gaoding-cli 1.0.0-alpha.5

package/dist/src/utils/reference-image.js

@@ -0,0 +1,43 @@
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { assertSafeHttpUrl } from "./url-safety.js";
+export function isRemoteImageReference(value) {
+    return /^https?:\/\//i.test(value.trim());
+}
+export function firstReferenceImage(value) {
+    if (Array.isArray(value)) {
+        return value.map(String).map((item) => item.trim()).find(Boolean);
+    }
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    if (!trimmed)
+        return undefined;
+    return trimmed.split(/[,\n]+/g).map((item) => item.trim()).find(Boolean);
+}
+export function assertReferenceImageAvailable(value, options) {
+    const image = firstReferenceImage(value);
+    if (!image) {
+        throw new Error(referenceImageRequiredMessage(options.context));
+    }
+    if (isRemoteImageReference(image)) {
+        return assertSafeHttpUrl(image, { context: "参考图 URL" });
+    }
+    const filePath = resolve(process.cwd(), image);
+    if (!existsSync(filePath)) {
+        throw new Error([
+            `REFERENCE_IMAGE_REQUIRED: ${options.context} 需要原始参考图，但当前图片路径不存在：${image}`,
+            "请提供本地图片文件路径或可访问的 http(s) 图片 URL。",
+            "不要根据截图描述或识图结果重新生成替代参考图；只有用户明确要求“重新生成一张相似参考图”时才允许这么做。",
+        ].join("\n"));
+    }
+    return image;
+}
+export function referenceImageRequiredMessage(context) {
+    return [
+        `REFERENCE_IMAGE_REQUIRED: ${context} 需要原始参考图。`,
+        "请提供本地图片文件路径或可访问的 http(s) 图片 URL。",
+        "如果图片来自 Codex 对话附件，请先确认附件已落到工作区可读路径，再把该路径传给 --image。",
+        "不要通过解析附件内容后重新生成替代商品图。",
+    ].join("\n");
+}

package/dist/src/utils/resolve-app-local-images.d.ts

@@ -0,0 +1,8 @@
+import type { ToolInvoker } from "../api/tool-invoker.js";
+/**
+ * App 编排侧工具需要可访问 URL；本地路径在网关会变成 file: 导致 Dify 失败。
+ * 在 `gd-cli workflows run` 提交前对常见图片字段做上传替换，并写入 `image_url` 供 chat/cutout 等读取。
+ */
+export declare function resolveAppLocalMediaToUrls(params: Record<string, unknown>, invoker: ToolInvoker, options?: {
+    allowSensitivePath?: boolean;
+}): Promise<Record<string, unknown>>;

package/dist/src/utils/resolve-app-local-images.js

@@ -0,0 +1,84 @@
+import { existsSync, statSync } from "node:fs";
+import { basename, resolve } from "node:path";
+import { assertSafeUploadPath } from "./sensitive-path.js";
+import { assertSafeHttpUrl } from "./url-safety.js";
+const MAX_BYTES = 25 * 1024 * 1024;
+function isHttpUrl(s) {
+    return /^https?:\/\//i.test(s.trim());
+}
+function extractUrlFromOutputs(outputs) {
+    if (outputs && typeof outputs === "object") {
+        const o = outputs;
+        const u = o.url ?? o.uri;
+        if (typeof u === "string" && isHttpUrl(u)) {
+            return assertSafeHttpUrl(u.trim(), { context: "上传响应 URL" });
+        }
+    }
+    const raw = JSON.stringify(outputs ?? "");
+    const m = raw.match(/https?:\/\/[^"'\s\\]+/);
+    if (m)
+        return assertSafeHttpUrl(m[0], { context: "上传响应 URL" });
+    throw new Error("上传响应中未找到可用的 http(s) URL");
+}
+async function uploadLocalFile(invoker, absolutePath, allowSensitivePath) {
+    const safePath = assertSafeUploadPath(absolutePath, {
+        allowSensitivePath,
+        context: "App 图片",
+    });
+    const fileStat = statSync(safePath);
+    if (fileStat.size > MAX_BYTES) {
+        throw new Error(`文件过大（>${MAX_BYTES} 字节）: ${absolutePath}`);
+    }
+    const result = await invoker.invoke("upload", {
+        file: safePath,
+        file_name: basename(safePath),
+        allow_sensitive_path: allowSensitivePath,
+    }, { timeout: 120 });
+    if (result.status !== "completed") {
+        throw new Error(`上传失败: ${result.status} ${JSON.stringify(result.error ?? result)}`);
+    }
+    return extractUrlFromOutputs(result.outputs);
+}
+/**
+ * 若值为本机可读文件路径，则先 `upload` 再替换为 CDN URL。
+ * 已是 http(s) 则原样保留。
+ */
+async function resolveMaybeLocalPath(invoker, raw, allowSensitivePath) {
+    const t = raw.trim();
+    if (!t)
+        return t;
+    if (isHttpUrl(t))
+        return assertSafeHttpUrl(t, { context: "App 图片 URL" });
+    const p = resolve(process.cwd(), t);
+    if (!existsSync(p) || !statSync(p).isFile()) {
+        return raw;
+    }
+    return uploadLocalFile(invoker, p, allowSensitivePath);
+}
+/**
+ * App 编排侧工具需要可访问 URL；本地路径在网关会变成 file: 导致 Dify 失败。
+ * 在 `gd-cli workflows run` 提交前对常见图片字段做上传替换，并写入 `image_url` 供 chat/cutout 等读取。
+ */
+export async function resolveAppLocalMediaToUrls(params, invoker, options = {}) {
+    const out = { ...params };
+    const allowSensitivePath = options.allowSensitivePath === true;
+    const singleKeys = ["image", "product_image", "cover_image"];
+    for (const key of singleKeys) {
+        const v = out[key];
+        if (typeof v !== "string" || !v.trim())
+            continue;
+        out[key] = await resolveMaybeLocalPath(invoker, v, allowSensitivePath);
+    }
+    const primary = out.image ?? out.product_image ?? out.cover_image;
+    if (typeof primary === "string" && isHttpUrl(primary)) {
+        out.image_url = primary.trim();
+    }
+    if (typeof out.images === "string" && out.images.trim()) {
+        const parts = out.images
+            .split(",")
+            .map((s) => s.trim())
+            .filter(Boolean);
+        out.images = (await Promise.all(parts.map((p) => resolveMaybeLocalPath(invoker, p, allowSensitivePath)))).join(",");
+    }
+    return out;
+}

package/dist/src/utils/sensitive-path.d.ts

@@ -0,0 +1,6 @@
+export interface SensitivePathOptions {
+    allowSensitivePath?: boolean;
+    context?: string;
+}
+export declare function assertSafeUploadPath(file: string, options?: SensitivePathOptions): string;
+export declare function sensitivePathReason(file: string): string | null;

package/dist/src/utils/sensitive-path.js

@@ -0,0 +1,69 @@
+import os from "node:os";
+import path from "node:path";
+const SENSITIVE_SEGMENTS = new Set([
+    ".aws",
+    ".azure",
+    ".config",
+    ".docker",
+    ".gd",
+    ".gd-cli-dev",
+    ".git",
+    ".gnupg",
+    ".kube",
+    ".npm",
+    ".ssh",
+]);
+const SENSITIVE_FILENAMES = new Set([
+    ".env",
+    ".env.local",
+    ".git-credentials",
+    ".gitconfig",
+    ".npmrc",
+    ".netrc",
+    ".pypirc",
+    "credentials.json",
+    "credential.json",
+    "id_ed25519",
+    "id_rsa",
+    "known_hosts",
+]);
+export function assertSafeUploadPath(file, options = {}) {
+    const absolutePath = path.resolve(process.cwd(), file);
+    if (allowSensitive(options))
+        return absolutePath;
+    const reason = sensitivePathReason(absolutePath);
+    if (reason) {
+        const context = options.context ?? "本地文件";
+        throw new Error(`${context} 位于受保护路径，默认不上传：${absolutePath}（${reason}）。确认需要上传时请显式传 --allow-sensitive-path。`);
+    }
+    return absolutePath;
+}
+export function sensitivePathReason(file) {
+    const absolutePath = path.resolve(process.cwd(), file);
+    const segments = absolutePath.split(path.sep).filter(Boolean);
+    const lowerSegments = segments.map((segment) => segment.toLowerCase());
+    const filename = lowerSegments[lowerSegments.length - 1] ?? "";
+    if (SENSITIVE_FILENAMES.has(filename) || /^\.env(\.|$)/.test(filename)) {
+        return `敏感文件名 ${filename}`;
+    }
+    const hiddenSegment = lowerSegments.find((segment) => segment.startsWith("."));
+    if (hiddenSegment) {
+        return `隐藏路径片段 ${hiddenSegment}`;
+    }
+    const sensitiveSegment = lowerSegments.find((segment) => SENSITIVE_SEGMENTS.has(segment));
+    if (sensitiveSegment) {
+        return `敏感目录 ${sensitiveSegment}`;
+    }
+    const home = os.homedir();
+    const relativeToHome = path.relative(home, absolutePath);
+    if (relativeToHome && !relativeToHome.startsWith("..") && !path.isAbsolute(relativeToHome)) {
+        const firstHomeSegment = relativeToHome.split(path.sep)[0]?.toLowerCase();
+        if (firstHomeSegment && SENSITIVE_SEGMENTS.has(firstHomeSegment)) {
+            return `家目录敏感路径 ${firstHomeSegment}`;
+        }
+    }
+    return null;
+}
+function allowSensitive(options) {
+    return options.allowSensitivePath === true || process.env.GD_CLI_ALLOW_SENSITIVE_PATHS === "1";
+}

package/dist/src/utils/settings-store.d.ts

@@ -0,0 +1,42 @@
+export { SETTINGS_FILE } from "./gd-home.js";
+export type GdEnvName = "prod" | "fat" | "stage" | "local";
+export interface GdSettingsOverrides {
+    hub_api_base?: string;
+    sso_api_base?: string;
+    auth_page_origin?: string;
+    web_origin?: string;
+    channel_id?: string;
+    business_id?: string;
+}
+/** 持久化偏好（环境变量仍优先于本文件） */
+export interface GdSettings {
+    /** Active environment. Only prod has built-in endpoints. */
+    active_env?: GdEnvName;
+    /** 图像/视频模型偏好；auto 表示使用平台返回的默认顺序 */
+    models?: {
+        image?: string;
+        video?: string;
+    };
+    /** 平台模型顺序缓存；由 CLI 内部每日最多刷新一次，Agent 不需要显式查询模型 */
+    model_cache?: {
+        image?: ModelCacheEntry;
+        video?: ModelCacheEntry;
+    };
+    /** 单项覆盖，不改变 active_env */
+    overrides?: GdSettingsOverrides;
+    /** @deprecated 请用 active_env=local */
+    use_local_server?: boolean;
+    /** @deprecated 请用 overrides.hub_api_base */
+    api_base?: string;
+}
+export interface ModelCacheEntry {
+    date: string;
+    codes: string[];
+    source: "remote" | "fallback";
+    fetched_at: string;
+}
+export declare function readSettings(): GdSettings;
+export declare function writeSettings(next: GdSettings): void;
+export declare function patchSettings(patch: Partial<GdSettings>): GdSettings;
+/** 清除端点相关字段，恢复为默认 prod（在无环境变量覆盖时） */
+export declare function clearEndpointSettings(): void;

package/dist/src/utils/settings-store.js

@@ -0,0 +1,50 @@
+import fs from "node:fs";
+import { ensureCredentialDir, ensureCredentialFile } from "./credential-permissions.js";
+import { GD_DIR, SETTINGS_FILE } from "./gd-home.js";
+export { SETTINGS_FILE } from "./gd-home.js";
+export function readSettings() {
+    try {
+        if (!fs.existsSync(SETTINGS_FILE))
+            return {};
+        ensureCredentialDir(GD_DIR);
+        ensureCredentialFile(SETTINGS_FILE);
+        const raw = fs.readFileSync(SETTINGS_FILE, "utf-8");
+        const data = JSON.parse(raw);
+        if (!data || typeof data !== "object")
+            return {};
+        return data;
+    }
+    catch {
+        return {};
+    }
+}
+export function writeSettings(next) {
+    ensureCredentialDir(GD_DIR);
+    fs.writeFileSync(SETTINGS_FILE, `${JSON.stringify(next, null, 2)}\n`, {
+        encoding: "utf-8",
+        mode: 0o600,
+    });
+    ensureCredentialFile(SETTINGS_FILE);
+}
+export function patchSettings(patch) {
+    const cur = readSettings();
+    const merged = { ...cur, ...patch };
+    writeSettings(merged);
+    return merged;
+}
+/** 清除端点相关字段，恢复为默认 prod（在无环境变量覆盖时） */
+export function clearEndpointSettings() {
+    const cur = readSettings();
+    delete cur.use_local_server;
+    delete cur.api_base;
+    delete cur.active_env;
+    delete cur.overrides;
+    delete cur.direct_auth;
+    const keys = Object.keys(cur);
+    if (keys.length === 0) {
+        if (fs.existsSync(SETTINGS_FILE))
+            fs.unlinkSync(SETTINGS_FILE);
+        return;
+    }
+    writeSettings(cur);
+}

package/dist/src/utils/sleep.d.ts

@@ -0,0 +1 @@
+export declare function sleep(ms: number): Promise<void>;

package/dist/src/utils/sleep.js

@@ -0,0 +1,3 @@
+export function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/src/utils/spinner.d.ts

@@ -0,0 +1,2 @@
+import { type Ora } from "ora";
+export declare function createSpinner(text: string): Ora;

package/dist/src/utils/spinner.js

@@ -0,0 +1,4 @@
+import ora from "ora";
+export function createSpinner(text) {
+    return ora({ text, stream: process.stderr });
+}

package/dist/src/utils/static-help.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from "commander";
+export declare function setStaticHelp(command: Command, text: string): void;

package/dist/src/utils/static-help.js

@@ -0,0 +1,3 @@
+export function setStaticHelp(command, text) {
+    command.helpInformation = () => `${text.trimEnd()}\n`;
+}

package/dist/src/utils/tool-display.d.ts

@@ -0,0 +1,10 @@
+import type { ToolSpec } from "../registry/types.js";
+/**
+ * 对用户可见的工具名称（中文说明），用于 spinner / 结果区，避免只显示 generate 等内部 id。
+ */
+export declare function toolActivityLabel(toolId: string, spec?: Pick<ToolSpec, "display_name"> | null): string;
+export declare function appActivityLabel(appId: string, displayName?: string | null): string;
+/** 从 Registry 解析工具展示名（失败时用本地兜底） */
+export declare function resolveToolActivityLabel(toolId: string, _client?: unknown): Promise<string>;
+/** 从 Registry 解析应用展示名 */
+export declare function resolveAppActivityLabel(appId: string, _client?: unknown): Promise<string>;

package/dist/src/utils/tool-display.js

@@ -0,0 +1,55 @@
+import { resolveAppSpec, resolveToolSpec } from "../registry/direct-registry.js";
+/** 无 Registry 时的兜底（与 Server 种子 display_name 对齐） */
+const TOOL_DISPLAY_FALLBACK = {
+    generate: "AI 生图",
+    cutout: "智能抠图",
+    edit: "AI 编辑",
+    expand: "AI 扩图",
+    erase: "AI 消除",
+    upscale: "高清放大",
+    vectorize: "转矢量图",
+    chat: "AI 对话",
+    upload: "上传素材",
+    prompt: "提示词优化",
+    title: "智能标题",
+    video: "AI 视频",
+    "video-hd": "视频超清",
+};
+/**
+ * 对用户可见的工具名称（中文说明），用于 spinner / 结果区，避免只显示 generate 等内部 id。
+ */
+export function toolActivityLabel(toolId, spec) {
+    const fromSpec = spec?.display_name?.trim();
+    if (fromSpec)
+        return fromSpec;
+    const fb = TOOL_DISPLAY_FALLBACK[toolId];
+    if (fb)
+        return fb;
+    return `工具「${toolId}」`;
+}
+/** App 对用户展示的名称（与 registry / 种子对齐） */
+const APP_DISPLAY_FALLBACK = {
+    "listing-gallery": "商品图库",
+    "pdp-a-plus": "详情页模块",
+    "social-seeding-pack": "小红书种草",
+    "campaign-kv-pack": "Campaign KV",
+};
+export function appActivityLabel(appId, displayName) {
+    const d = displayName?.trim();
+    if (d)
+        return d;
+    const fb = APP_DISPLAY_FALLBACK[appId];
+    if (fb)
+        return fb;
+    return `应用「${appId}」`;
+}
+/** 从 Registry 解析工具展示名（失败时用本地兜底） */
+export async function resolveToolActivityLabel(toolId, _client) {
+    const spec = resolveToolSpec(toolId);
+    return toolActivityLabel(toolId, spec ?? undefined);
+}
+/** 从 Registry 解析应用展示名 */
+export async function resolveAppActivityLabel(appId, _client) {
+    const app = resolveAppSpec(appId);
+    return appActivityLabel(appId, app?.name);
+}

package/dist/src/utils/transient-network-error.d.ts

@@ -0,0 +1,4 @@
+/**
+ * 判断是否为可重试的瞬时网络错误（对端重置、拒绝连接、超时等）。
+ */
+export declare function isTransientNetworkError(err: unknown): boolean;

package/dist/src/utils/transient-network-error.js

@@ -0,0 +1,40 @@
+/**
+ * 判断是否为可重试的瞬时网络错误（对端重置、拒绝连接、超时等）。
+ */
+export function isTransientNetworkError(err) {
+    const codes = new Set();
+    const walk = (e) => {
+        if (!e || typeof e !== "object")
+            return;
+        const x = e;
+        if (typeof x.code === "string")
+            codes.add(x.code);
+        if (x.cause)
+            walk(x.cause);
+        if (typeof AggregateError !== "undefined" && e instanceof AggregateError) {
+            for (const sub of e.errors)
+                walk(sub);
+        }
+    };
+    walk(err);
+    const transient = new Set([
+        "ECONNRESET",
+        "ECONNREFUSED",
+        "ETIMEDOUT",
+        "EPIPE",
+        "ENOTFOUND",
+        "EAI_AGAIN",
+        "UND_ERR_SOCKET",
+        "UND_ERR_CONNECT_TIMEOUT",
+    ]);
+    for (const c of codes) {
+        if (transient.has(c))
+            return true;
+    }
+    const msg = err instanceof Error ? err.message : String(err);
+    if (/ECONNRESET|ECONNREFUSED|ETIMEDOUT|fetch failed|socket|HTTP status code 503|grpc-status=14|UNAVAILABLE|Service Unavailable/i
+        .test(msg)) {
+        return true;
+    }
+    return false;
+}

package/dist/src/utils/url-safety.d.ts

@@ -0,0 +1,6 @@
+export interface SafeUrlOptions {
+    context?: string;
+    allowPrivate?: boolean;
+}
+export declare function assertSafeHttpUrl(raw: string, options?: SafeUrlOptions): string;
+export declare function isBlockedHost(hostname: string): boolean;

package/dist/src/utils/url-safety.js

@@ -0,0 +1,67 @@
+import net from "node:net";
+const METADATA_IPV4 = "169.254.169.254";
+export function assertSafeHttpUrl(raw, options = {}) {
+    const context = options.context ?? "URL";
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    }
+    catch {
+        throw new Error(`${context} 必须是合法 URL`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error(`${context} 仅支持 http/https URL`);
+    }
+    if (parsed.username || parsed.password) {
+        throw new Error(`${context} 不能包含用户名或密码`);
+    }
+    if (!allowPrivate(options) && isBlockedHost(parsed.hostname)) {
+        throw new Error(`${context} 不能指向 localhost、内网、link-local 或云元数据地址`);
+    }
+    return parsed.toString();
+}
+export function isBlockedHost(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
+    if (host === "localhost" ||
+        host.endsWith(".localhost") ||
+        host.endsWith(".local") ||
+        host === "metadata" ||
+        host === "metadata.google.internal") {
+        return true;
+    }
+    if (host === METADATA_IPV4)
+        return true;
+    const ipType = net.isIP(host);
+    if (ipType === 4)
+        return isPrivateIpv4(host);
+    if (ipType === 6)
+        return isPrivateIpv6(host);
+    return false;
+}
+function allowPrivate(options) {
+    return options.allowPrivate === true || process.env.GD_CLI_ALLOW_PRIVATE_URLS === "1";
+}
+function isPrivateIpv4(host) {
+    const parts = host.split(".").map((part) => Number(part));
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return true;
+    }
+    const [a, b] = parts;
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 168));
+}
+function isPrivateIpv6(host) {
+    return (host === "::" ||
+        host === "::1" ||
+        host.startsWith("fc") ||
+        host.startsWith("fd") ||
+        host.startsWith("fe80:") ||
+        host.startsWith("::ffff:127.") ||
+        host.startsWith("::ffff:10.") ||
+        host.startsWith("::ffff:192.168.") ||
+        host.startsWith("::ffff:169.254."));
+}

package/dist/src/utils/write-app-deliverables.d.ts

@@ -0,0 +1,18 @@
+export interface WriteAppDeliverablesOptions {
+    appId: string;
+    taskId: string;
+    outputs: unknown;
+    /** 根目录，其下会建子目录并生成 zip */
+    outputDir: string;
+    /** 人类可读应用名，用于 README */
+    activityLabel?: string;
+}
+export interface WriteAppDeliverablesResult {
+    dir: string;
+    zipPath: string;
+    readmePath: string;
+}
+/**
+ * 将 App 完成后的 outputs 落盘：每步一个 Markdown、图片下载到 images/、打 zip。
+ */
+export declare function writeAppDeliverables(opts: WriteAppDeliverablesOptions): Promise<WriteAppDeliverablesResult>;