gaoding-cli 1.0.0-alpha.7 → 1.0.0-alpha.8

package/dist/src/commands/workflows.js

@@ -8,7 +8,7 @@ import { appendAppRunQuickExample } from "../utils/help-verify.js";
 import { writeAppDeliverables } from "../utils/write-app-deliverables.js";
 import { emitJson, wrapEnvelope, shouldEmitEnvelope } from "../core/output/envelope.js";
 import { DIRECT_APPS, resolveAppSpec, } from "../registry/direct-registry.js";
-import { buildWorkflowExamples, buildWorkflowSchema, buildManifest, rowsForManifest, } from "../registry/agent-contracts.js";
+import { buildWorkflowExamples, buildWorkflowSchema, buildWorkflowManifest, rowsForWorkflowManifest, } from "../registry/agent-contracts.js";
 import { applySetEntries, collectArg, readJsonInput } from "../utils/input-json.js";
 import { setStaticHelp } from "../utils/static-help.js";
 import { printCapabilityExamples, printCapabilitySchema, } from "../utils/capability-presenter.js";
@@ -16,6 +16,7 @@ import { capabilityMetadata } from "../utils/capability-metadata.js";
 import { assertReferenceImageAvailable, firstReferenceImage, } from "../utils/reference-image.js";
 import { buildEcommerceInputGuidance } from "../utils/ecommerce-input-guidance.js";
 import { resolveSafeOutputDir } from "../utils/output-path.js";
+import { setAuthRequirement } from "../middleware/auth.js";
 const INTERNAL_OPTS = new Set([
     "outputDir",
     "save",
@@ -26,13 +27,13 @@ const INTERNAL_OPTS = new Set([
     "asset",
 ]);
 export function registerWorkflowsCommand(program) {
-    const apps = program
+    const workflows = program
         .command("workflows")
         .usage("<command> [options]")
         .description("完整创意场景 Workflows")
         .configureHelp({ showGlobalOptions: true });
-    setStaticHelp(apps, WORKFLOWS_HELP);
-    apps
+    setStaticHelp(workflows, WORKFLOWS_HELP);
+    const list = workflows
         .command("list")
         .alias("ls")
         .description("列出内置 Workflows")
@@ -50,7 +51,8 @@ export function registerWorkflowsCommand(program) {
             formatOutput(rowsForAppList(publicItems), format);
         }
     }));
-    apps
+    setAuthRequirement(list, "none");
+    const info = workflows
         .command("info <workflow-id>")
         .description("查看 Workflow 详情")
         .action(withErrorHandler(async (appId, _opts, command) => {
@@ -67,7 +69,8 @@ export function registerWorkflowsCommand(program) {
             formatOutput(payload, format);
         }
     }));
-    apps
+    setAuthRequirement(info, "none");
+    const schema = workflows
         .command("schema <workflow-id>")
         .description("查看 Workflow 输入/输出 JSON Schema")
         .action(withErrorHandler(async (appId, _opts, command) => {
@@ -81,7 +84,8 @@ export function registerWorkflowsCommand(program) {
             printCapabilitySchema(payload);
         }
     }));
-    apps
+    setAuthRequirement(schema, "none");
+    const examples = workflows
         .command("examples <workflow-id>")
         .description("查看 Workflow 调用示例")
         .action(withErrorHandler(async (appId, _opts, command) => {
@@ -95,15 +99,17 @@ export function registerWorkflowsCommand(program) {
             printCapabilityExamples(payload);
         }
     }));
-    apps
+    setAuthRequirement(examples, "none");
+    const manifest = workflows
         .command("manifest")
         .description("输出 Workflows 机器可读能力清单")
         .action((_opts, command) => {
-        const manifest = buildManifest("workflows");
+        const manifest = buildWorkflowManifest();
         const format = resolveListOutputFormat(command);
-        formatOutput(format === "json" ? manifest : rowsForManifest(manifest), format);
+        formatOutput(format === "json" ? manifest : rowsForWorkflowManifest(manifest), format);
     });
-    const callCmd = apps
+    setAuthRequirement(manifest, "none");
+    const callCmd = workflows
         .command("run <workflow-id> [input]")
         .usage("<workflow-id> [input] [options]")
         .description("运行 Workflow（场景编排）")
@@ -135,6 +141,7 @@ export function registerWorkflowsCommand(program) {
     callCmd.action(withErrorHandler(async (appId, input, options, command) => {
         await runAppCall(appId, input, options, command);
     }));
+    setAuthRequirement(callCmd, (command) => command.opts().dryRun === true ? "none" : "current-org");
     appendAppRunQuickExample(callCmd, "gd-cli workflows run");
     callCmd.addHelpText("afterAll", WORKFLOW_RUN_HELP);
 }
@@ -358,7 +365,18 @@ function applyAssetEntries(target, entries) {
 }
 function toPublicAppPayload(app) {
     return {
-        ...app,
+        id: app.id,
+        aliases: app.aliases ?? [],
+        name: app.name,
+        description: app.description,
+        category: app.category,
+        estimated_duration: app.estimated_duration,
+        input: app.input,
+        output: app.output,
+        outputs: app.outputs ?? [],
+        examples: app.examples ?? [],
+        supports_batch: app.supports_batch ?? false,
+        consumes_quota: app.consumes_quota ?? false,
         ...capabilityMetadata("app", app.id),
         canonical_command: `gd-cli workflows run ${app.id}`,
         schema_command: `gd-cli workflows schema ${app.id} --format json`,
@@ -369,7 +387,7 @@ const WORKFLOWS_HELP = `
 gd-cli workflows <command> [options]
 
 用于运行完整业务场景，例如商品图库素材包、详情页/A+模块素材包、小红书种草图文包。
-一个 Workflow 通常会编排多个 Tools，并输出一组可交付物料。
+一个 Workflow 通常会编排多个内部能力，并输出一组可交付物料。
 
 常用命令:
   list/ls                   列出内置 Workflows

package/dist/src/core/auth/auth-guard.d.ts

@@ -0,0 +1,21 @@
+import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
+import type { CredentialsV2, OrgBinding } from "./types.js";
+export type AuthRequirement = "none" | "credential" | "current-org";
+export interface AuthGuardOptions {
+    store?: CredentialStoreV2;
+    now?: () => Date;
+    refreshCurrentOrg?: (organization: OrgBinding) => Promise<void>;
+    onRefreshWarning?: (error: unknown) => void;
+}
+export interface AuthGuardLike {
+    ensure(requirement: AuthRequirement): Promise<CredentialsV2 | null>;
+}
+export declare class AuthGuard {
+    private readonly store;
+    private readonly now;
+    private readonly refreshCurrentOrg;
+    private readonly onRefreshWarning;
+    constructor(options?: AuthGuardOptions);
+    ensure(requirement: AuthRequirement): Promise<CredentialsV2 | null>;
+    private clearCurrentOrganization;
+}

package/dist/src/core/auth/auth-guard.js

@@ -0,0 +1,121 @@
+import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
+import { isVerbose } from "../../utils/config.js";
+import { redactSensitiveText } from "../../utils/redact.js";
+import { CliUsageError } from "../output/cli-error.js";
+export class AuthGuard {
+    store;
+    now;
+    refreshCurrentOrg;
+    onRefreshWarning;
+    constructor(options = {}) {
+        this.store = options.store ?? new CredentialStoreV2();
+        this.now = options.now ?? (() => new Date());
+        this.refreshCurrentOrg = options.refreshCurrentOrg ?? (async (organization) => {
+            const { OrgManager } = await import("./org-manager.js");
+            await new OrgManager(this.store).refreshCurrentOrgBinding(organization);
+        });
+        this.onRefreshWarning = options.onRefreshWarning ?? warnRefreshFailure;
+    }
+    async ensure(requirement) {
+        if (requirement === "none")
+            return null;
+        const credentials = this.store.read();
+        if (!credentials) {
+            throw new CliUsageError({
+                code: "AUTH_MISSING",
+                type: "auth",
+                message: "未找到 AK/SK 凭证，请先登录。",
+                hint: "请先登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (isExpired(credentials.expires_at, this.now())) {
+            throw new CliUsageError({
+                code: "AUTH_EXPIRED",
+                type: "auth",
+                message: "AK/SK 凭证已过期，请重新登录。",
+                hint: "请重新登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (requirement === "current-org" && !credentials.current_org?.id) {
+            throw new CliUsageError({
+                code: "ORG_REQUIRED",
+                type: "auth",
+                message: "当前未选择组织。",
+                hint: "请先选择组织：gd-cli org switch",
+                retryable: false,
+                next_steps: ["gd-cli org list", "gd-cli org switch"],
+            });
+        }
+        if (requirement === "current-org" &&
+            credentials.current_org &&
+            isRefreshDue(credentials.current_org.bind_expires_at, this.now())) {
+            try {
+                await refreshOnce(`${credentials.ak}:${credentials.current_org.id}`, () => this.refreshCurrentOrg(credentials.current_org));
+                return this.store.read();
+            }
+            catch (error) {
+                if (isOrgInvalid(error)) {
+                    const organization = {
+                        id: credentials.current_org.id,
+                        name: credentials.current_org.name,
+                    };
+                    this.clearCurrentOrganization(credentials.current_org.id);
+                    throw new CliUsageError({
+                        code: "ORG_INVALID",
+                        type: "auth",
+                        message: `当前组织 ${organization.name} (${organization.id}) 不可用或已无访问权限。`,
+                        hint: "请重新选择组织：gd-cli org switch",
+                        retryable: false,
+                        next_steps: ["gd-cli org list", "gd-cli org switch"],
+                        detail: { organization },
+                    });
+                }
+                this.onRefreshWarning(error);
+            }
+        }
+        return credentials;
+    }
+    clearCurrentOrganization(expectedOrgId) {
+        const latest = this.store.read();
+        if (!latest || latest.current_org?.id !== expectedOrgId)
+            return;
+        delete latest.current_org;
+        this.store.write(latest);
+    }
+}
+const REFRESH_WINDOW_MS = 5 * 60 * 1000;
+const pendingRefreshes = new Map();
+function refreshOnce(key, refresh) {
+    const pending = pendingRefreshes.get(key);
+    if (pending)
+        return pending;
+    const started = refresh().finally(() => {
+        if (pendingRefreshes.get(key) === started)
+            pendingRefreshes.delete(key);
+    });
+    pendingRefreshes.set(key, started);
+    return started;
+}
+function isRefreshDue(expiresAt, now) {
+    if (!expiresAt)
+        return true;
+    const expires = Date.parse(expiresAt);
+    return !Number.isFinite(expires) || expires <= now.getTime() + REFRESH_WINDOW_MS;
+}
+function isExpired(expiresAt, now) {
+    const expires = Date.parse(expiresAt);
+    return !Number.isFinite(expires) || expires <= now.getTime();
+}
+function isOrgInvalid(error) {
+    return error instanceof CliUsageError && error.body.code === "ORG_INVALID";
+}
+function warnRefreshFailure(error) {
+    if (!isVerbose())
+        return;
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[gd-cli] 当前组织访问刷新失败，本次继续使用现有组织：${redactSensitiveText(message)}`);
+}

package/dist/src/core/auth/org-manager.d.ts

@@ -1,7 +1,7 @@
 import { SsoClient } from "../../api/sso-client.js";
 import { HubClient } from "../../api/hub-client.js";
 import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
-import type { OrgSummary } from "./types.js";
+import type { OrgBinding, OrgSummary } from "./types.js";
 /**
  * 组织列表与 bind-org。
  * Device 模式：组织列表走 Hub 网关代理的 /structure/user/orgs；
@@ -17,6 +17,7 @@ export declare class OrgManager {
     switchOrgInteractive(): Promise<OrgSummary | undefined>;
     switchOrg(orgId: string): Promise<OrgSummary>;
     bindAuthorizedOrg(orgId: string): Promise<OrgSummary>;
+    refreshCurrentOrgBinding(organization: OrgBinding): Promise<void>;
     getCurrentOrgId(): string | undefined;
     getCurrentOrg(): OrgSummary | undefined;
     private listOrgsWithSource;

package/dist/src/core/auth/org-manager.js

@@ -1,7 +1,8 @@
-import { SsoClient } from "../../api/sso-client.js";
+import { SsoApiError, SsoClient } from "../../api/sso-client.js";
 import { HubClient } from "../../api/hub-client.js";
 import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
 import { GDHUB_CLI_CLIENT_ID } from "../../utils/config.js";
+import { CliUsageError } from "../output/cli-error.js";
 import chalk from "chalk";
 const BIND_TTL_MS = 24 * 60 * 60 * 1000;
 const STRUCTURE_USER_ORGS_PATH = "/structure/user/orgs";
@@ -46,7 +47,7 @@ export class OrgManager {
         console.log(chalk.yellow("\nSSO 未返回可切换的组织列表。请从稿定工作台获取 orgId，或使用:\n  gd-cli org switch --org <org-id>\n"));
         const { Prompt } = await import("../prompt/index.js");
         const orgId = await Prompt.text({
-            message: "输入要绑定的组织 ID (orgId)",
+            message: "输入要选择的组织 ID (orgId)",
             validate: (v) => (v?.trim() ? true : "orgId 不能为空"),
         });
         return this.switchOrg(orgId.trim());
@@ -61,7 +62,7 @@ export class OrgManager {
         const listed = await this.listOrgsWithSource(v2);
         const selected = listed.orgs.find((o) => o.id === normalizedOrgId);
         if (listed.source === "structure" && !selected) {
-            throw new Error(`组织 ${normalizedOrgId} 不在当前授权用户可绑定组织列表中，请先执行 gd-cli org list 确认 orgId`);
+            throw new Error(`组织 ${normalizedOrgId} 不在当前用户的可用组织列表中，请先执行 gd-cli org list 确认 orgId`);
         }
         return this.bindOrgDevice(v2, normalizedOrgId, selected);
     }
@@ -82,6 +83,34 @@ export class OrgManager {
         }
         return this.bindOrgDevice(v2, normalizedOrgId, selected);
     }
+    async refreshCurrentOrgBinding(organization) {
+        const v2 = this.v2Store.read();
+        if (!v2)
+            throw new Error("未找到 AK/SK 凭证，请先执行 gd-cli auth login");
+        if (v2.current_org?.id !== organization.id)
+            return;
+        let result;
+        try {
+            result = await this.sso.bindOrg(v2.ak, v2.sk, organization.id);
+        }
+        catch (error) {
+            const message = explicitInvalidOrganizationMessage(error);
+            if (message)
+                throw orgInvalidError(organization.id, message);
+            throw error;
+        }
+        assertBindOrgSuccess(result, organization.id);
+        const latest = this.v2Store.read();
+        if (!latest || latest.current_org?.id !== organization.id)
+            return;
+        latest.current_org = {
+            id: organization.id,
+            name: latest.current_org.name,
+            bind_expires_at: result.bind_expires_at ?? new Date(Date.now() + BIND_TTL_MS).toISOString(),
+        };
+        latest.client_id = GDHUB_CLI_CLIENT_ID;
+        this.v2Store.write(latest);
+    }
     getCurrentOrgId() {
         const v2 = this.v2Store.read();
         if (v2?.current_org?.id)
@@ -112,7 +141,7 @@ export class OrgManager {
         };
     }
     async listStructureOrgs() {
-        const raw = await this.hub.get(STRUCTURE_USER_ORGS_PATH);
+        const raw = await this.hub.get(STRUCTURE_USER_ORGS_PATH, { authRequirement: "credential" });
         if (!Array.isArray(raw))
             return [];
         const seen = new Set();
@@ -180,13 +209,39 @@ function assertBindOrgSuccess(result, orgId) {
         /成功|success|ok/i.test(text);
     const hasFailureSignal = /(失败|错误|无效|不允许|未授权|无权限|没有权限|不存在|过期|fail|error|invalid|denied|forbidden|unauthorized|not found)/i
         .test(text);
+    if (code?.toUpperCase() === "ORG_INVALID") {
+        throw orgInvalidError(orgId, message ?? code);
+    }
     if (hasFailureSignal && !hasSuccessSignal) {
-        throw new Error(`绑定组织失败：${message ?? code ?? "bind-org 返回失败"}（orgId=${orgId}）`);
+        throw new Error(`选择组织失败：${message ?? code ?? "服务端返回失败"}（orgId=${orgId}）`);
     }
     if (code && !hasSuccessSignal) {
-        throw new Error(`绑定组织失败：${message ?? `bind-org 返回 code=${code}`}（orgId=${orgId}）`);
+        throw new Error(`选择组织失败：${message ?? `服务端返回 code=${code}`}（orgId=${orgId}）`);
+    }
+}
+function explicitInvalidOrganizationMessage(error) {
+    if (!(error instanceof SsoApiError))
+        return undefined;
+    try {
+        const body = JSON.parse(error.body);
+        if (cleanString(body.code)?.toUpperCase() !== "ORG_INVALID")
+            return undefined;
+        return cleanString(body.message) ?? "当前组织不可用";
+    }
+    catch {
+        return undefined;
     }
 }
+function orgInvalidError(orgId, message) {
+    return new CliUsageError({
+        code: "ORG_INVALID",
+        type: "auth",
+        message: `选择组织失败：${message}（orgId=${orgId}）`,
+        hint: "请通过 gd-cli org list 确认可用组织。",
+        retryable: false,
+        next_steps: ["gd-cli org list", "gd-cli org switch"],
+    });
+}
 function formatOrgChoice(org, currentOrgId) {
     const product = org.product_name ? ` · ${org.product_name}` : "";
     const current = org.id === currentOrgId ? " ← 当前" : "";