, browserType: type, dataIds, user: USER, customParam: customParamFromArgs(args) }];
+  const r = await postJson("/api/bcw/test/testRemoteBrowser", body);
+  if (json) return r;
+  const rows = extractRemoteRows(r, type);
+  if (!rows.length) {
+    const nf = (r.notFound || {});
+    const list = nf && nf[module + "_" + type] && nf[module + "_" + type].ids ? nf[module + "_" + type].ids : [];
+    console.log("(未翻译到名称) notFound ids: " + (list.join(",") || "全部"));
+    return;
+  }
+  printHuman("id→name (" + rows.length + "/" + dataIds.length + ")", rows, ["id", "content"]);
+}
+async function cmdFieldName2id(args, json) {
+  const module = need("module", args), type = need("type", args), name = need("name", args);
+  const body = { newly: 1, searchValue: name, ...customParamFromArgs(args) };
+  const url = "/api/" + module + "/common/browser/complete/" + type;
+  const r = await postJson(url, body);
+  if (json) return r;
+  const rows = ((r.data || {}).data) || [];
+  if (!rows.length) { console.log("(未匹配到名称对应 ID)"); return; }
+  printHuman("name→id 候选 " + rows.length + " 条", rows.map((x) => ({ id: x.id, name: x.name ?? x.title ?? "" })), ["id", "name"]);
+}
+
+// ---------------- conf：环境参数配置中心（chatBi config map） ----------------
+// 覆盖 config-resolve 原 resolve_config.py 的 URL 直连调用：get/batch/batch-file/group/group-file/resolve/resolve-file
+// 与管理 add/add-file/update/delete。认证复用进程内登录缓存（完整 Cookie + eteamsid，同 query/ds/doc），
+// 无内置令牌；baseUrl 取登录缓存（与 executeQueryDsl 同域）。confType 默认由 key 前缀推导
+// （CONN_→conn / DS_→ds / WF_→wf / API_→api），可用 --type 显式指定任意大类（如 data-source-query / system-config）。
+//
+// v0.1.9 confGroup（配置分组，可选）：
+//   后端在 confType=api 时支持按分组二次分层（如 api/workflow、api/hr），定位维度变为
+//   「confType + confGroup + confKey」。本 CLI 统一用 --group 传分组：
+//     · confType 为 api（或显式传了 --group）时，新增/更新/删除/单查 才下发 confGroup 字段，
+//       其他 confType 一律不带该字段，避免污染既有（无分组列）的配置类型。
+//     · conf group <confType> <confGroup> 走 batchGetChatBiConfigMapByTypeAndGroup 按类型+分组批量取回。
+const CONF_PREFIX_TYPE = [["CONN_", "conn"], ["DS_", "ds"], ["WF_", "wf"], ["API_", "api"]];
+const CONF_GET_PATH = "/api/dw/newetl/chatBi/getChatBiConfigMap";
+const CONF_BATCH_PATH = "/api/dw/newetl/chatBi/batchGetChatBiConfigMap";
+const CONF_BATCH_GROUP_PATH = "/api/dw/newetl/chatBi/batchGetChatBiConfigMapByTypeAndGroup";
+const CONF_ADD_PATH = "/api/dw/newetl/chatBi/batchAddChatBiConfigMap";
+const CONF_UPDATE_PATH = "/api/dw/newetl/chatBi/updateChatBiConfigMap";
+const CONF_DELETE_PATH = "/api/dw/newetl/chatBi/deleteChatBiConfigMap";
+const CONF_TOKEN_RE = /#\{([A-Z][A-Z0-9_]{2,})\}/g;
+function confKeyType(key, explicitType) {
+  if (explicitType) return explicitType;
+  for (const [p, t] of CONF_PREFIX_TYPE) if (key.startsWith(p)) return t;
+  throw new Error("无法由 confKey 推导 confType（需 CONN_/DS_/WF_/API_ 前缀或显式 --type）: " + key);
+}
+// confGroup 仅在 confType=api 或调用方显式指定时下发（见上方说明）
+function confUseGroup(ctype, group) {
+  return ctype === "api" || (group !== undefined && group !== null && group !== "");
+}
+function confPutGroup(body, ctype, group) {
+  if (confUseGroup(ctype, group)) body.confGroup = group === undefined || group === null ? "" : String(group);
+  return body;
+}
+function confGroupSuffix(ctype, group) { // GET/DELETE 用的 query 后缀
+  return confUseGroup(ctype, group) ? "&confGroup=" + encodeURIComponent(group === undefined || group === null ? "" : String(group)) : "";
+}
+function confItemId(it) { // 同 confKey 可分布在多个 confGroup，带分组时用「组|键」做映射键，避免互相覆盖
+  const g = it && it.confGroup;
+  return g ? g + "|" + (it.confKey || "") : ((it && it.confKey) || "");
+}
+function confLookup(map, it) { // 兼容后端回包是否带 confGroup：先按「组|键」取，再退化到 confKey
+  return map[confItemId(it)] || map[it.confKey];
+}
+function confFail(j, url) {
+  const m = (j && (j.msg || (j.actionMsg && j.actionMsg.message))) || "";
+  throw new Error("配置服务请求失败 [" + url + "]" + (m ? ": " + m : ""));
+}
+async function confRequest(method, url, bodyObj) {
+  const resp = await fetch(BASE + url, {
+    method,
+    headers: {
+      "accept": "application/json, text/plain, */*",
+      "langType": "zh_CN",
+      "cookie": auth.cookie,
+      "eteamsid": auth.eteamsid,
+      "ebbusinessid": EB_BIZ_ID,
+      "user-agent": UA,
+      ...(bodyObj !== undefined ? { "Content-Type": "application/json;charset=UTF-8" } : {}),
+    },
+    ...(bodyObj !== undefined ? { body: JSON.stringify(bodyObj) } : {}),
+  });
+  const text = await resp.text();
+  let j; try { j = parseJsonSafe(text); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + text.slice(0, 300)); }
+  checkAuthFail(resp, text, j);
+  return j;
+}
+async function confGetData(ctype, key, silent, group) {
+  const url = CONF_GET_PATH + "?confType=" + encodeURIComponent(ctype) + "&confKey=" + encodeURIComponent(key) + confGroupSuffix(ctype, group);
+  let r;
+  try { r = await confRequest("GET", url); }
+  catch (e) { if (silent) return null; throw e; }
+  const data = (r && r.data) || null;
+  if (!silent && (!data || data.confValue === undefined || data.confValue === null || data.confValue === "")) {
+    throw new Error("配置不存在或为空: confType=" + ctype + (group ? " confGroup=" + group : "") + " confKey=" + key);
+  }
+  return data;
+}
+function confNormalizeBatch(payload) {
+  const data = (payload && payload.data) || null;
+  const out = {};
+  const put = (row, fallbackKey) => {
+    if (!row || typeof row !== "object") return;
+    const k = row.confKey || row.conf_key || fallbackKey;
+    if (!k) return;
+    if (row.confGroup === undefined) { const g = row.conf_group; if (g !== undefined && g !== null && g !== "") row.confGroup = g; }
+    out[confItemId({ confGroup: row.confGroup, confKey: k })] = row;
+  };
+  if (Array.isArray(data)) for (const row of data) put(row);
+  else if (data && typeof data === "object") for (const [k, v] of Object.entries(data)) put(v, k);
+  return out;
+}
+// 按类型+分组批量取回（batchGetChatBiConfigMapByTypeAndGroup），payload = [{confType, confGroup}...]
+async function confBatchByTypeAndGroup(pairs) {
+  const payload = pairs.map((p) => ({ confType: p.confType, confGroup: p.confGroup === undefined || p.confGroup === null ? "" : String(p.confGroup) }));
+  const r = await confRequest("POST", CONF_BATCH_GROUP_PATH, payload);
+  return confNormalizeBatch(r);
+}
+async function cmdConfGet(args, json, keys) {
+  const key = keys[0];
+  if (!key) throw new Error("conf get 缺少 confKey（用法: conf get <key> [--type t] [--group g]）");
+  const ctype = confKeyType(key, args.type);
+  let data;
+  try {
+    data = await confGetData(ctype, key, false, args.group);
+  } catch (e) {
+    if (ctype === "api" && !args.group) {
+      throw new Error(e.message + "（confType=api 建议用 --group 指定分组，如 --group workflow；或用 conf group api <分组> 查看该分组下全部配置）");
+    }
+    throw e;
+  }
+  if (json) return data;
+  console.log(JSON.stringify(data, null, 1));
+}
+async function cmdConfBatch(args, json, keys) {
+  if (!keys.length) throw new Error("conf batch 缺少 confKey 列表（用法: conf batch <key1> [key2 ...] [--type t] [--group g]）");
+  const items = keys.map((k) => { const t = confKeyType(k, args.type); return confPutGroup({ confType: t, confKey: k }, t, args.group); });
+  let map = {};
+  try {
+    const r = await confRequest("POST", CONF_BATCH_PATH, items);
+    map = confNormalizeBatch(r);
+    for (const it of items) {
+      const c = confLookup(map, it);
+      if (!c || c.confValue === undefined || c.confValue === null || c.confValue === "") {
+        throw new Error("批量响应缺失 confKey=" + it.confKey);
+      }
+    }
+  } catch (e) {
+    if (String(e.message).indexOf("批量响应缺失") === 0) throw e;
+    console.error("[config-resolve] 批量接口不可用，降级逐条单查: " + e.message);
+    map = {};
+    for (const it of items) map[confItemId(it)] = await confGetData(it.confType, it.confKey, false, it.confGroup);
+  }
+  if (json) return map;
+  printHuman("配置 " + items.length + " 条", keys.map((k) => {
+    const it = items.find((x) => x.confKey === k);
+    const c = confLookup(map, it) || {};
+    return { key: k, confType: it.confType, confGroup: it.confGroup ?? "", confValue: c.confValue ?? "", confName: c.confName ?? "" };
+  }), ["key", "confType", "confGroup", "confValue", "confName"]);
+}
+async function cmdConfBatchFile(args, json, keys) {
+  const val = flagOrPos(args, "batch-file", keys);
+  if (val === undefined) throw new Error("conf batch-file 缺少参数（用法: conf batch-file @items.json）");
+  const items = readJsonArg(String(val), "--batch-file");
+  const list = Array.isArray(items) ? items : [items];
+  const map = {};
+  const meta = {};
+  for (const it of list) {
+    if (!it.confKey || !it.confType) continue;
+    const id = confItemId(it);
+    map[id] = await confGetData(it.confType, it.confKey, false, it.confGroup);
+    meta[id] = it;
+  }
+  if (json) return map;
+  printHuman("配置 " + Object.keys(map).length + " 条", Object.keys(map).map((id) => ({ key: meta[id].confKey, confGroup: meta[id].confGroup ?? "", confValue: (map[id] || {}).confValue ?? "", confName: (map[id] || {}).confName ?? "" })), ["key", "confGroup", "confValue", "confName"]);
+}
+// 按类型+分组批量查（batchGetChatBiConfigMapByTypeAndGroup）：pairs = [{confType, confGroup}...]
+async function cmdConfGroup(args, json, keys) {
+  const ctype = keys[0] || args.type;
+  const group = keys[1] !== undefined ? keys[1] : args.group;
+  if (!ctype) throw new Error("conf group 缺少 confType（用法: conf group <confType> <confGroup> | --type api --group workflow）");
+  if (group === undefined) throw new Error("conf group 缺少 confGroup（用法: conf group <confType> <confGroup>）");
+  const map = await confBatchByTypeAndGroup([{ confType: ctype, confGroup: group }]);
+  const rows = Object.values(map);
+  const onlyKey = args.key;
+  const filtered = onlyKey ? rows.filter((r) => (r.confKey || r.conf_key) === onlyKey) : rows;
+  if (json) return onlyKey ? (filtered[0] ?? null) : filtered;
+  if (onlyKey && !filtered.length) throw new Error("配置不存在: confType=" + ctype + " confGroup=" + group + " confKey=" + onlyKey);
+  printHuman("confType=" + ctype + " confGroup=" + group + " 配置 " + filtered.length + " 条",
+    filtered.map((r) => ({ confKey: r.confKey || r.conf_key || "", confValue: r.confValue ?? "", confName: r.confName ?? "", confAttrs: r.confAttrs ?? "" })),
+    ["confKey", "confValue", "confName", "confAttrs"]);
+  return filtered;
+}
+async function cmdConfGroupFile(args, json, keys) {
+  const val = flagOrPos(args, "group-file", keys);
+  if (val === undefined) throw new Error("conf group-file 缺少参数（用法: conf group-file @items.json，形如 [{\"confType\":\"api\",\"confGroup\":\"workflow\"}]）");
+  const pairs = readJsonArg(String(val), "--group-file");
+  const list = (Array.isArray(pairs) ? pairs : [pairs]).filter((p) => p && p.confType);
+  if (!list.length) throw new Error("conf group-file 内容为空或缺少 confType");
+  const map = await confBatchByTypeAndGroup(list);
+  const rows = Object.values(map);
+  if (json) return map;
+  printHuman("批量分组配置 " + rows.length + " 条",
+    rows.map((r) => ({ confType: r.confType ?? "", confGroup: r.confGroup ?? "", confKey: r.confKey || r.conf_key || "", confValue: r.confValue ?? "", confName: r.confName ?? "" })),
+    ["confType", "confGroup", "confKey", "confValue", "confName"]);
+  return map;
+}
+async function confResolveAll(keys, group) {
+  // 多占位符：先批量预取一轮（失败降级逐条单查），返回 {key: data}
+  const items = keys.map((k) => confPutGroup({ confType: confKeyType(k, ""), confKey: k }, confKeyType(k, ""), group));
+  const map = {};
+  try {
+    const r = await confRequest("POST", CONF_BATCH_PATH, items);
+    const got = confNormalizeBatch(r);
+    for (const it of items) {
+      const c = confLookup(got, it);
+      if (!c || c.confValue === undefined || c.confValue === null || c.confValue === "") throw new Error("缺失 " + it.confKey);
+      map[it.confKey] = c;
+    }
+  } catch {
+    for (const it of items) map[it.confKey] = await confGetData(it.confType, it.confKey, false, it.confGroup);
+  }
+  return map;
+}
+async function confResolveText(text, json, group) {
+  const found = [...new Set([...text.matchAll(CONF_TOKEN_RE)].map((m) => m[1]))];
+  const map = found.length ? await confResolveAll(found, group) : {};
+  const out = text.replace(CONF_TOKEN_RE, (m0, k) => {
+    const cfg = map[k];
+    if (!cfg) throw new Error("配置不存在或为空: " + k);
+    return cfg.confValue ?? "";
+  });
+  if (json) return { input: text, output: out, resolved: Object.fromEntries(Object.entries(map).map(([k, v]) => [k, v.confValue ?? ""])) };
+  return out;
+}
+async function cmdConfResolve(args, json, keys) {
+  let text = keys[0];
+  if (!text) throw new Error("conf resolve 缺少文本（用法: conf resolve '<含#{KEY}文本>' | @file.txt [--group g]）");
+  if (text.startsWith("@")) text = fs.readFileSync(text.slice(1), "utf-8");
+  const out = await confResolveText(text, json, args.group);
+  if (json) { console.log(JSON.stringify(out, null, 1)); return out; }
+  process.stdout.write(out + "\n");
+}
+async function cmdConfResolveFile(args, json, keys) {
+  const p = flagOrPos(args, "resolve-file", keys);
+  if (!p) throw new Error("conf resolve-file 缺少文件路径（用法: conf resolve-file <文件路径> [--group g]）");
+  if (!fs.existsSync(p)) throw new Error("文件不存在: " + p);
+  const text = fs.readFileSync(p, "utf-8");
+  const out = await confResolveText(text, json, args.group);
+  if (json) { console.log(JSON.stringify(out, null, 1)); return out; }
+  process.stdout.write(out + "\n");
+}
+async function cmdConfAdd(args, json, keys) {
+  const key = keys[0];
+  if (!key || args.value === undefined) throw new Error("conf add 缺少 confKey/confValue（用法: conf add <key> --value <真实值> [--name] [--attrs] [--type] [--group] [--force]）");
+  const ctype = confKeyType(key, args.type);
+  if (!args.force && await confGetData(ctype, key, true, args.group)) {
+    console.error("[config-resolve] 配置已存在，跳过新增（如需修改请用 conf update；确需重建可先 conf delete）: " + key);
+    return null;
+  }
+  const item = confPutGroup({ confType: ctype, confKey: key, confValue: String(args.value), confAttrs: args.attrs || "", confName: args.name || "" }, ctype, args.group);
+  const r = await confRequest("POST", CONF_ADD_PATH, [item]);
+  if (json) return r;
+  console.log("新增成功: " + (item.confGroup ? item.confGroup + "/" : "") + key + " = " + item.confValue);
+}
+async function cmdConfAddFile(args, json, keys) {
+  const val = flagOrPos(args, "add-file", keys);
+  if (val === undefined) throw new Error("conf add-file 缺少参数（用法: conf add-file @items.json，元素形如 {confType,confGroup,confKey,confValue,confName,confAttrs}）");
+  const items = readJsonArg(String(val), "--add-file");
+  const list = Array.isArray(items) ? items : [items];
+  const toAdd = [];
+  for (const it of list) {
+    if (!it.confKey || it.confValue === undefined) continue;
+    const ctype = it.confType || confKeyType(it.confKey, args.type);
+    const group = it.confGroup !== undefined ? it.confGroup : args.group;
+    const dup = await confGetData(ctype, it.confKey, true, group);
+    if (dup) { console.error("[config-resolve] 已存在跳过: " + it.confKey); continue; }
+    toAdd.push(confPutGroup({ confType: ctype, confKey: it.confKey, confValue: String(it.confValue), confAttrs: it.confAttrs || "", confName: it.confName || "" }, ctype, group));
+  }
+  if (!toAdd.length) { console.log("全部已存在，无新增"); return null; }
+  const r = await confRequest("POST", CONF_ADD_PATH, toAdd);
+  if (json) return r;
+  console.log("批量新增 " + toAdd.length + " 条成功");
+}
+async function cmdConfUpdate(args, json, keys) {
+  const key = keys[0];
+  if (!key) throw new Error("conf update 缺少 confKey（用法: conf update <key> [--value v] [--name n] [--attrs a] [--type t] [--group g]）");
+  if (args.value === undefined && args.name === undefined && args.attrs === undefined) {
+    throw new Error("conf update 至少需提供 --value / --name / --attrs 之一");
+  }
+  const ctype = confKeyType(key, args.type);
+  const body = confPutGroup({ confType: ctype, confKey: key }, ctype, args.group);
+  if (args.value !== undefined) body.confValue = String(args.value);
+  if (args.name !== undefined) body.confName = args.name;
+  if (args.attrs !== undefined) body.confAttrs = args.attrs;
+  const r = await confRequest("POST", CONF_UPDATE_PATH, body);
+  if (json) return r;
+  console.log("更新成功: " + (body.confGroup ? body.confGroup + "/" : "") + key);
+}
+async function cmdConfDelete(args, json, keys) {
+  const key = keys[0];
+  if (!key) throw new Error("conf delete 缺少 confKey（用法: conf delete <key> [--type t] [--group g]）");
+  const ctype = confKeyType(key, args.type);
+  const url = CONF_DELETE_PATH + "?confType=" + encodeURIComponent(ctype) + "&confKey=" + encodeURIComponent(key) + confGroupSuffix(ctype, args.group);
+  const r = await confRequest("DELETE", url);
+  if (json) return r;
+  console.log("删除成功: " + (confUseGroup(ctype, args.group) && args.group ? args.group + "/" : "") + key);
+}
+async function cmdConf(sub, args, json, pos) {
+  const keys = pos.slice(2);
+  switch (sub) {
+    case "get": return cmdConfGet(args, json, keys);
+    case "batch": return cmdConfBatch(args, json, keys);
+    case "batch-file": return cmdConfBatchFile(args, json, keys);
+    case "group": return cmdConfGroup(args, json, keys);
+    case "group-file": return cmdConfGroupFile(args, json, keys);
+    case "resolve": return cmdConfResolve(args, json, keys);
+    case "resolve-file": return cmdConfResolveFile(args, json, keys);
+    case "add": return cmdConfAdd(args, json, keys);
+    case "add-file": return cmdConfAddFile(args, json, keys);
+    case "update": return cmdConfUpdate(args, json, keys);
+    case "delete": return cmdConfDelete(args, json, keys);
+    default: usage(); process.exit(1);
+  }
+}
+
+// ---------------- attend：考勤 REST 接口 ----------------
+// 2026-09-07：封装 /api/attend/web/attendInfoV2/getAttendInfoStatis（假期余额统计，hr-attendance 场景六病假/事假）。
+// 请求参数 {beginDate, endDate, userId}；返回 data.vacationBalanceList[]：{id,title,data:[{name,value,key}]}，
+// key 含 lastRemaining(历年可请)/remaining(今年可请)/total(总计可请)。
+function defaultMonthRange() {
+  const now = new Date();
+  const y = now.getFullYear();
+  const m = now.getMonth() + 1;
+  const lastDay = new Date(y, m, 0).getDate();
+  const p = (n) => String(n).padStart(2, "0");
+  return { begin: y + "-" + p(m) + "-01", end: y + "-" + p(m) + "-" + p(lastDay) };
+}
+async function cmdAttendStatis(args, json) {
+  const user = args.user || auth.userId || "";
+  if (!user) throw new Error("缺少查询人员：--user <人员ID>（查本人可不传，默认当前登录用户）");
+  const def = defaultMonthRange();
+  const body = { beginDate: args.begin || def.begin, endDate: args.end || def.end, userId: user };
+  const r = await postJson("/api/attend/web/attendInfoV2/getAttendInfoStatis", body);
+  if (json) return r;
+  if (String(r.code) !== "200") {
+    console.log("code=" + r.code + " msg=" + (r.msg || ""));
+    if (/没有权限|无权限|权限不足|未授权|无权访问|无查询权限/i.test(String(r.msg || ""))) {
+      throw new Error("当前用户对该人员考勤数据无查询权限，请检查 ETEAMSID 或联系管理员开通");
+    }
+    return;
+  }
+  const d = r.data || {};
+  const list = Array.isArray(d.vacationBalanceList) ? d.vacationBalanceList : [];
+  if (!list.length) { console.log("(空：该人员无假期余额数据) userId=" + user + " " + body.beginDate + "~" + body.endDate); return; }
+  console.log("== 考勤假期余额 userId=" + user + "（" + body.beginDate + " ~ " + body.endDate + "）==");
+  for (const item of list) {
+    console.log((item.title || item.id || "?") + (item.id ? " [" + item.id + "]" : ""));
+    if (Array.isArray(item.data) && item.data.length) {
+      console.log("  " + item.data.map((x) => (x.name || x.key) + "=" + (x.value ?? "")).join("  "));
+    }
+  }
+}
+
+// ---------------- exp：专家包版本管理（expert-repository） ----------------
+async function expGet(url) {
+  // 返回 {raw, j}：raw 用于正则提取大整数 id（commitId 19 位超 JS Number 精度，JSON.parse 会丢精度！）
+  const resp = await fetch(BASE + url, {
+    method: "GET",
+    headers: { "accept": "application/json, text/plain, */*", "langType": "zh_CN", "cookie": auth.cookie, "eteamsid": auth.eteamsid, "ebbusinessid": EB_BIZ_ID, "user-agent": UA },
+  });
+  const raw = await resp.text();
+  let j; try { j = parseJsonSafe(raw); } catch { throw new Error("HTTP " + resp.status + " 非JSON响应: " + raw.slice(0, 300)); }
+  if (resp.status === 401 || (j && String(j.code) === "-1" && /token|登录|失效/i.test(String(j.msg || "")))) throw new Error("登录态失效，请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）");
+  return { raw, j };
+}
+function rawNum(raw, key) {
+  // 从原始 JSON 文本提取整数字段为精确字符串（避免 JSON.parse 大数丢精度，如 commitId）
+  const m = raw.match(new RegExp('"' + key + '":\\s*(\\d+)'));
+  return m ? m[1] : "";
+}
+function rawNumSeq(raw, key) {
+  // 提取某 key 全部整数序列（按出现顺序），如提交历史里的 commitId
+  const re = new RegExp('"' + key + '":\\s*(\\d+)', "g");
+  const out = []; let m;
+  while ((m = re.exec(raw)) !== null) out.push(m[1]);
+  return out;
+}
+const EXP_ALLOWED_DIRS = [".codebuddy-plugin", "agents", "avatars", "skills"];
+const EXP_SKIP_DIRS = [".git", ".workbuddy", "node_modules", "__pycache__"];
+const EXP_SKIP_FILES = [".sync-state.json"]; // 本地同步状态元文件（含基线 sha），永不随包提交
+function sha256(buf) { return crypto.createHash("sha256").update(buf).digest("hex"); }
+function walkDir(dir, root) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const abs = path.join(dir, entry.name);
+    const rel = path.relative(root, abs).split(path.sep).join("/");
+    if (entry.isDirectory()) {
+      if (EXP_SKIP_DIRS.includes(entry.name)) continue;
+      const top = rel.split("/")[0];
+      if (rel.includes("/") && !EXP_ALLOWED_DIRS.includes(top)) continue; // 仅允许根文件+四大目录
+      walkDir(abs, root).forEach((x) => out.push(x));
+    } else if (entry.isFile()) {
+      if (EXP_SKIP_FILES.includes(entry.name)) continue; // .sync-state.json 不入包
+      const top = rel.split("/")[0];
+      if (!rel.includes("/") || EXP_ALLOWED_DIRS.includes(top)) out.push({ rel, abs });
+    }
+  }
+  return out;
+}
+function collectPackage(dir) {
+  if (!fs.existsSync(dir)) throw new Error("本地专家包目录不存在: " + dir);
+  return walkDir(dir, dir).map(({ rel, abs }) => {
+    const buf = fs.readFileSync(abs);
+    if (buf.length > 10 * 1024 * 1024) throw new Error("文件超 10MB 上限: " + rel);
+    return { relativePath: rel, contentBase64: buf.toString("base64"), sha256: sha256(buf), abs };
+  });
+}
+function localShaMap(dir) {
+  const map = {};
+  for (const f of walkDir(dir, dir)) map[f.rel] = sha256(fs.readFileSync(f.abs));
+  return map;
+}
+function expOk(r) {
+  if (!r) return false;
+  if (r.actionMsg) return String(r.actionMsg.code) === "0";
+  const code = r.code;
+  if (code === undefined) return !r.fail;
+  return String(code) === "0" || String(code) === "200";
+}
+function expFailMsg(r) {
+  if (r && r.actionMsg && String(r.actionMsg.code) !== "0") return r.actionMsg.message;
+  if (r && r.msg) return r.msg;
+  return "请求失败";
+}
+function printExpData(r, title) {
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  if (title) console.log("== " + title + " ==");
+  console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+async function rawGet(url) {
+  const resp = await fetch(BASE + url, {
+    method: "GET",
+    headers: { "accept": "*/*", "langType": "zh_CN", "cookie": auth.cookie, "eteamsid": auth.eteamsid, "ebbusinessid": EB_BIZ_ID, "user-agent": UA },
+  });
+  if (resp.status === 401) throw new Error("登录态失效，请重新登录 weaver-work-cli（`weaver-work-cli auth login --base-url <域名>`）");
+  return Buffer.from(await resp.arrayBuffer());
+}
+async function expStatus(args, json) {
+  const expert = need("expert", args);
+  const { raw, j: r } = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  const d = r.data || {};
+  console.log("== 仓库状态 " + expert + " ==");
+  console.log("expertCode = " + (d.expertCode ?? ""));
+  console.log("displayName = " + (d.displayName ?? ""));
+  console.log("branchName = " + (d.branchName ?? ""));
+  console.log("headCommitId = " + (rawNum(raw, "headCommitId") || d.headCommitId));
+  console.log("headRevision = " + (d.headRevision ?? ""));
+  for (const k of ["headCommitHash", "headCommitMessage", "headCommitTime", "headAuthor", "protected"]) if (d[k] !== undefined) console.log(k + " = " + d[k]);
+  if (Array.isArray(d.locks) && d.locks.length) { console.log("有效锁:"); for (const l of d.locks) console.log("  " + JSON.stringify(l)); }
+}
+async function expManifest(args, json) {
+  const expert = need("expert", args);
+  let url = "/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main");
+  if (args.commit) url += "&commitId=" + encodeURIComponent(args.commit);
+  const r = await getUrl(url);
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  const items = r.data || [];
+  console.log("== 文件清单 " + items.length + " 项 ==");
+  printHuman("", items, ["relativePath", "sha256", "size", "action"]);
+}
+async function expCommits(args, json) {
+  const expert = need("expert", args);
+  const { raw, j: r } = await expGet("/api/dw/expert-repository/v1/repositories/commits?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  const rows = (r.data || []).map((x, i) => ({ ...x, commitId: (rawNumSeq(raw, "commitId")[i] || x.commitId) }));
+  console.log("== 提交历史 " + rows.length + " 条（commitId 为精确值，可复制用于 file/release/rollback）==");
+  printHuman("", rows, ["commitId", "submitMode", "author", "createTime", "message"]);
+}
+async function expFile(args, json) {
+  const expert = need("expert", args), commit = need("commit", args), rp = need("path", args);
+  const buf = await rawGet("/api/dw/expert-repository/v1/repositories/file?expertCode=" + encodeURIComponent(expert) + "&commitId=" + encodeURIComponent(commit) + "&relativePath=" + encodeURIComponent(rp));
+  if (args.out) { fs.writeFileSync(args.out, buf); console.log("已下载 " + buf.length + " 字节 -> " + args.out); return; }
+  if (json) { console.log(JSON.stringify({ relativePath: rp, size: buf.length, base64: buf.toString("base64") })); return; }
+  process.stdout.write(buf.toString("utf-8"));
+}
+// ---- exp 智能拉取：基线状态文件（三方差异保护，2026-09-04 实现）----
+// .sync-state.json 记录上次成功同步的 commitId/revision 与每文件 sha256（基线）。
+// pull 逐文件三方对比：local(当前本地) vs base(上次同步基线) vs remote(远端 manifest)，
+// 决策：仅远端改→覆盖；仅本地改→保留本地；双方都改→备份本地副本后覆盖（备份目录保留本地版）；
+// 无基线文件/基线无记录→保守备份后覆盖。拉取成功后把 .sync-state.json 更新为新 head。
+function syncStatePath(dir) { return path.join(dir, ".sync-state.json"); }
+function readSyncState(dir) {
+  const p = syncStatePath(dir);
+  if (!fs.existsSync(p)) return null;
+  try {
+    const j = JSON.parse(fs.readFileSync(p, "utf-8"));
+    const files = {};
+    for (const [rel, v] of Object.entries(j.files || {})) files[rel] = (typeof v === "string") ? v : (v.sha256 || "");
+    return { commitId: String(j.commitId || ""), headRevision: j.headRevision, files };
+  } catch { return null; }
+}
+function writeSyncState(dir, commitId, headRevision, fileShaMap) {
+  const files = {};
+  for (const [rel, sha] of Object.entries(fileShaMap)) files[rel] = { sha256: sha };
+  const obj = { commitId: String(commitId), headRevision, files, updateTime: new Date().toISOString() };
+  fs.writeFileSync(syncStatePath(dir), JSON.stringify(obj, null, 1), "utf-8");
+}
+async function expPull(args, json) {
+  const expert = need("expert", args), dir = need("dir", args);
+  const dry = !!args["dry-run"];
+  const force = !!args["force"]; // --force = 一律以远端覆盖（放弃本地修改）
+  const st = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+  if (!expOk(st.j)) throw new Error(expFailMsg(st.j));
+  const headId = rawNum(st.raw, "headCommitId") || String((st.j.data || {}).headCommitId);
+  const headRev = (st.j.data || {}).headRevision;
+  const mf = await expGet("/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+  if (!expOk(mf.j)) throw new Error(expFailMsg(mf.j));
+  const items = (mf.j.data || []).filter((f) => f.relativePath && f.relativePath !== "DELETE");
+  const local = fs.existsSync(dir) ? localShaMap(dir) : {};
+  const base = readSyncState(dir); // 基线：上次同步后的文件 sha（无则 null）
+  const baseCommit = (base && base.commitId) || "";
+  // 基线有效判定：上次同步 commitId 须在提交历史上（取不到历史就保守按无基线处理）
+  let backupRoot = "";
+  let downloaded = 0, unchanged = 0, preserved = 0, backed = 0, missing = 0;
+  const plan = []; // {rel, action, reason}
+  const mkBackupRoot = () => {
+    if (backupRoot) return backupRoot;
+    const absDir = path.resolve(dir);
+    const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+    backupRoot = path.join(path.dirname(absDir), path.basename(absDir) + ".pull-backup-" + ts);
+    fs.mkdirSync(backupRoot, { recursive: true });
+    return backupRoot;
+  };
+  for (const it of items) {
+    const lp = path.join(dir, it.relativePath.split("/").join(path.sep));
+    const ls = local[it.relativePath];
+    const baseSha = (base && base.files) ? base.files[it.relativePath] : undefined;
+    if (ls === it.sha256) { unchanged++; continue; }
+    if (ls === undefined) { // 本地缺失 → 直接下载（新增/恢复）
+      missing++; plan.push({ rel: it.relativePath, action: dry ? "待下载" : "已下载", reason: "本地缺失" });
+    } else if (!force && baseSha !== undefined && ls === baseSha && baseSha !== it.sha256) {
+      // 仅远端改（本地未动，与基线一致）→ 覆盖
+      plan.push({ rel: it.relativePath, action: dry ? "待下载" : "已下载", reason: "远端更新（本地未动）" });
+    } else if (!force && baseSha !== undefined && baseSha === it.sha256) {
+      // 仅本地改（远端=基线，本地≠基线）→ 保留本地，不覆盖
+      preserved++; plan.push({ rel: it.relativePath, action: "保留本地", reason: "本地修改（远端未动）" });
+      continue;
+    } else { // 双方都改 / 无基线可判 / --force → 先备份本地副本再覆盖
+      backed++;
+      if (!dry && !force) {
+        const bdir = path.join(mkBackupRoot(), it.relativePath.split("/").join(path.sep));
+        fs.mkdirSync(path.dirname(bdir), { recursive: true });
+        fs.copyFileSync(lp, bdir);
+      }
+      plan.push({ rel: it.relativePath, action: dry ? "待下载(将备份本地)" : (force ? "已下载(force覆盖)" : "已下载(本地已备份)"), reason: (force ? "force 覆盖" : (baseSha === undefined ? "无基线记录" : "双方都改")) });
+    }
+    if (dry) continue;
+    fs.mkdirSync(path.dirname(lp), { recursive: true });
+    const buf = await rawGet("/api/dw/expert-repository/v1/repositories/file?expertCode=" + encodeURIComponent(expert) + "&commitId=" + encodeURIComponent(headId) + "&relativePath=" + encodeURIComponent(it.relativePath));
+    fs.writeFileSync(lp, buf);
+    downloaded++;
+  }
+  // 拉取成功后更新基线状态文件（记录新 head + 本地最终文件 sha）
+  if (!dry) {
+    const finalLocal = localShaMap(dir);
+    writeSyncState(dir, headId, headRev, finalLocal);
+  }
+  const out = { expert, headCommitId: headId, headRevision: headRev, total: items.length, unchanged, downloaded, preserved, backed, missing, dryRun: !!dry, backupDir: backupRoot || undefined };
+  if (json) { console.log(JSON.stringify(out)); return; }
+  console.log("== pull " + expert + "@" + headId + (dry ? " (dry-run)" : "") + " ==");
+  console.log("清单 " + out.total + " 项 | 未变 " + unchanged + " | 已下载 " + downloaded + " | 保留本地 " + preserved + " | 覆盖前备份 " + backed + " | 缺失 " + missing);
+  for (const p of plan.slice(0, 40)) console.log("  [" + p.action + "] " + p.rel + (p.reason ? "（" + p.reason + "）" : ""));
+  if (plan.length > 40) console.log("  ... 共 " + plan.length + " 个文件");
+  if (backupRoot && !dry) console.log("本地修改副本备份于: " + backupRoot);
+  if (preserved > 0 && !dry) console.log("⚠️ " + preserved + " 个文件因含本地修改被保留（远端未改）；如需强制覆盖请加 --force");
+}
+async function expInit(args, json) {
+  const expert = need("expert", args), dir = need("dir", args);
+  const files = collectPackage(dir);
+  const body = { expertCode: expert, displayName: args["display-name"] || expert, branchName: args.branch || "main",
+    description: args.description || "", initialCommitMessage: args.message || "初始化导入", files };
+  const r = await postJson("/api/dw/expert-repository/v1/repositories", body);
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  console.log("== 仓库已创建 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+async function expCommit(args, json) {
+  const expert = need("expert", args), dir = need("dir", args), msg = need("message", args);
+  const mode = (args.mode || "FULL_SNAPSHOT").toUpperCase();
+  const st = await expGet("/api/dw/expert-repository/v1/repositories/status?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+  if (!expOk(st.j)) throw new Error("无法获取基线: " + expFailMsg(st.j));
+  const base = st.j.data || {};
+  const body = {
+    branchName: base.branchName || "main",
+    baseCommitId: rawNum(st.raw, "headCommitId") || String(base.headCommitId), // 精确字符串，避免大数丢精度
+    baseRevision: base.headRevision,
+    commitMessage: msg,
+  };
+  if (mode === "FILE_PATCH") {
+    const mf = await expGet("/api/dw/expert-repository/v1/repositories/manifest?expertCode=" + encodeURIComponent(expert) + "&branchName=" + (args.branch || "main"));
+    if (!expOk(mf.j)) throw new Error("无法获取 manifest: " + expFailMsg(mf.j));
+    const remoteSha = {}; for (const f of (mf.j.data || [])) remoteSha[f.relativePath] = f.sha256;
+    const local = collectPackage(dir);
+    const localSha = {}; for (const f of local) localSha[f.relativePath] = f.sha256;
+    const changes = [];
+    for (const f of local) {
+      const rs = remoteSha[f.relativePath];
+      if (rs === undefined) changes.push({ operation: "ADD", relativePath: f.relativePath, contentBase64: f.contentBase64, sha256: f.sha256, baseFileSha256: "" });
+      else if (rs !== f.sha256) changes.push({ operation: "MODIFY", relativePath: f.relativePath, contentBase64: f.contentBase64, sha256: f.sha256, baseFileSha256: rs });
+    }
+    for (const rp of Object.keys(remoteSha)) if (localSha[rp] === undefined) changes.push({ operation: "DELETE", relativePath: rp, baseFileSha256: remoteSha[rp] });
+    if (!changes.length) throw new Error("本地与远端一致，无变更可提交");
+    body.submitMode = "FILE_PATCH"; body.changes = changes;
+  } else {
+    body.submitMode = "FULL_SNAPSHOT"; body.files = collectPackage(dir);
+  }
+  const r = await postJson("/api/dw/expert-repository/v1/repositories/commits?expertCode=" + encodeURIComponent(expert), body);
+  if (json) return r;
+  if (!expOk(r)) {
+    const m = expFailMsg(r);
+    if (/基线|过期|revision|冲突/i.test(m)) throw new Error("提交冲突: " + m + " —— 请先 exp pull 拉取最新并合并后重试");
+    throw new Error("提交失败: " + m);
+  }
+  // 提交成功后把本地 .sync-state.json 基线刷新到新 head（与本地文件 sha 一致），保证后续 pull 三方判定准确
+  const rj = r.data || {};
+  const newHead = rawNum(JSON.stringify(r), "headCommitId") || rawNum(JSON.stringify(r), "commitId") || rj.headCommitId || rj.commitId || "";
+  if (newHead && fs.existsSync(dir)) {
+    try { writeSyncState(dir, newHead, rj.headRevision ?? rj.revision ?? 0, localShaMap(dir)); } catch {}
+  }
+  console.log("== 提交成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+async function expLock(args, json) {
+  const expert = need("expert", args);
+  const act = (args.action || "").toLowerCase();
+  const branch = args.branch || "main";
+  if (act === "query") {
+    const r = await getUrl("/api/dw/expert-repository/v1/repositories/locks?expertCode=" + encodeURIComponent(expert) + "&branchName=" + encodeURIComponent(branch));
+    if (json) return r;
+    if (!expOk(r)) throw new Error(expFailMsg(r));
+    printExpData(r, "有效锁");
+    return;
+  }
+  if (act === "heartbeat") {
+    const token = need("lock-token", args);
+    const r = await postJson("/api/dw/expert-repository/v1/repositories/locks/heartbeat?lockToken=" + encodeURIComponent(token), {});
+    if (json) return r;
+    if (!expOk(r)) throw new Error(expFailMsg(r));
+    console.log("锁已续期: " + JSON.stringify(r.data ?? {}));
+    return;
+  }
+  if (act === "release") {
+    const token = need("lock-token", args);
+    const req = new Request(BASE + "/api/dw/expert-repository/v1/repositories/locks?lockToken=" + encodeURIComponent(token), { method: "DELETE" });
+    const resp = await fetch(req, { headers: { "cookie": auth.cookie, "eteamsid": auth.eteamsid, "accept": "application/json" } });
+    const text = await resp.text();
+    let r; try { r = JSON.parse(text); } catch { r = { data: { raw: text } }; }
+    if (json) return r;
+    if (!expOk(r)) throw new Error(expFailMsg(r));
+    console.log("锁已释放");
+    return;
+  }
+  // acquire（默认）
+  const body = { branchName: branch, componentKey: args.component || "ROOT", ttlMinutes: parseInt(args.ttl || "30", 10) };
+  const r = await postJson("/api/dw/expert-repository/v1/repositories/locks?expertCode=" + encodeURIComponent(expert), body);
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  console.log("== 锁已获取（记录 lockToken 供 heartbeat/release/commit 使用）==");
+  console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+async function expRelease(args, json) {
+  const expert = need("expert", args);
+  const r = await postJson("/api/dw/expert-repository/v1/repositories/releases?expertCode=" + encodeURIComponent(expert),
+    { commitId: need("commit", args), versionTag: need("version", args), releaseNote: args.note || "" });
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  console.log("== 发布成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+async function expRollback(args, json) {
+  const expert = need("expert", args);
+  const r = await postJson("/api/dw/expert-repository/v1/repositories/releases/rollback?expertCode=" + encodeURIComponent(expert) + "&versionTag=" + encodeURIComponent(need("version", args)), {});
+  if (json) return r;
+  if (!expOk(r)) throw new Error(expFailMsg(r));
+  console.log("== 回滚成功 =="); console.log(JSON.stringify(r.data ?? {}, null, 1));
+}
+
+// ---------------- main ----------------
+function usage() {
+  console.log(`e10-data CLI（data-assistant 数据接口统一命令行，2026-09-03 扩展）
+用法: node e10-data.mjs <族> <子命令> [--参数]   通用 --json 原样输出
+
+login   登录（**唯一不需要已有凭据**的命令族；其余命令都要求先有登录态）
+  login xiaoe-env [--domain <url>]   # 用环境变量 XIAOE_USER_TOKEN + XIAOE_DOMAIN（XiaoE 全局 token）
+                                     # 换 ETEAMSID 并写入 profile（免浏览器；不依赖 python）
+                                     # --domain 缺省 = 当前 profile 的 config.json.baseUrl → 默认平台地址
+                                     # 依赖环境变量：XIAOE_USER_TOKEN（XiaoE token）、XIAOE_DOMAIN（erpa 域名）
+                                     # 别名 e10-data xiaoe-env（与 e10-login 同名命令一致）
+                                     # 说明：换 token 由本 CLI 原生完成；写 profile（auth 加密）仍交 e10-login set
+                                     #       成功后自动用取数链路自检读回凭据，读不回即报错（不假成功）
+
+query   DSL 数据查询 executeQueryDsl
+  query  --conn <connId> --model <ebuilder|flow|eteams|attend|hr|document|dw|blog> --schema <数据库> [--table-id <流程ID>] [--debug true|false] --dsl @file.json|'{...}'
+ds      数据源（业务模块）取数与元数据
+  ds groups  [--pattern <关键词>] [--json]        # 内置分组清单（仅用于 find 的默认扫描集）
+  ds find    --name <关键词> [--groups g1,g2] [--all-groups] [--max-groups N] [--limit N]
+             [--app-id <id>] [--size 100] [--pages N] [--concurrency 10] [--no-escalate] [--loose] [--source-type LOGIC]
+             # 跨分组找表：**进程内并发**扇出（一次凭据），产物=候选表清单 + 路由建议，**不取数**
+             #   默认扫描集 = 核心 3 组（业务表单/e-builder表单/流程）+ 语义命中组，≤ --max-groups
+             #   默认集合全 miss 时自动升级为全分组扫一次（--no-escalate 可关；窗口 >2000 行时不自动升级）
+             #   --all-groups = 直接扫全部内置分组（进程内并发，实测 ~5.5s）
+             #   --app-id：EB 分组（weaver-ebuilder-form-service）按应用分域，需限定应用时带上
+             #   ⚠️ 端点 /api/dw/newetl/chatBi/ds/listByPage **当前忽略 name**（后端待升级）⇒ 本次是
+             #      「抓 --pages 页 × --size 行 + 本地按表名过滤」：**未命中 ≠ 该表不存在**，
+             #      分组行数大时请调大 --size（≤2000）/--pages（≤50）。后端支持 name 后自动精确、无需改调用
+             #   输出按「实体」归并去重（同一流程会在多个报表/效率分组重复出现）
+  ds describe --group <gid> --table <tid> [--app-id <id>] [--skill <skillKey，默认 data-source-query>]
+             [--require] [--source-type LOGIC]
+             # 一次**并发**取回两件套：字段 + 词库（两者入参同为 (groupId, tableId)，互不依赖）
+             #   ⚠️ **不做权限校验**：EB 分组取数前仍必须单独执行 eb perm-page（appId 只从那次调用取）
+             #   --require：任一路失败即报错退出
+  ds tables  --group <gid> [--name 关键词] [--app-id <id>]
+  ds fields  --group <gid> --table <tid> [--app-id <id>]
+  ds fields-dsl  --group <gid> --table <tid> [--app-id <id>]   # 同 fields，接口 /api/dw/newetl/chatBi/ds/fieldsForDSL
+  ds list    --group <gid> --table <tid> --fields a,b [--where @f|json] [--order "f asc"] [--page N] [--size N] [--app-id <id>]
+  ds chart   --group <gid> --table <tid> --group-by g1,g2 --stat @f.json [--where ...] [--app-id <id>]
+  ds stat    --group <gid> --table <tid> --stat @f.json [--where ...] [--app-id <id>]
+  ds count   --group <gid> --table <tid> [--where ...] [--app-id <id>]
+  （ds 通用 --source-type LOGIC|ETEAMS，默认 LOGIC）
+  （ds 取数的 appId：一律**显式传入** --app-id <id>（v0.1.14 起 CLI 不再自动反查）。
+     EB 建模表单（groupId=weaver-ebuilder-form-service）必须带：该值取自 chat_bi_eb_config_map 的权限校验查询
+     ——调用方先查权限（无权限即终止、不取数），同一条记录的 app_id 即本次必带的 appId；
+     其他数据集可不传，CLI 不拦截、以接口报错为准；--app-id auto / --no-app-id 已废弃，等同不传）
+  --where 过滤条件（v0.1.8 起支持树形 OR，递归）：
+    数组 = AND 根： [{"fieldId":"f1","conditionType":"Date","compareType":"range","conditionValue":"2026-09~2026-10"},{"fieldId":"f2",...}]
+    对象 = 完整树： {"relationship":"0","conditionList":[{"fieldId":"f1",...},{"fieldId":"f2",...}]}   # "0"=OR、"1"=AND，缺省 AND
+    数组元素可内嵌条件组 {"relationship":"0","conditionList":[...]} 实现 (A AND B) OR (C AND D)
+    叶子键 fieldId/conditionId 均可（fieldId 优先）；缺少字段的叶子会直接报错（不再静默当全表）
+doc     文档查询
+  doc count  [--name 关键词] [--creator id1,id2] [--author id1,id2] [--content-type office] [--time "起~止"] [--last-time "起~止"] [--folder id,id|--folder-neq id,id]
+  doc list   [同上条件] [--all 翻页到底] [--page N] [--size 100]
+noun    词库查询
+  noun list --skill <skillKey> [--source-type LOGIC] [--source-group gid] [--source-table tid]（数据源场景带三参数）
+field   关联字段翻译
+  field id2name  --module <m> --type <t> --ids id1,id2 [--form-param '{"fieldId":"..","module":"ebuilderform"}'|--eb-browser-param '{..}'|--property-type x]
+  field name2id  --module <m> --type <t> --name 名称 [同上附加参数]
+conf    环境参数配置中心（chatBi config map，替代 config-resolve 脚本 URL 直连；confType 默认由 CONN_/DS_/WF_/API_ 前缀推导，可 --type 显式）
+        confGroup（配置分组，v0.1.9 新增，可选）：confType=api 时后端支持二级分层（如 api/workflow），
+        定位维度 = confType+confGroup+confKey；仅 confType=api（或显式传 --group）时才下发 confGroup，其他类型不带该字段
+  conf get <key> [--type t] [--group g]           # 单查（confValue/confAttrs/confName 全量 JSON）
+  conf batch <key1> [key2 ...] [--type t] [--group g]   # 批量查（批量接口异常自动降级逐条单查）
+  conf batch-file @items.json                     # 按 [{confType,confGroup,confKey}..] 显式批量查（支持任意 confType）
+  conf group <confType> <confGroup> [--key k]     # 按类型+分组批量查（batchGetChatBiConfigMapByTypeAndGroup）
+  conf group-file @items.json                     # 按 [{"confType":"api","confGroup":"workflow"}..] 多分组批量查
+  conf resolve '<含#{KEY}文本>'|@file.txt [--group g]   # 文本占位符替换为真实值（含中文建议 @file）
+  conf resolve-file <文件路径> [--group g]          # 读文件替换全部占位符并打印（不改写原文件）
+  conf add <key> --value <真实值> [--name 说明] [--attrs '{"request":..,"response":..}'] [--type t] [--group g] [--force]  # 新增（默认判重，已存在跳过）
+  conf add-file @items.json                       # JSON 数组批量新增（逐条判重，元素可带 confGroup）
+  conf update <key> [--value v] [--name n] [--attrs a] [--type t] [--group g]   # 更新（confType+confGroup+confKey 定位，传哪个字段更哪个）
+  conf delete <key> [--type t] [--group g]        # 删除
+  示例: conf group api workflow | conf add GET_WORKFLOW_LIST --type api --group workflow --value /api/workflow/getList --name 查询流程列表
+exp     专家包版本管理（expert-repository/v1，响应以 data.actionMsg.code=0 判成功）
+  exp status    --expert <code> [--branch main]                       # 仓库状态（headCommitId/headRevision=提交基线）
+  exp manifest  --expert <code> [--commit <id>]                       # 文件清单（sha256）
+  exp commits   --expert <code>                                       # 提交历史
+  exp file      --expert <code> --commit <id> --path <相对路径> [--out 本地文件]
+  exp pull      --expert <code> --dir <本地专家包目录> [--dry-run] [--force]   # 智能拉取：基线三方对比（仅远端改→覆盖/仅本地改→保留/双方都改→备份后覆盖；--force 一律覆盖），成功后更新 .sync-state.json 基线
+  exp init      --expert <code> --dir <本地目录> [--display-name X] [--message 初始化导入]
+  exp commit    --expert <code> --dir <本地目录> --message "..." [--mode FULL_SNAPSHOT|FILE_PATCH]
+  exp lock      --expert <code> --action query|acquire(默认)|heartbeat|release --component ROOT --ttl 30 --lock-token <token>
+  exp release   --expert <code> --commit <id> --version vX.Y.Z [--note 说明]
+  exp rollback  --expert <code> --version vX.Y.Z
+attend  考勤 REST 接口（2026-09-07 新增，hr-attendance 病假/事假等假期余额）
+  attend statis [--user <人员ID>] [--begin 2026-09-01] [--end 2026-09-30]   # getAttendInfoStatis 假期余额统计；--user 默认当前登录用户，--begin/--end 默认当月
+eb      EB 建模表单权限校验（chatBi EB 配置映射分页查询，替代 DSL 查 chat_bi_eb_config_map）
+  eb perm-page --obj-id <id> --form-table <物理表名> [--page N] [--size N] [--app-id <id>] [--require]
+      # obj-id / form-table 必填（本地强校验；缺失后端只回空、不报错）
+      # obj-id / app-id 必须字符串传参（19 位大整数，Number 舍入 → 静默 total=0）
+      # total>=1 = 有权限，并回带该行 appId；--require 时 total=0 直接报错退出
+认证: 加解密由 e10-login 负责（本 CLI 不参与）；凭据出口 = e10-login auth/whoami（自动同步镜像）；皆无请先 e10-login oidc
+      （无浏览器/无 python 环境：login xiaoe-env 用环境变量 token 直接登录）`);
+}
+
+async function main() {
+  const rawArgv = process.argv.slice(2);
+  // 仅当顶层显式 -v/--version（无子命令）时打印版本；exp release/rollback 的 --version 是版本号参数、conf 文本可能含 version 字样，一律放行
+  if (rawArgv.length === 1 && (rawArgv[0] === "--version" || rawArgv[0] === "-v")) {
+    console.log("e10-data " + cliVersion());
+    process.exit(0);
+  }
+  const { args, pos } = parseArgs(rawArgv);
+  if (!pos.length) { usage(); process.exit(1); }
+  const family = pos[0], sub = pos[1], json = !!args.json;
+  let result;
+  if (family === "ds") {
+    if (!sub) { usage(); process.exit(1); }
+    switch (sub) {
+      case "groups": result = await cmdDsGroups(args, json); break;
+      case "find": result = await cmdDsFind(args, json); break;
+      case "describe": result = await cmdDsDescribe(args, json); break;
+      case "tables": result = await cmdTables(args, json); break;
+      case "fields": result = await cmdFields(args, json); break;
+      case "fields-dsl": result = await cmdFieldsForDSL(args, json); break;
+      case "list": result = await cmdList(args, json); break;
+      case "chart": result = await cmdChart(args, json); break;
+      case "stat": result = await cmdStat(args, json); break;
+      case "count": result = await cmdCount(args, json); break;
+      default: usage(); process.exit(1);
+    }
+  } else if (family === "query") {
+    result = await cmdQuery(args, json);
+  } else if (family === "doc") {
+    if (sub === "count") result = await cmdDocCount(args, json);
+    else if (sub === "list") result = await cmdDocList(args, json);
+    else { usage(); process.exit(1); }
+  } else if (family === "noun") {
+    if (sub === "list") result = await cmdNoun(args, json);
+    else { usage(); process.exit(1); }
+  } else if (family === "field") {
+    if (sub === "id2name") result = await cmdFieldId2name(args, json);
+    else if (sub === "name2id") result = await cmdFieldName2id(args, json);
+    else { usage(); process.exit(1); }
+  } else if (family === "conf") {
+    if (!sub) { usage(); process.exit(1); }
+    result = await cmdConf(sub, args, json, pos);
+  } else if (family === "exp") {
+    if (!sub) { usage(); process.exit(1); }
+    switch (sub) {
+      case "status": result = await expStatus(args, json); break;
+      case "manifest": result = await expManifest(args, json); break;
+      case "commits": result = await expCommits(args, json); break;
+      case "file": result = await expFile(args, json); break;
+      case "pull": result = await expPull(args, json); break;
+      case "init": result = await expInit(args, json); break;
+      case "commit": result = await expCommit(args, json); break;
+      case "lock": result = await expLock(args, json); break;
+      case "release": result = await expRelease(args, json); break;
+      case "rollback": result = await expRollback(args, json); break;
+      default: usage(); process.exit(1);
+    }
+  } else if (family === "attend") {
+    if (sub === "statis") result = await cmdAttendStatis(args, json);
+    else { usage(); process.exit(1); }
+  } else if (family === "eb") {
+    if (!sub) { usage(); process.exit(1); }
+    switch (sub) {
+      case "perm-page": result = await cmdEbPermPage(args, json); break;
+      default: usage(); process.exit(1);
+    }
+  } else { usage(); process.exit(1); }
+  if (json && result !== undefined) console.log(JSON.stringify(result, null, 1));
+}
+main().catch((e) => { console.error("ERROR: " + e.message); process.exit(1); });