gangtise-openapi-cli 0.20.0 → 0.21.0

package/README.md

@@ -4,6 +4,22 @@
 
 ## Changelog
 
+### v0.21.0 — 2026-06-29
+
+**行为变更（注意）**
+- ⚠️ `vault wechat-chatroom-list` 省略 `--size` 现在**拉全量**（此前默认只返回 20 条）。该接口不返回 `total`，CLI 改为串行翻页（翻到不满页为止，单页上限 50）；传 `--size N` 仍只取前 N 条。依赖"默认 20 条"的脚本会拿到全部群。
+
+**修复**
+- `quote day-kline --security all` 等大结果集用默认 `table` 格式输出时不再因 `Math.max(...大数组)` 撑爆调用栈崩溃（`RangeError`）；`renderTable` 改用 reduce 计算列宽
+- CSV 导出：含回车符 `\r` 的字段现在正确加引号（RFC 4180）；`table` / `markdown` 的多行字段折叠换行，保持表格对齐
+- 下载文件名剥离控制字符 / NUL，避免 `fs.writeFile` 报错
+
+**修复（安全）**
+- token 缓存文件（`~/.config/gangtise/token.json`）改为临时文件 + 原子 `rename` 写入：从第一字节即 `0600`，消除"旧文件宽松权限残留"与"崩溃截断"两个隐患
+
+**内部 / 工程**
+- 依赖 `vitest` 升级到 3.2.6（修复 dev-only 安全告警）；新增 `npm run typecheck`；测试 257 → 272
+
 ### v0.20.0 — 2026-06-26
 
 **新增接口**
@@ -64,21 +80,7 @@
 - `--industry` 用 `citicIndustry` 码（`1008001xx`，全命令通用）；`--research-area` 用 `gangtiseIndustry` 码（行业 `1008001xx` + 宏观/策略/固收/金工/海外等方向 `122000xxx`）。详见 `gangtise-openapi/references/commands/reference-and-lookup.md`
 - 日程类 `--location`（domesticCity）服务端过滤已生效（v0.16.0 时曾未生效）
 
-### v0.16.0 — 2026-06-12
-
-**新增接口（参考数据 · 常量查询，均免积分）**
-- `reference constant-category` — 查询常量分类：全量导出常量分类及各分类适用于哪些接口的哪些参数（7 个分类：中信/申万/Gangtise 行业、国内城市、A股/港股公告分类、区域）
-- `reference constant-list --category <code>` — 查询常量值：按分类导出全量常量（`constantId` / `constantName`，树形分类含 `children` 嵌套）
-- `reference concept-search --keyword <kw>` — 查询题材 ID：按名称/拼音/分组名搜索，返回 `conceptId`（供 `alternative concept-info / concept-securities`、`ai theme-tracking` 使用）
-- `reference sector-search --keyword <kw>` — 查询板块 ID：返回 `sectorId` + `hierarchy` 层级路径
-- `reference sector-constituents --sector-id <id>` — 查询板块成分股：返回该板块全量成分股（`gtsCode` / `gtsName`）；注意 sectorId 必须来自 sector-search，题材 conceptId 查不到成分
-
-**接口变更（Breaking）**
-- 移除已被新 API 覆盖的 6 个本地 lookup 子命令及静态数据：`lookup research-area / industry / region / announcement-category / theme-id / industry-code list`，请改用 `reference constant-list` / `reference concept-search` / `reference sector-constituents`（申万行业代码 `821xxx.SWI` 全量：`sector-constituents --sector-id 2000000014`，即申万一级行业指数板块）
-- `lookup` 仅保留 2 个 API 未覆盖的本地表：`broker-org` / `meeting-org`
-- 路演/调研/策略会/论坛 list 新增 `--location <id>` 按城市过滤（domesticCity 常量 ID；服务端过滤 v0.17.0 起已生效）
-
-> 更早版本（v0.15.0 及之前）的完整更新历史见 [GitHub Releases](https://github.com/gangtiser/gangtise-openapi-cli/releases)。
+> 更早版本及完整更新历史见 [CHANGELOG.md](CHANGELOG.md)。
 
 ## 首次安装
 
@@ -131,6 +133,7 @@ export GANGTISE_TIMEOUT_MS=30000       # 请求超时（默认 30s）
 本项目包含 Skill 定义（`gangtise-openapi/SKILL.md`），可让 AI agent 自动调用 `gangtise` CLI 完成投研数据查询。支持以下 AI 编程助手：
 
 - [Claude Code](https://claude.ai/claude-code) — `~/.claude/skills/`
+- [Codex](https://github.com/openai/codex) — `~/.codex/skills/`
 - [OpenClaw](https://github.com/openclaw/openclaw) — `~/.openclaw/skills/`
 - [Hermes](https://github.com/nicepkg/hermes) — `~/.hermes/skills/`
 
@@ -161,6 +164,9 @@ gangtise-openapi/
 # Claude Code
 cp -r gangtise-openapi ~/.claude/skills/gangtise-openapi
 
+# Codex
+cp -r gangtise-openapi ~/.codex/skills/gangtise-openapi
+
 # OpenClaw
 cp -r gangtise-openapi ~/.openclaw/skills/gangtise-openapi
 
@@ -321,6 +327,7 @@ gangtise ai knowledge-batch --query 比亚迪 --query 最近热门概念
 - `vault record-list`
 - `vault my-conference-list`
 - `vault wechat-message-list`
+- `vault wechat-chatroom-list`（特例：接口无 `total`，CLI 串行翻页）
 - `ai hot-topic`
 
 规则：
@@ -330,6 +337,7 @@ gangtise ai knowledge-batch --query 比亚迪 --query 最近热门概念
 - `--from` 必须是非负整数，`--size` 必须是正整数；非法数字会在本地直接报 `ValidationError`，不会继续请求 API
 - 安全上限：自动翻页最多 1000 页，防止异常循环
 - 分页结果中 `total` 字段会被保留（json 格式输出 `{total, list}`），同时 stderr 输出 `Total: N, showing: M`
+- `vault wechat-chatroom-list` 是特例：接口不返回 `total`，CLI 改为串行翻页——省略 `--size` 拉全量、传 `--size N` 取前 N 条，单页 50，无 `Total:` 提示
 
 ## 智能文件命名
 

package/dist/src/cli.js

@@ -471,7 +471,7 @@ addDownloadCommand(vault, { endpointKey: "vault.record.download", name: "record-
 vault.command("my-conference-list").option("--from <number>", "Starting offset", "0").option("--size <number>", "Total rows to return; omit to fetch all").option("--start-time <datetime>").option("--end-time <datetime>").option("--keyword <text>").option("--research-area <id>", "Research area ID", collectList, []).option("--security <code>", "Security code", collectList, []).option("--institution <id>", "Institution ID", collectList, []).option("--category <name>", "Conference category: earningsCall/strategyMeeting/fundRoadshow/shareholdersMeeting/maMeeting/specialMeeting/companyAnalysis/industryAnalysis/other", collectList, []).option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.my-conference.list", { from: parseFrom(options.from), size: parseSize(options.size), startTime: options.startTime, endTime: options.endTime, keyword: options.keyword, researchAreaList: maybeArray(options.researchArea), securityList: maybeArray(options.security), institutionList: maybeArray(options.institution), categoryList: maybeArray(options.category) }), { endpointKey: "vault.my-conference.list", idField: "conferenceId" }));
 addDownloadCommand(vault, { endpointKey: "vault.my-conference.download", name: "my-conference-download", idOption: "--conference-id", idField: "conferenceId", fallbackPrefix: "conference", contentTypeDescription: "Content type: asr/summary", titleListEndpoint: "vault.my-conference.list" });
 vault.command("wechat-message-list").option("--from <number>", "Starting offset", "0").option("--size <number>", "Total rows to return; omit to fetch all").option("--start-time <datetime>").option("--end-time <datetime>").option("--keyword <text>").option("--security <code>", "Security code (e.g. 000001.SZ)", collectList, []).option("--wechat-group-id <id>", "WeChat group ID", collectList, []).option("--industry <id>", "Industry ID", collectList, []).option("--category <name>", "Message type: text/image/documents/url", collectList, []).option("--tag <name>", "Tag: roadShow/research/strategyMeeting/meetingSummary/industryComment/companyComment/earningsReview", collectList, []).option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.wechat-message.list", buildWechatMessageListBody(options))));
-vault.command("wechat-chatroom-list").option("--from <number>", "Starting offset", "0").option("--size <number>", "Rows to return", "20").option("--room-name <name>", "WeChat group name; repeat or comma-separate for multiple names", collectList, []).option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.wechat-chatroom.list", buildWechatChatroomListBody(options))));
+vault.command("wechat-chatroom-list").option("--from <number>", "Starting offset", "0").option("--size <number>", "Total rows to return; omit to fetch all").option("--room-name <name>", "WeChat group name; repeat or comma-separate for multiple names", collectList, []).option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.wechat-chatroom.list", buildWechatChatroomListBody(options))));
 vault.command("stock-pool-list").option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.stock-pool.list", {})));
 vault.command("stock-pool-stocks").option("--pool-id <id>", "Pool ID; repeat for multiple; omit (or 'all') for all pools", collectList).option("--format <format>", "Output format", "table").option("--output <path>").action((options) => emit(options, (client) => client.call("vault.stock-pool.stocks", buildStockPoolStocksBody(options))));
 program.addCommand(vault);

package/dist/src/core/args.js

@@ -42,12 +42,12 @@ export function collectNumberList(value, previous = []) {
 export function collectKeyValue(value, previous = {}) {
     const index = value.indexOf("=");
     if (index === -1) {
-        throw new Error(`Invalid key=value pair: ${value}`);
+        throw new ValidationError(`Invalid key=value pair: ${value}`);
     }
     const key = value.slice(0, index).trim();
     const rawValue = value.slice(index + 1).trim();
     if (!key) {
-        throw new Error(`Invalid key=value pair: ${value}`);
+        throw new ValidationError(`Invalid key=value pair: ${value}`);
     }
     return {
         ...previous,

package/dist/src/core/asyncContent.js

@@ -1,10 +1,9 @@
 import { ApiError } from "./errors.js";
 import { printData } from "./printer.js";
+// 14 attempts with exponential backoff (5s→30s cap) ≈ 316s total wait budget.
 export const POLL_MAX_ATTEMPTS = 14;
 const POLL_INITIAL_DELAY_MS = 5_000;
 const POLL_MAX_DELAY_MS = 30_000;
-/** Total wait time stays close to the previous 12*15s=180s budget. */
-export const POLL_DELAY_MS = POLL_INITIAL_DELAY_MS;
 function nextDelayMs(attempt) {
     // 5s, 8s, 13s, 20s, 30s, 30s, ...
     const grown = POLL_INITIAL_DELAY_MS * 1.6 ** (attempt - 1);

package/dist/src/core/auth.js

@@ -1,3 +1,4 @@
+import { randomUUID } from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { ConfigError } from "./errors.js";
@@ -33,7 +34,20 @@ export function redactTokenCache(cache) {
 }
 export async function writeTokenCache(filePath, cache) {
     await fs.mkdir(path.dirname(filePath), { recursive: true });
-    await fs.writeFile(filePath, JSON.stringify(cache, null, 2), { encoding: "utf8", mode: 0o600 });
+    // Write to a fresh 0600 temp file then rename over the target. Writing the bearer
+    // token straight to token.json would (a) keep an existing file's lax perms — the
+    // `mode` option only applies on creation, so a follow-up chmod still leaves a brief
+    // world-readable window — and (b) risk a truncated file on crash. A temp file is
+    // 0600 from the first byte and rename is atomic, carrying the 0600 perms over.
+    const tmp = `${filePath}.tmp-${randomUUID()}`;
+    await fs.writeFile(tmp, JSON.stringify(cache, null, 2), { encoding: "utf8", mode: 0o600 });
+    try {
+        await fs.rename(tmp, filePath);
+    }
+    catch (error) {
+        await fs.unlink(tmp).catch(() => { });
+        throw error;
+    }
 }
 export function isTokenCacheValid(cache, bufferSeconds = 300) {
     if (!cache?.accessToken || !cache.expiresAt) {

package/dist/src/core/client.js

@@ -244,6 +244,70 @@ export class GangtiseClient {
         }
         return out;
     }
+    /**
+     * Sequential pagination for endpoints that page by offset but return NO `total`
+     * and use a non-standard list key (e.g. wechat chatroom's `chatRoomList`). We
+     * can't fan out like requestPaginated (no total ⇒ unknown page count), so page
+     * serially until a short page (fewer rows than requested) signals the end.
+     * Returns `{ [listKey]: rows }` so normalize/printer treat it like any list.
+     */
+    async requestSequentialPaginated(endpoint, body) {
+        const initialBody = body && typeof body === 'object' ? { ...body } : {};
+        if ('from' in initialBody && (typeof initialBody.from !== 'number' || !Number.isFinite(initialBody.from) || initialBody.from < 0)) {
+            throw new ValidationError('Invalid from: expected a non-negative number');
+        }
+        if ('size' in initialBody && initialBody.size !== undefined && (typeof initialBody.size !== 'number' || !Number.isFinite(initialBody.size) || initialBody.size <= 0)) {
+            throw new ValidationError('Invalid size: expected a positive number');
+        }
+        const listKey = endpoint.pagination?.listKey ?? 'list';
+        const maxPageSize = endpoint.pagination?.maxPageSize ?? 50;
+        const startFrom = typeof initialBody.from === 'number' && Number.isFinite(initialBody.from) ? initialBody.from : 0;
+        const requestedSize = typeof initialBody.size === 'number' && Number.isFinite(initialBody.size) ? initialBody.size : undefined;
+        const extractList = (page) => {
+            if (!page || typeof page !== 'object')
+                return null;
+            const arr = page[listKey];
+            return Array.isArray(arr) ? arr : null;
+        };
+        const collected = [];
+        let firstPage = null;
+        let from = startFrom;
+        const MAX_PAGES = 1000;
+        let truncatedByPageCap = false;
+        for (let page = 0;; page++) {
+            const remaining = requestedSize === undefined ? maxPageSize : requestedSize - collected.length;
+            if (requestedSize !== undefined && remaining <= 0)
+                break;
+            const size = Math.min(maxPageSize, remaining);
+            const pageData = await this.requestJson(endpoint, { ...initialBody, from, size });
+            if (firstPage === null)
+                firstPage = pageData;
+            const list = extractList(pageData);
+            if (list === null) {
+                // First response isn't a paginated-list shape → return it untouched. But a
+                // LATER page losing shape must NOT discard the rows already collected (mirrors
+                // requestPaginated's fail-soft fan-out): stop, keep them, and warn loudly.
+                if (page === 0)
+                    return firstPage;
+                process.stderr.write(`[gangtise] warning: a page response had unexpected shape; results are partial — ${collected.length} rows fetched.\n`);
+                break;
+            }
+            for (const item of list)
+                collected.push(item);
+            if (list.length < size)
+                break; // short page ⇒ no more rows
+            if (page + 1 >= MAX_PAGES) {
+                truncatedByPageCap = true;
+                break;
+            }
+            from += list.length;
+        }
+        if (truncatedByPageCap) {
+            process.stderr.write(`[gangtise] warning: hit the ${MAX_PAGES}-page safety cap; fetched ${collected.length} rows. Pass --size to fetch a bounded subset.\n`);
+        }
+        const rows = requestedSize === undefined ? collected : collected.slice(0, requestedSize);
+        return { [listKey]: rows };
+    }
     async login() {
         const authorization = await this.getAuthorizationHeader();
         const cache = await readTokenCache(this.config.tokenCachePath);
@@ -411,7 +475,9 @@ export class GangtiseClient {
             return this.download(endpoint, query ?? {}, options);
         }
         if (endpoint.kind === 'json' && endpoint.pagination?.enabled) {
-            return this.requestPaginated(endpoint, body);
+            return endpoint.pagination.sequential
+                ? this.requestSequentialPaginated(endpoint, body)
+                : this.requestPaginated(endpoint, body);
         }
         return this.requestJson(endpoint, body);
     }

package/dist/src/core/download.js

@@ -2,11 +2,12 @@ import { extname } from "node:path";
 import { DownloadError } from "./errors.js";
 import { saveOutputIfNeeded } from "./output.js";
 import { lookupTitleCache, readTitleCache, TITLE_LOOKUP_SIZE } from "./titleCache.js";
-/** Replace filesystem-unsafe characters with `_` so a title or a server-supplied
- * filename can't create stray subdirectories or escape the intended output path.
+/** Replace filesystem-unsafe characters (path separators, wildcards, and control
+ * characters / NUL) with `_` so a title or a server-supplied filename can't create
+ * stray subdirectories, escape the intended output path, or break fs.writeFile.
  * Shared by title-based naming and the download fallback. */
 function sanitizeFilename(name) {
-    return name.replace(/[/\\:*?"<>|]/g, "_");
+    return name.replace(/[/\\:*?"<>|\u0000-\u001f]/g, "_");
 }
 const MIME_EXT = {
     "application/pdf": ".pdf",

package/dist/src/core/endpoints.js

@@ -565,6 +565,8 @@ export const ENDPOINTS = {
         path: "/application/open-vault/wechatgroupmsg/chatroomId",
         kind: "json",
         description: "List WeChat group chatroom IDs",
+        // No `total` in the response, list key is `chatRoomList`, server caps size at 50.
+        pagination: { enabled: true, maxPageSize: 50, sequential: true, listKey: "chatRoomList" },
     },
     "vault.stock-pool.list": {
         key: "vault.stock-pool.list",

package/dist/src/core/output.js

@@ -42,14 +42,17 @@ function renderTable(rows) {
         return "(empty)";
     }
     const columns = Array.from(new Set(rows.flatMap((row) => Object.keys(row))));
-    const widths = columns.map((column) => {
-        const cellWidths = rows.map((row) => formatScalar(row[column]).length);
-        return Math.max(column.length, ...cellWidths);
-    });
+    // Format every cell once (formatScalar may JSON.stringify objects), collapsing
+    // newlines so multi-line fields don't break alignment. Reuse the matrix for both
+    // width and rendering — and compute widths with reduce, NOT Math.max(...arr):
+    // spreading a per-row array overflows the call stack on large results (table is
+    // the default format, e.g. `quote day-kline --security all`).
+    const matrix = rows.map((row) => columns.map((column) => formatScalar(row[column]).replace(/[\r\n]+/g, " ")));
+    const widths = columns.map((column, c) => matrix.reduce((max, cells) => Math.max(max, cells[c].length), column.length));
     const renderLine = (values) => values.map((value, index) => value.padEnd(widths[index], " ")).join("  ");
     const header = renderLine(columns);
     const divider = renderLine(widths.map((width) => "-".repeat(width)));
-    const body = rows.map((row) => renderLine(columns.map((column) => formatScalar(row[column]))));
+    const body = matrix.map((cells) => renderLine(cells));
     return [header, divider, ...body].join("\n");
 }
 function renderMarkdown(rows) {
@@ -59,7 +62,7 @@ function renderMarkdown(rows) {
     const columns = Array.from(new Set(rows.flatMap((row) => Object.keys(row))));
     const header = `| ${columns.join(" | ")} |`;
     const divider = `| ${columns.map(() => "---").join(" | ")} |`;
-    const body = rows.map((row) => `| ${columns.map((column) => formatScalar(row[column]).replaceAll("|", "\\|")).join(" | ")} |`);
+    const body = rows.map((row) => `| ${columns.map((column) => formatScalar(row[column]).replace(/[\r\n]+/g, " ").replaceAll("|", "\\|")).join(" | ")} |`);
     return [header, divider, ...body].join("\n");
 }
 function renderCsv(rows) {
@@ -96,7 +99,7 @@ export function renderOutput(value, format) {
 export async function streamOutputToFile(value, format, outputPath) {
     if (format !== "jsonl" && format !== "csv")
         return false;
-    const list = pickListForStreaming(value);
+    const list = pickList(value);
     if (!list)
         return false;
     // Below this row count the join() approach is cheaper than per-row writes.
@@ -129,7 +132,9 @@ export async function streamOutputToFile(value, format, outputPath) {
     }
     return true;
 }
-function pickListForStreaming(value) {
+/** Extract a row array from a value: the array itself, or its `.list` property,
+ * else null. Shared by streaming, printer's title-cache, and list detection. */
+export function pickList(value) {
     if (Array.isArray(value))
         return value;
     if (value && typeof value === "object") {
@@ -146,7 +151,7 @@ function csvEscape(value) {
     // so values like "-3.5" stay numeric for Excel/pandas.
     if (/^[=@\t\r]/.test(out) || (/^[+\-]/.test(out) && !Number.isFinite(Number(out))))
         out = "'" + out;
-    if (/[",\n]/.test(out))
+    if (/[",\n\r]/.test(out))
         return `"${out.replaceAll("\"", "\"\"")}"`;
     return out;
 }
@@ -164,7 +169,7 @@ export async function saveOutputIfNeeded(content, outputPath) {
         return;
     }
     const { dirname } = await import("node:path");
-    await (await import("node:fs/promises")).mkdir(dirname(outputPath), { recursive: true });
+    await fs.mkdir(dirname(outputPath), { recursive: true });
     if (typeof content === "string") {
         await fs.writeFile(outputPath, content, "utf8");
         return;

package/dist/src/core/printer.js

@@ -1,13 +1,9 @@
 import { normalizeRows } from "./normalize.js";
-import { renderOutput, saveOutputIfNeeded, streamOutputToFile } from "./output.js";
+import { pickList, renderOutput, saveOutputIfNeeded, streamOutputToFile } from "./output.js";
 import { extractTitles, writeTitleCache } from "./titleCache.js";
 export async function printData(data, format, output, cache) {
     const normalized = normalizeRows(data);
-    const items = Array.isArray(normalized)
-        ? normalized
-        : (normalized && typeof normalized === "object" && Array.isArray(normalized.list))
-            ? normalized.list
-            : null;
+    const items = pickList(normalized);
     if (cache && items) {
         const titles = extractTitles(items, cache);
         if (Object.keys(titles).length > 0) {

package/dist/src/core/quoteSharding.js

@@ -93,8 +93,11 @@ export async function callKlineWithSharding(client, endpointKey, body, config) {
             header = rec;
         if (!fieldList && Array.isArray(rec.fieldList))
             fieldList = rec.fieldList;
+        // Append one-by-one rather than push(...list): a future higher row cap could
+        // make a single shard's list large enough to overflow the stack via spread.
         if (Array.isArray(rec.list))
-            merged.push(...rec.list);
+            for (const item of rec.list)
+                merged.push(item);
     }
     // Every shard failed → surface the error loudly (non-zero exit) rather than
     // masking a total outage as an empty success.

package/dist/src/version.js

@@ -1,2 +1,2 @@
 // Auto-generated — DO NOT EDIT
-export const CLI_VERSION = "0.20.0";
+export const CLI_VERSION = "0.21.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gangtise-openapi-cli",
-  "version": "0.20.0",
+  "version": "0.21.0",
   "description": "CLI for Gangtise OpenAPI",
   "license": "MIT",
   "repository": {
@@ -26,6 +26,7 @@
     "build": "tsc -p tsconfig.json",
     "dev": "tsx src/cli.ts",
     "test": "vitest run",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
     "prepare": "node scripts/prepare.cjs && npm run build"
   },
   "engines": {
@@ -39,6 +40,6 @@
     "@types/node": "^24.3.0",
     "tsx": "^4.20.5",
     "typescript": "^5.9.2",
-    "vitest": "^3.2.4"
+    "vitest": "^3.2.6"
   }
 }