gaoding-cli 1.0.0-alpha.7 → 1.0.0-alpha.9

package/dist/src/core/auth/auth-guard.js

@@ -0,0 +1,121 @@
+import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
+import { isVerbose } from "../../utils/config.js";
+import { redactSensitiveText } from "../../utils/redact.js";
+import { CliUsageError } from "../output/cli-error.js";
+export class AuthGuard {
+    store;
+    now;
+    refreshCurrentOrg;
+    onRefreshWarning;
+    constructor(options = {}) {
+        this.store = options.store ?? new CredentialStoreV2();
+        this.now = options.now ?? (() => new Date());
+        this.refreshCurrentOrg = options.refreshCurrentOrg ?? (async (organization) => {
+            const { OrgManager } = await import("./org-manager.js");
+            await new OrgManager(this.store).refreshCurrentOrgBinding(organization);
+        });
+        this.onRefreshWarning = options.onRefreshWarning ?? warnRefreshFailure;
+    }
+    async ensure(requirement) {
+        if (requirement === "none")
+            return null;
+        const credentials = this.store.read();
+        if (!credentials) {
+            throw new CliUsageError({
+                code: "AUTH_MISSING",
+                type: "auth",
+                message: "未找到 AK/SK 凭证，请先登录。",
+                hint: "请先登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (isExpired(credentials.expires_at, this.now())) {
+            throw new CliUsageError({
+                code: "AUTH_EXPIRED",
+                type: "auth",
+                message: "AK/SK 凭证已过期，请重新登录。",
+                hint: "请重新登录：gd-cli auth login",
+                retryable: false,
+                next_steps: ["gd-cli auth login"],
+            });
+        }
+        if (requirement === "current-org" && !credentials.current_org?.id) {
+            throw new CliUsageError({
+                code: "ORG_REQUIRED",
+                type: "auth",
+                message: "当前未选择组织。",
+                hint: "请先选择组织：gd-cli org switch",
+                retryable: false,
+                next_steps: ["gd-cli org list", "gd-cli org switch"],
+            });
+        }
+        if (requirement === "current-org" &&
+            credentials.current_org &&
+            isRefreshDue(credentials.current_org.bind_expires_at, this.now())) {
+            try {
+                await refreshOnce(`${credentials.ak}:${credentials.current_org.id}`, () => this.refreshCurrentOrg(credentials.current_org));
+                return this.store.read();
+            }
+            catch (error) {
+                if (isOrgInvalid(error)) {
+                    const organization = {
+                        id: credentials.current_org.id,
+                        name: credentials.current_org.name,
+                    };
+                    this.clearCurrentOrganization(credentials.current_org.id);
+                    throw new CliUsageError({
+                        code: "ORG_INVALID",
+                        type: "auth",
+                        message: `当前组织 ${organization.name} (${organization.id}) 不可用或已无访问权限。`,
+                        hint: "请重新选择组织：gd-cli org switch",
+                        retryable: false,
+                        next_steps: ["gd-cli org list", "gd-cli org switch"],
+                        detail: { organization },
+                    });
+                }
+                this.onRefreshWarning(error);
+            }
+        }
+        return credentials;
+    }
+    clearCurrentOrganization(expectedOrgId) {
+        const latest = this.store.read();
+        if (!latest || latest.current_org?.id !== expectedOrgId)
+            return;
+        delete latest.current_org;
+        this.store.write(latest);
+    }
+}
+const REFRESH_WINDOW_MS = 5 * 60 * 1000;
+const pendingRefreshes = new Map();
+function refreshOnce(key, refresh) {
+    const pending = pendingRefreshes.get(key);
+    if (pending)
+        return pending;
+    const started = refresh().finally(() => {
+        if (pendingRefreshes.get(key) === started)
+            pendingRefreshes.delete(key);
+    });
+    pendingRefreshes.set(key, started);
+    return started;
+}
+function isRefreshDue(expiresAt, now) {
+    if (!expiresAt)
+        return true;
+    const expires = Date.parse(expiresAt);
+    return !Number.isFinite(expires) || expires <= now.getTime() + REFRESH_WINDOW_MS;
+}
+function isExpired(expiresAt, now) {
+    const expires = Date.parse(expiresAt);
+    return !Number.isFinite(expires) || expires <= now.getTime();
+}
+function isOrgInvalid(error) {
+    return error instanceof CliUsageError && error.body.code === "ORG_INVALID";
+}
+function warnRefreshFailure(error) {
+    if (!isVerbose())
+        return;
+    const message = error instanceof Error ? error.message : String(error);
+    console.error(`[gd-cli] 当前组织访问刷新失败，本次继续使用现有组织：${redactSensitiveText(message)}`);
+}

package/dist/src/core/auth/org-manager.d.ts

@@ -1,7 +1,7 @@
 import { SsoClient } from "../../api/sso-client.js";
 import { HubClient } from "../../api/hub-client.js";
 import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
-import type { OrgSummary } from "./types.js";
+import type { OrgBinding, OrgSummary } from "./types.js";
 /**
  * 组织列表与 bind-org。
  * Device 模式：组织列表走 Hub 网关代理的 /structure/user/orgs；
@@ -17,6 +17,7 @@ export declare class OrgManager {
     switchOrgInteractive(): Promise<OrgSummary | undefined>;
     switchOrg(orgId: string): Promise<OrgSummary>;
     bindAuthorizedOrg(orgId: string): Promise<OrgSummary>;
+    refreshCurrentOrgBinding(organization: OrgBinding): Promise<void>;
     getCurrentOrgId(): string | undefined;
     getCurrentOrg(): OrgSummary | undefined;
     private listOrgsWithSource;

package/dist/src/core/auth/org-manager.js

@@ -1,7 +1,8 @@
-import { SsoClient } from "../../api/sso-client.js";
+import { SsoApiError, SsoClient } from "../../api/sso-client.js";
 import { HubClient } from "../../api/hub-client.js";
 import { CredentialStoreV2 } from "../../auth/credential-store-v2.js";
 import { GDHUB_CLI_CLIENT_ID } from "../../utils/config.js";
+import { CliUsageError } from "../output/cli-error.js";
 import chalk from "chalk";
 const BIND_TTL_MS = 24 * 60 * 60 * 1000;
 const STRUCTURE_USER_ORGS_PATH = "/structure/user/orgs";
@@ -46,7 +47,7 @@ export class OrgManager {
         console.log(chalk.yellow("\nSSO 未返回可切换的组织列表。请从稿定工作台获取 orgId，或使用:\n  gd-cli org switch --org <org-id>\n"));
         const { Prompt } = await import("../prompt/index.js");
         const orgId = await Prompt.text({
-            message: "输入要绑定的组织 ID (orgId)",
+            message: "输入要选择的组织 ID (orgId)",
             validate: (v) => (v?.trim() ? true : "orgId 不能为空"),
         });
         return this.switchOrg(orgId.trim());
@@ -61,7 +62,7 @@ export class OrgManager {
         const listed = await this.listOrgsWithSource(v2);
         const selected = listed.orgs.find((o) => o.id === normalizedOrgId);
         if (listed.source === "structure" && !selected) {
-            throw new Error(`组织 ${normalizedOrgId} 不在当前授权用户可绑定组织列表中，请先执行 gd-cli org list 确认 orgId`);
+            throw new Error(`组织 ${normalizedOrgId} 不在当前用户的可用组织列表中，请先执行 gd-cli org list 确认 orgId`);
         }
         return this.bindOrgDevice(v2, normalizedOrgId, selected);
     }
@@ -82,6 +83,34 @@ export class OrgManager {
         }
         return this.bindOrgDevice(v2, normalizedOrgId, selected);
     }
+    async refreshCurrentOrgBinding(organization) {
+        const v2 = this.v2Store.read();
+        if (!v2)
+            throw new Error("未找到 AK/SK 凭证，请先执行 gd-cli auth login");
+        if (v2.current_org?.id !== organization.id)
+            return;
+        let result;
+        try {
+            result = await this.sso.bindOrg(v2.ak, v2.sk, organization.id);
+        }
+        catch (error) {
+            const message = explicitInvalidOrganizationMessage(error);
+            if (message)
+                throw orgInvalidError(organization.id, message);
+            throw error;
+        }
+        assertBindOrgSuccess(result, organization.id);
+        const latest = this.v2Store.read();
+        if (!latest || latest.current_org?.id !== organization.id)
+            return;
+        latest.current_org = {
+            id: organization.id,
+            name: latest.current_org.name,
+            bind_expires_at: result.bind_expires_at ?? new Date(Date.now() + BIND_TTL_MS).toISOString(),
+        };
+        latest.client_id = GDHUB_CLI_CLIENT_ID;
+        this.v2Store.write(latest);
+    }
     getCurrentOrgId() {
         const v2 = this.v2Store.read();
         if (v2?.current_org?.id)
@@ -112,7 +141,7 @@ export class OrgManager {
         };
     }
     async listStructureOrgs() {
-        const raw = await this.hub.get(STRUCTURE_USER_ORGS_PATH);
+        const raw = await this.hub.get(STRUCTURE_USER_ORGS_PATH, { authRequirement: "credential" });
         if (!Array.isArray(raw))
             return [];
         const seen = new Set();
@@ -180,13 +209,39 @@ function assertBindOrgSuccess(result, orgId) {
         /成功|success|ok/i.test(text);
     const hasFailureSignal = /(失败|错误|无效|不允许|未授权|无权限|没有权限|不存在|过期|fail|error|invalid|denied|forbidden|unauthorized|not found)/i
         .test(text);
+    if (code?.toUpperCase() === "ORG_INVALID") {
+        throw orgInvalidError(orgId, message ?? code);
+    }
     if (hasFailureSignal && !hasSuccessSignal) {
-        throw new Error(`绑定组织失败：${message ?? code ?? "bind-org 返回失败"}（orgId=${orgId}）`);
+        throw new Error(`选择组织失败：${message ?? code ?? "服务端返回失败"}（orgId=${orgId}）`);
     }
     if (code && !hasSuccessSignal) {
-        throw new Error(`绑定组织失败：${message ?? `bind-org 返回 code=${code}`}（orgId=${orgId}）`);
+        throw new Error(`选择组织失败：${message ?? `服务端返回 code=${code}`}（orgId=${orgId}）`);
+    }
+}
+function explicitInvalidOrganizationMessage(error) {
+    if (!(error instanceof SsoApiError))
+        return undefined;
+    try {
+        const body = JSON.parse(error.body);
+        if (cleanString(body.code)?.toUpperCase() !== "ORG_INVALID")
+            return undefined;
+        return cleanString(body.message) ?? "当前组织不可用";
+    }
+    catch {
+        return undefined;
     }
 }
+function orgInvalidError(orgId, message) {
+    return new CliUsageError({
+        code: "ORG_INVALID",
+        type: "auth",
+        message: `选择组织失败：${message}（orgId=${orgId}）`,
+        hint: "请通过 gd-cli org list 确认可用组织。",
+        retryable: false,
+        next_steps: ["gd-cli org list", "gd-cli org switch"],
+    });
+}
 function formatOrgChoice(org, currentOrgId) {
     const product = org.product_name ? ` · ${org.product_name}` : "";
     const current = org.id === currentOrgId ? " ← 当前" : "";

package/dist/src/core/output/envelope.d.ts

@@ -36,5 +36,6 @@ export interface ResultEnvelope<T = unknown> {
 }
 export declare function wrapEnvelope<T>(payload: T, meta?: Record<string, unknown>): ResultEnvelope<T>;
 export declare function failedEnvelope(error: CliErrorBody, meta?: Record<string, unknown>): ResultEnvelope<null>;
+export declare function publicCliErrorBody(error: CliErrorBody): CliErrorBody;
 export declare function emitJson(data: unknown): void;
 export declare function shouldEmitEnvelope(format: string, rootFormat?: string): boolean;

package/dist/src/core/output/envelope.js

@@ -24,7 +24,7 @@ function normalizeEnvelopeStatus(value) {
     return "completed";
 }
 export function failedEnvelope(error, meta) {
-    return { status: "failed", data: null, error, meta };
+    return { status: "failed", data: null, error: publicCliErrorBody(error), meta };
 }
 function normalizePayloadError(value) {
     if (!value)
@@ -45,7 +45,7 @@ function normalizePayloadError(value) {
     }
     const error = value;
     const type = error.type;
-    return {
+    return publicCliErrorBody({
         code: typeof error.code === "string" ? error.code : "ERROR",
         type: type === "business" ||
             type === "auth" ||
@@ -54,11 +54,9 @@ function normalizePayloadError(value) {
             type === "unknown"
             ? type
             : "unknown",
-        message: typeof error.message === "string" ? error.message : JSON.stringify(error),
+        message: typeof error.message === "string" ? error.message : "请求失败",
         reason: typeof error.reason === "string" ? error.reason : undefined,
         hint: typeof error.hint === "string" ? error.hint : undefined,
-        app_id: typeof error.app_id === "string" ? error.app_id : undefined,
-        tool_id: typeof error.tool_id === "string" ? error.tool_id : undefined,
         retryable: typeof error.retryable === "boolean" ? error.retryable : undefined,
         next_command: typeof error.next_command === "string" ? error.next_command : undefined,
         next_steps: Array.isArray(error.next_steps) ? error.next_steps.map(String) : undefined,
@@ -67,8 +65,80 @@ function normalizePayloadError(value) {
         forbidden_actions: Array.isArray(error.forbidden_actions) ? error.forbidden_actions.map(String) : undefined,
         allow_org_check: typeof error.allow_org_check === "boolean" ? error.allow_org_check : undefined,
         agent_message_template: typeof error.agent_message_template === "string" ? error.agent_message_template : undefined,
-        detail: error,
+    });
+}
+export function publicCliErrorBody(error) {
+    const body = {
+        code: publicString(error.code) ?? "ERROR",
+        type: publicErrorType(error.type),
+        message: publicString(error.message) ?? "请求失败",
+        reason: publicString(error.reason),
+        hint: publicString(error.hint),
+        retryable: typeof error.retryable === "boolean" ? error.retryable : undefined,
+        diagnostic_context: publicDiagnosticContext(error.diagnostic_context),
+        next_command: publicString(error.next_command),
+        next_steps: publicStringArray(error.next_steps),
+        pricing_url: publicString(error.pricing_url),
+        user_action_required: publicString(error.user_action_required),
+        forbidden_actions: publicStringArray(error.forbidden_actions),
+        allow_org_check: typeof error.allow_org_check === "boolean" ? error.allow_org_check : undefined,
+        agent_message_template: publicString(error.agent_message_template),
     };
+    return Object.fromEntries(Object.entries(body).filter(([, value]) => value !== undefined));
+}
+const PUBLIC_DIAGNOSTIC_KEYS = new Set([
+    "environment",
+    "business_id",
+    "channel_id",
+    "org_id",
+    "org_name",
+    "user_id",
+    "api_path",
+    "selected_model",
+    "attempted_models",
+]);
+function publicDiagnosticContext(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return undefined;
+    const entries = Object.entries(value)
+        .filter(([key]) => PUBLIC_DIAGNOSTIC_KEYS.has(key))
+        .flatMap(([key, item]) => {
+        const projected = publicDiagnosticValue(item);
+        return projected === undefined ? [] : [[key, projected]];
+    });
+    return entries.length > 0 ? Object.fromEntries(entries) : undefined;
+}
+function publicDiagnosticValue(value) {
+    if (typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        const items = value.filter((item) => typeof item === "string" ||
+            typeof item === "number" ||
+            typeof item === "boolean");
+        return items.length > 0 ? items : undefined;
+    }
+    return undefined;
+}
+function publicString(value) {
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function publicStringArray(value) {
+    if (!Array.isArray(value))
+        return undefined;
+    const items = value.filter((item) => typeof item === "string" && item.length > 0);
+    return items.length > 0 ? items : undefined;
+}
+function publicErrorType(value) {
+    return value === "business" ||
+        value === "auth" ||
+        value === "network" ||
+        value === "validation" ||
+        value === "unknown"
+        ? value
+        : "unknown";
 }
 function extractAssets(obj) {
     const out = [];