kld-sdd 2.6.21 → 2.7.3

package/bin/kld-sdd-init.js

@@ -9,7 +9,6 @@
  *   log          SDD Telemetry CLI（记录阶段事件、查询指标）
  *   link-spec    将代码仓关联到本地 spec clone（git config sdd.specPath）
  *   sync-repos   工作目录下发现新增代码仓并轻量接入（不装 skills）
- *   auth         用户账号绑定：login / logout / status
  */
 
 const path = require('path');
@@ -52,14 +51,9 @@ if (args[0] === 'log') {
   }
   console.log(`✅ sync-repos 完成，接入 ${result.attached.length} 个代码仓`);
 } else if (args[0] === 'auth') {
-  const sub = args[1] || 'status';
-  const { runAuthCommand } = require('../lib/device-auth-cli.js');
-  runAuthCommand(sub, args.slice(2)).then((code) => {
-    process.exit(code);
-  }).catch((error) => {
-    console.error(`❌ auth 失败: ${error.message}`);
-    process.exit(1);
-  });
+  // 登录体系已随 2.7.0 移除：仅保留 deprecation 提示，不进入 init 向导
+  console.log('ℹ️  auth 子命令已于 2.7.0 移除：使用统计按本机 git 身份（user.name/user.email）上报，无需绑定。');
+  process.exit(0);
 } else {
   // 正常初始化模式
   const { main } = require('../lib/init');

package/lib/init.js

@@ -30,7 +30,6 @@ const {
 const { deployCodebuddyHookPack } = require('./deploy-codebuddy-hooks');
 const workspaceLayout = require('./workspace-layout');
 const sddConfig = require('../skywalk-sdd/ontology/sdd-config.cjs');
-const { runAccountBinding } = require('./init-account-binding');
 
 let rl = null;
 
@@ -896,13 +895,16 @@ function deployTelemetryDataDir(targetCwd = process.cwd()) {
     console.log('   ⚠️  lib/shared.cjs 源文件缺失，多个脚本将缺少共用工具依赖');
   }
 
-  // kld-fixback: 部署使用统计上报模块（usage-contract/usage-reporter/user-config）
+  // kld-fixback: 部署使用统计上报模块（usage-contract/usage-reporter/user-config/git-identity）
   // 这些模块被部署后的 skywalk-sdd/log.cjs（即 index.cjs 副本）在 cmdStart 中 require，
-  // 缺失时会上报静默失效。三件套必须同时部署，路径与 npm 包内布局一致。
+  // 缺失时会上报静默失效。四件套必须同时部署，路径与 npm 包内布局一致。
+  // ⚠️ usage-reporter.cjs 顶层 require('./git-identity.cjs')：缺它时模块加载即抛
+  // MODULE_NOT_FOUND，被 cmdStart try/catch 吞掉后上报 100% 静默丢失。
   const usageModules = [
-    { src: 'usage-contract.cjs', desc: '使用统计契约（七值/Device/ApiResponse/HTTP）' },
-    { src: 'usage-reporter.cjs', desc: '使用事件上报器（3s deadline + pending 队列）' },
-    { src: 'user-config.cjs', desc: '用户级配置（~/.kld-sdd/config.json + cli_token）' },
+    { src: 'usage-contract.cjs', desc: '使用统计契约（七值/ApiResponse/HTTP）' },
+    { src: 'usage-reporter.cjs', desc: '使用事件上报器（git 身份缓存 + 3s deadline + pending 队列）' },
+    { src: 'user-config.cjs', desc: '用户级配置（~/.kld-sdd/config.json，仅 server）' },
+    { src: 'git-identity.cjs', desc: 'git 身份持久缓存与后台刷新（usage-reporter 的硬依赖）' },
   ];
   for (const mod of usageModules) {
     const src = path.join(pkgPath, 'skywalk-sdd', 'lib', mod.src);
@@ -1095,22 +1097,17 @@ function deployCodeRepoHooks(codeRepoRoot, specRepoRoot, options = {}) {
   if (!fs.existsSync(specHooksDir)) {
     fs.mkdirSync(specHooksDir, { recursive: true });
   }
-  const hookScripts = [
-    'pre-commit-sdd-check.cjs',
-    'pre-commit-consistency-check.cjs',
-    'pre-push-sdd-check.cjs',
-    'pre-push-consistency-check.cjs',
-  ];
+  // 复制全部 .cjs 脚本 + hooks.config 配置文件
+  const hookScripts = fs.existsSync(gitHooksTemplateDir)
+    ? fs.readdirSync(gitHooksTemplateDir).filter(f => f.endsWith('.cjs') || f === 'hooks.config')
+    : [];
   for (const script of hookScripts) {
     const src = path.join(gitHooksTemplateDir, script);
     const dst = path.join(specHooksDir, script);
-    // 删除 !fs.existsSync(dst) 条件：原逻辑只在目标不存在时复制，导致模板升级后 spec 仓不会拿到最新脚本。
-    // 现在始终覆盖，与 shell hook 的 marker 覆盖策略保持一致。
-    if (fs.existsSync(src)) {
-      fs.copyFileSync(src, dst);
-    }
+    // 始终覆盖，与 shell hook 的 marker 覆盖策略保持一致
+    fs.copyFileSync(src, dst);
   }
-  console.log(`   ✓ 确保 spec 仓 skywalk-sdd/git-hooks/ 脚本齐全`);
+  console.log(`   ✓ 确保 spec 仓 skywalk-sdd/git-hooks/ 脚本齐全（${hookScripts.length} 个文件）`);
 
   // ── 2. 安装三个 shell hooks 到代码仓 .git/hooks/ ──
   // 模板 hook 运行时自动定位 spec 仓的 .cjs 脚本
@@ -1169,16 +1166,17 @@ function deployQualityGateTemplates(targetCwd = process.cwd(), options = {}) {
   const targetCiDir = path.join(dataDir, 'ci');
 
   if (fs.existsSync(gitHooksTemplateDir)) {
-    // 只复制 .cjs 脚本到 skywalk-sdd/git-hooks/，shell hook 模板（commit-msg/pre-commit/pre-push）不落此目录
+    // 复制 .cjs 脚本 + hooks.config 到 skywalk-sdd/git-hooks/
+    // shell hook 模板（commit-msg/pre-commit/pre-push）不落此目录
     if (!fs.existsSync(targetGitHooksDir)) {
       fs.mkdirSync(targetGitHooksDir, { recursive: true });
     }
     for (const file of fs.readdirSync(gitHooksTemplateDir)) {
-      if (file.endsWith('.cjs')) {
+      if (file.endsWith('.cjs') || file === 'hooks.config') {
         fs.copyFileSync(path.join(gitHooksTemplateDir, file), path.join(targetGitHooksDir, file));
       }
     }
-    console.log('   ✓ 部署 skywalk-sdd/git-hooks/（.cjs 脚本）');
+    console.log('   ✓ 部署 skywalk-sdd/git-hooks/（.cjs 脚本 + hooks.config）');
   } else {
     console.log(`   ⚠️  Git hooks 模板缺失: ${gitHooksTemplateDir}`);
   }
@@ -1546,20 +1544,6 @@ skywalk-sdd/state/
   }
 }
 
-/**
- * B1 汇总块绑定文案：已绑定显示用户，未绑定引导 auth login；不出现“使用统计”字样
- */
-function formatBindingSummaryLine(bindingResult) {
-  if (
-    bindingResult
-    && (bindingResult.status === 'bound' || bindingResult.status === 'kept')
-    && bindingResult.userName
-  ) {
-    return `  ✓ 平台账号已绑定：${bindingResult.userName}`;
-  }
-  return '  6. 绑定平台账号：npx kld-sdd auth login';
-}
-
 /**
  * 显示帮助信息
  */
@@ -1798,23 +1782,6 @@ async function main() {
   }
   removeOuterSkywalk(workspaceRoot);
 
-  // 9. B1 账号绑定向导（部署完成后、最终汇总前；--skip-auth/非 TTY 自动跳过；失败不阻塞 init）
-  const bindingController = new AbortController();
-  const onBindingSigint = () => bindingController.abort();
-  process.on('SIGINT', onBindingSigint);
-  let bindingResult = null;
-  try {
-    bindingResult = await runAccountBinding({
-      ask,
-      skipAuth: args.includes('--skip-auth'),
-      signal: bindingController.signal,
-    });
-  } catch (error) {
-    console.log(`⚠️  账号绑定向导异常（${error && error.message ? error.message : error}），已跳过`);
-  } finally {
-    process.removeListener('SIGINT', onBindingSigint);
-  }
-
   const selectedNames = selectedTools.map(t => TOOL_CONFIGS[t].name).join(', ');
 
   console.log();
@@ -1894,8 +1861,6 @@ async function main() {
   console.log('  4. 激活 opsx-apply 申请实施，opsx-archive 归档完成');
   console.log('  5. 随时入库：node skywalk-sdd/kb-upload.cjs --folder=<变更目录> --minimum-level=propose-spec');
   console.log('     （需先运行 /opsx-kb-config 配置知识库）');
-  // B1: 汇总块绑定文案（不出现“使用统计”字样）
-  console.log(formatBindingSummaryLine(bindingResult));
   if (selectedTools.includes('codebuddy')) {
     console.log('  - CodeBuddy 用户：SDD Hook Pack 已随初始化自动部署，门禁自动生效，无需手动配置');
   }
@@ -1919,8 +1884,7 @@ async function main() {
 }
 
 // kld-T06: Progress Runtime 已删除，用户级 workspace 注册函数一并移除。
-// 用户级 Device Flow 绑定由 lib/device-auth.js + skywalk-sdd/lib/user-config.cjs 负责，
-// 通过 `kld-sdd auth login` 显式触发。
+// 使用统计按本机 git 身份（user.name/user.email）上报，无需任何账号绑定。
 
 module.exports = {
   main,
@@ -1930,7 +1894,6 @@ module.exports = {
   selectEditor,
   isVerbose,
   vlog,
-  formatBindingSummaryLine,
   deployOpsxSkills,
   copyTemplatesToProject,
   deployProfileArtifacts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kld-sdd",
-  "version": "2.6.21",
+  "version": "2.7.3",
   "description": "KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills",
   "main": "index.js",
   "bin": {
@@ -8,7 +8,7 @@
     "kld-sdd-init": "bin/kld-sdd-init.js"
   },
   "scripts": {
-    "test": "node test/external-key.cjs && node test/change-key.cjs && node test/modules-and-sdd-config.cjs && node test/active-changes.cjs && node test/hook-layouts.cjs && node test/spec-package-init.cjs && node test/workspace-layout.cjs && node test/ontology-release-blockers.cjs && node test/ontology-semantic-core.cjs && node test/ontology-identity-versioning.cjs && node test/ontology-identity-continuity.cjs && node test/ontology-state-transaction.cjs && node test/ontology-process-concurrency.cjs && node test/ontology-observer-convergence.cjs && node test/ontology-working-runtime.cjs && node test/ontology-stage-materialization.cjs && node test/ontology-template-contract.cjs && node test/ontology-cli-archive.cjs && node test/archive-package-producer.cjs && node --test test/evidence-integrity-oracle.cjs test/evidence-integrity-wiring.cjs test/change-report-correctness.cjs test/report-metrics-correctness.cjs test/change-report-model-ui.cjs && node test/validate-skills-bundle.cjs && node test/tool-profiles.cjs && node test/settings-merge.cjs && node test/command-bridge.cjs && node test/codebuddy-hooks.cjs && node test/skill-content-contract.cjs && node test/init-agent-profiles.cjs && node test/init-report-runtime.cjs && node test/init-output-verbosity.cjs && node test/init-account-binding.cjs && node --test test/usage-contract.test.cjs test/user-config.test.cjs test/device-auth.test.cjs test/usage-runtime-removal.test.cjs skywalk-sdd/usage-reporter.test.cjs skywalk-sdd/usage-reporting.test.cjs && node test/progress-package-artifact.test.cjs"
+    "test": "node test/external-key.cjs && node test/change-key.cjs && node test/modules-and-sdd-config.cjs && node test/active-changes.cjs && node test/hook-layouts.cjs && node test/spec-package-init.cjs && node test/workspace-layout.cjs && node test/ontology-release-blockers.cjs && node test/ontology-semantic-core.cjs && node test/ontology-identity-versioning.cjs && node test/ontology-identity-continuity.cjs && node test/ontology-state-transaction.cjs && node test/ontology-process-concurrency.cjs && node test/ontology-observer-convergence.cjs && node test/ontology-working-runtime.cjs && node test/ontology-stage-materialization.cjs && node test/ontology-template-contract.cjs && node test/ontology-cli-archive.cjs && node test/archive-package-producer.cjs && node --test test/evidence-integrity-oracle.cjs test/evidence-integrity-wiring.cjs test/change-report-correctness.cjs test/report-metrics-correctness.cjs test/change-report-model-ui.cjs && node test/validate-skills-bundle.cjs && node test/tool-profiles.cjs && node test/settings-merge.cjs && node test/command-bridge.cjs && node test/codebuddy-hooks.cjs && node test/skill-content-contract.cjs && node test/init-agent-profiles.cjs && node test/init-report-runtime.cjs && node test/init-output-verbosity.cjs && node --test test/usage-contract.test.cjs test/user-config.test.cjs test/usage-runtime-removal.test.cjs skywalk-sdd/usage-reporter.test.cjs skywalk-sdd/usage-reporting.test.cjs && node test/progress-package-artifact.test.cjs && node --test test/progress-package-install.e2e.cjs"
   },
   "keywords": [
     "kld",

package/skywalk-sdd/index.cjs

@@ -5858,6 +5858,19 @@ function cmdEnd(args, options = {}) {
   if (!options.silent) {
     console.log(JSON.stringify(output, null, 2));
   }
+  // kld-usage-flush: stage_end 落库后冲刷 pending 队列（fire-and-forget，不产生新事件）。
+  // 覆盖"start 时网络故障/无身份，end 时已恢复"的同会话补报场景；失败不影响 output 与退出码。
+  // promise 以不可枚举属性挂返回对象供测试 await，JSON.stringify 输出不变。
+  try {
+    const { flushPendingUsage } = require('./lib/usage-reporter.cjs');
+    const usageFlush = flushPendingUsage({ projectRoot }).catch(() => null);
+    Object.defineProperty(output, 'usageFlush', {
+      value: usageFlush,
+      enumerable: false,
+      writable: false,
+      configurable: true,
+    });
+  } catch { /* flush 不可用不阻塞 */ }
   return output;
 }
 

package/skywalk-sdd/lib/git-identity.cjs

@@ -0,0 +1,270 @@
+// kld-T07 — git 身份持久缓存与后台刷新（慢 git 环境韧性）
+// 职责：~/.kld-sdd/git-identity.json 持久缓存读写（tmp+rename 原子）；
+//   TTL 判定（身份 7 天 / tombstone 1 天）；
+//   detached+unref 后台刷新（git config --get-regexp 单次调用，宽限 60s）；
+//   in-progress 锁（mtime TTL 120s）防并发多 spawn；
+//   仅 git 成功但字段缺失才写 tombstone；失败/超时不写，允许下次重试。
+// 设计背景：企业终端 git 进程启动 7~34s，前台 execFileSync 必然超时；
+//   稳态（缓存命中）零 git 调用、零额外延迟。
+// 依赖注入（spawn/execFileSync/now/env/homeDir）便于单测；Node 14 兼容。
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const os = require('node:os');
+const childProcess = require('node:child_process');
+
+const IDENTITY_FILE_NAME = 'git-identity.json';
+const REFRESH_LOCK_NAME = 'git-identity.refresh.lock';
+const IDENTITY_TTL_MS = 7 * 24 * 3600 * 1000; // 身份缓存 7 天
+const TOMBSTONE_TTL_MS = 24 * 3600 * 1000; // tombstone 1 天
+const REFRESH_LOCK_TTL_MS = 120 * 1000; // in-progress 锁 120s
+const REFRESH_GIT_TIMEOUT_MS = 60 * 1000; // 后台 git 宽限 60s（适配 7-34s 慢机器）
+
+/** 解析 home：显式 homeDir > env KLD_SDD_HOME > os.homedir（与 pendingPathFor 同注入模式） */
+function resolveHome(homeDir, env) {
+  const e = env || process.env;
+  return homeDir || (e && e.KLD_SDD_HOME) || os.homedir();
+}
+
+function identityPathFor(homeDir, env) {
+  return path.join(resolveHome(homeDir, env), '.kld-sdd', IDENTITY_FILE_NAME);
+}
+
+function refreshLockPathFor(homeDir, env) {
+  return path.join(resolveHome(homeDir, env), '.kld-sdd', REFRESH_LOCK_NAME);
+}
+
+function nowMs(options) {
+  return options && typeof options.now === 'function' ? options.now() : Date.now();
+}
+
+/** 原子写 JSON（tmp+rename），与 writePendingAtomic 同款 */
+function writeJsonAtomic(filePath, obj) {
+  fs.mkdirSync(path.dirname(filePath), { recursive: true });
+  const tmp = path.join(
+    path.dirname(filePath),
+    `.${path.basename(filePath)}.${process.pid}.${Date.now()}.tmp`,
+  );
+  fs.writeFileSync(tmp, `${JSON.stringify(obj)}\n`, 'utf8');
+  try {
+    fs.renameSync(tmp, filePath);
+  } catch (err) {
+    try { fs.unlinkSync(tmp); } catch { /* ignore */ }
+    throw err;
+  }
+}
+
+/**
+ * 写入身份缓存（readAt 可经 options.now 注入，测试 TTL 用）。
+ * @param {{userName:string,email:string}} identity
+ */
+function writeIdentityCache(identity, options = {}) {
+  writeJsonAtomic(identityPathFor(options.homeDir, options.env), {
+    userName: identity.userName,
+    email: identity.email,
+    readAt: new Date(nowMs(options)).toISOString(),
+  });
+}
+
+/** 写入 tombstone（确认无身份；TTL 1 天，防止每命令反复 spawn git） */
+function writeTombstone(options = {}) {
+  writeJsonAtomic(identityPathFor(options.homeDir, options.env), {
+    unavailable: true,
+    readAt: new Date(nowMs(options)).toISOString(),
+  });
+}
+
+/**
+ * 读身份缓存。
+ * @returns {{kind:'identity',userName:string,email:string,stale:boolean}
+ *          |{kind:'tombstone',stale:boolean}
+ *          |{kind:'miss'}}
+ *   损坏 JSON / 缺字段 / 文件不存在一律 miss
+ */
+function readIdentityCache(options = {}) {
+  let raw;
+  try {
+    raw = fs.readFileSync(identityPathFor(options.homeDir, options.env), 'utf8');
+  } catch {
+    return { kind: 'miss' };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return { kind: 'miss' };
+  }
+  if (!parsed || typeof parsed !== 'object') return { kind: 'miss' };
+  const readAt = Date.parse(typeof parsed.readAt === 'string' ? parsed.readAt : '');
+  const age = Number.isFinite(readAt) ? nowMs(options) - readAt : Infinity;
+  if (parsed.unavailable === true) {
+    return { kind: 'tombstone', stale: !(age >= 0 && age < TOMBSTONE_TTL_MS) };
+  }
+  if (
+    typeof parsed.userName === 'string' && parsed.userName
+    && typeof parsed.email === 'string' && parsed.email
+  ) {
+    return {
+      kind: 'identity',
+      userName: parsed.userName,
+      email: parsed.email,
+      stale: !(age >= 0 && age < IDENTITY_TTL_MS),
+    };
+  }
+  return { kind: 'miss' };
+}
+
+/**
+ * 获取 in-progress 锁：新鲜锁（<120s）存在或并发创建失败返回 false。
+ * 锁内容无语义，mtime 即心跳。
+ */
+function tryAcquireRefreshLock(options = {}) {
+  const lockPath = refreshLockPathFor(options.homeDir, options.env);
+  let stale = false;
+  try {
+    const st = fs.statSync(lockPath);
+    if (nowMs(options) - st.mtimeMs < REFRESH_LOCK_TTL_MS) return false;
+    stale = true; // 过期锁：可接管
+  } catch { /* 无锁 */ }
+  try {
+    fs.mkdirSync(path.dirname(lockPath), { recursive: true });
+    // 新建用 'wx' 排他竞争；过期锁允许覆盖接管（并发接管最多多刷一次，幂等无害）
+    fs.writeFileSync(lockPath, String(nowMs(options)), { encoding: 'utf8', flag: stale ? 'w' : 'wx' });
+    return true;
+  } catch {
+    return false; // 并发创建失败视为他人持锁
+  }
+}
+
+function releaseRefreshLock(options = {}) {
+  try {
+    fs.unlinkSync(refreshLockPathFor(options.homeDir, options.env));
+  } catch { /* ignore */ }
+}
+
+/**
+ * 触发后台刷新：detached+unref 子进程运行本文件 refresh 模式。
+ * spawn 抛错时释放锁。返回是否真正触发（false=锁被持有或 spawn 失败）。
+ */
+function triggerBackgroundRefresh(options = {}) {
+  if (!tryAcquireRefreshLock(options)) return false;
+  const spawnFn = (options && options.spawn) || childProcess.spawn;
+  try {
+    const child = spawnFn(
+      process.execPath,
+      [__filename, 'refresh', '--home', resolveHome(options.homeDir, options.env)],
+      { detached: true, stdio: 'ignore' },
+    );
+    if (child && typeof child.unref === 'function') child.unref();
+    return true;
+  } catch {
+    releaseRefreshLock(options);
+    return false;
+  }
+}
+
+/**
+ * 主入口（同步，零 git）：读持久缓存，必要时触发后台刷新。
+ * - 身份新鲜：直接返回，零 spawn
+ * - 身份过期：沿用旧值 + 触发刷新
+ * - tombstone 新鲜：返回 null，零 spawn
+ * - tombstone 过期 / miss：返回 null + 触发刷新
+ *
+ * @returns {{userName:string,email:string}|null}
+ */
+function ensureIdentity(options = {}) {
+  const cache = readIdentityCache(options);
+  if (cache.kind === 'identity') {
+    if (cache.stale) triggerBackgroundRefresh(options);
+    return { userName: cache.userName, email: cache.email };
+  }
+  if (cache.kind === 'tombstone' && !cache.stale) return null;
+  triggerBackgroundRefresh(options);
+  return null;
+}
+
+/**
+ * 后台刷新执行体（也可注入 execFileSync 在测试内 in-process 运行）。
+ * git 成功但字段缺失才写 tombstone；失败/超时什么都不写（允许下次重试）。
+ * 总是释放 in-progress 锁。
+ * @returns {boolean} git 调用是否成功（不代表一定写入了身份）
+ */
+function runRefresh(options = {}) {
+  const execFileSyncFn = (options && options.execFileSync) || childProcess.execFileSync;
+  try {
+    let out;
+    try {
+      out = String(execFileSyncFn('git', ['config', '--get-regexp', '^user\\.'], {
+        timeout: REFRESH_GIT_TIMEOUT_MS,
+        stdio: ['ignore', 'pipe', 'ignore'],
+      }));
+    } catch {
+      return false; // 失败/超时：不写 tombstone，允许下次重试
+    }
+    let userName = '';
+    let email = '';
+    for (const line of out.split('\n')) {
+      const m = line.match(/^(\S+)\s+(.*)$/);
+      if (!m) continue;
+      if (m[1] === 'user.name') userName = m[2].trim();
+      else if (m[1] === 'user.email') email = m[2].trim();
+    }
+    if (userName && email) {
+      writeIdentityCache({ userName, email }, options);
+    } else {
+      writeTombstone(options);
+    }
+    return true;
+  } finally {
+    releaseRefreshLock(options);
+  }
+}
+
+/**
+ * refresh 子进程 CLI 入口：node git-identity.cjs refresh --home <dir>
+ * runRefresh 成功且回读缓存为 identity 时，lazy require usage-reporter 自触发一次
+ * pending 冲刷（身份就绪后数秒内补报，不再等下一次七值 start）。
+ * lazy require 规避循环依赖（usage-reporter 顶层已 require 本模块）。
+ * 返回 flush promise（无触发时为 resolved promise），便于测试 await。
+ */
+function runRefreshCli(argv, options = {}) {
+  const homeIdx = argv.indexOf('--home');
+  const homeDir = homeIdx >= 0 ? argv[homeIdx + 1] : undefined;
+  try {
+    const ok = runRefresh(Object.assign({}, options, { homeDir }));
+    if (!ok) return Promise.resolve(false);
+    // 回读缓存：仅真实写入 identity 才触发 flush（tombstone 不触发）
+    const cache = readIdentityCache({ homeDir });
+    if (cache.kind !== 'identity') return Promise.resolve(false);
+    try {
+      const { flushPendingUsage } = require('./usage-reporter.cjs');
+      return flushPendingUsage({ homeDir })
+        .catch(() => false)
+        .then(() => true);
+    } catch {
+      return Promise.resolve(true);
+    }
+  } catch { /* 永不抛到进程外 */ }
+  return Promise.resolve(false);
+}
+
+if (require.main === module) {
+  if (process.argv[2] === 'refresh') runRefreshCli(process.argv.slice(2));
+}
+
+module.exports = {
+  ensureIdentity,
+  readIdentityCache,
+  writeIdentityCache,
+  writeTombstone,
+  triggerBackgroundRefresh,
+  runRefresh,
+  runRefreshCli,
+  identityPathFor,
+  refreshLockPathFor,
+  IDENTITY_TTL_MS,
+  TOMBSTONE_TTL_MS,
+  REFRESH_LOCK_TTL_MS,
+  REFRESH_GIT_TIMEOUT_MS,
+};

package/skywalk-sdd/lib/usage-contract.cjs

@@ -1,11 +1,16 @@
 // kld-T01 — CLI 使用统计上报契约
-// 集中定义：七值 skill 枚举、Device Flow 信封、ApiResponse 解包、
+// 集中定义：七值 skill 枚举、ApiResponse 解包、内置默认上报地址、
 // Node 14 兼容的 URL/HTTP 基础函数。与 kb-sdd 跨仓契约保持一致。
 'use strict';
 
 const http = require('node:http');
 const https = require('node:https');
 
+/**
+ * 内置默认上报地址：四级 server 解析的最后一级兜底。
+ */
+const DEFAULT_SERVER_URL = 'http://10.29.213.80:8080';
+
 /**
  * 七值使用统计 skill 枚举。
  * test / explore 不属于统计范围，永不映射。
@@ -75,89 +80,18 @@ function unwrapApiResponse(body) {
   return body.data === undefined ? null : body.data;
 }
 
-/**
- * 解析 Device Flow code 响应。
- * kb-sdd 契约：{ deviceCode, userCode, verificationUri, verificationUriComplete?, expiresIn?, interval? }
- * @param {object} body
- * @returns {{deviceCode:string,userCode:string,verificationUri:string,verificationUriComplete:string|null,expiresIn:number,interval:number}|null}
- */
-function parseDeviceCodeResponse(body) {
-  if (!body || typeof body !== 'object') return null;
-  if (typeof body.deviceCode !== 'string' || !body.deviceCode) return null;
-  if (typeof body.userCode !== 'string' || !body.userCode) return null;
-  if (typeof body.verificationUri !== 'string' || !body.verificationUri) return null;
-  const expiresIn = Number.isFinite(body.expiresIn) && body.expiresIn > 0
-    ? Math.floor(body.expiresIn)
-    : 600;
-  const interval = Number.isFinite(body.interval) && body.interval > 0
-    ? Math.floor(body.interval)
-    : 2;
-  return {
-    deviceCode: body.deviceCode,
-    userCode: body.userCode,
-    verificationUri: body.verificationUri,
-    verificationUriComplete: typeof body.verificationUriComplete === 'string' && body.verificationUriComplete
-      ? body.verificationUriComplete
-      : null,
-    expiresIn,
-    interval,
-  };
-}
-
-/**
- * 分类 Device Flow poll 响应。
- * kb-sdd 主契约：{ status: 'pending'|'authorized'|'expired'|'denied', token?, user? }
- * 兼容 RFC 8628：{ error: 'authorization_pending'|'slow_down'|'expired_token'|'access_denied' }
- *
- * @param {number|null} statusCode — HTTP 状态码；网络错误为 null
- * @param {object|null} body — 已解析 JSON；解析失败为 null
- * @returns {{kind:'authorized',token:string,user:*}|{kind:'pending'}|{kind:'slow_down'}|{kind:'expired'}|{kind:'denied'}|{kind:'error',message?:string}}
- */
-function classifyDevicePollResponse(statusCode, body) {
-  const payload = body && typeof body === 'object' ? body : {};
-  // kb-sdd 主契约：status 字段
-  if (typeof payload.status === 'string') {
-    const s = payload.status;
-    if (s === 'authorized') {
-      if (typeof payload.token === 'string' && payload.token) {
-        return { kind: 'authorized', token: payload.token, user: payload.user === undefined ? null : payload.user };
-      }
-      return { kind: 'error', message: 'authorized but missing token' };
-    }
-    if (s === 'pending') return { kind: 'pending' };
-    if (s === 'expired') return { kind: 'expired' };
-    if (s === 'denied') return { kind: 'denied' };
-    return { kind: 'error', message: `unknown status: ${s}` };
-  }
-  // RFC 8628 兼容：error 字段
-  if (typeof payload.error === 'string') {
-    const e = payload.error;
-    if (e === 'authorization_pending') return { kind: 'pending' };
-    if (e === 'slow_down') return { kind: 'slow_down' };
-    if (e === 'expired_token') return { kind: 'expired' };
-    if (e === 'access_denied') return { kind: 'denied' };
-    return { kind: 'error', message: e };
-  }
-  // 无识别字段：网络错误或 HTTP 异常
-  if (statusCode == null) return { kind: 'error', message: 'network error' };
-  if (statusCode >= 400) return { kind: 'error', message: `HTTP ${statusCode}` };
-  return { kind: 'error', message: 'unrecognized response' };
-}
-
 /**
  * 分类 usage 上报响应。
  * - confirmed: 2xx/204，服务端已确认，可从 pending 队列移除
- * - unauthorized: 401，token 失效；调用方应原子删除本地 token 并提示一次
  * - retry: 网络错误 / 429 / 5xx / timeout；保留在 pending 队列
- * - drop: 其他 4xx；不再重试但不上抛
+ * - drop: 其他 4xx（含 401）；不再重试但不上抛，也不清除任何本地状态
  *
  * @param {number|null} statusCode
- * @returns {'confirmed'|'unauthorized'|'retry'|'drop'}
+ * @returns {'confirmed'|'retry'|'drop'}
  */
 function classifyUsageSubmitResponse(statusCode) {
   if (statusCode == null || statusCode === 0) return 'retry';
   if (statusCode >= 200 && statusCode < 300) return 'confirmed';
-  if (statusCode === 401) return 'unauthorized';
   if (statusCode === 429) return 'retry';
   if (statusCode >= 500) return 'retry';
   return 'drop';
@@ -171,7 +105,7 @@ function classifyUsageSubmitResponse(statusCode) {
  *
  * @param {string} url — 完整 URL（必须 http/https）
  * @param {object} payload — 请求体（JSON 序列化）
- * @param {{token?:string,timeoutMs?:number,headers?:object}} [options]
+ * @param {{timeoutMs?:number,headers?:object}} [options]
  * @returns {Promise<{statusCode:number|null,body:*,data:*,error:*}>}
  *   statusCode: HTTP 状态码，网络错误为 null
  *   body: 原始解析后的 JSON 对象（如可解析）
@@ -192,7 +126,6 @@ function postJson(url, payload, options = {}) {
       return;
     }
     const transport = target.protocol === 'https:' ? https : http;
-    const token = options && typeof options.token === 'string' && options.token ? options.token : null;
     const timeoutMs = Number.isFinite(options && options.timeoutMs) && options.timeoutMs > 0
       ? Math.floor(options.timeoutMs)
       : 30000;
@@ -213,7 +146,6 @@ function postJson(url, payload, options = {}) {
       },
       options && options.headers && typeof options.headers === 'object' ? options.headers : {},
     );
-    if (token) headers.Authorization = `Bearer ${token}`;
 
     const request = transport.request(
       {
@@ -269,8 +201,7 @@ module.exports = {
   mapCommandToUsageSkill,
   normalizeServerUrl,
   unwrapApiResponse,
-  parseDeviceCodeResponse,
-  classifyDevicePollResponse,
   classifyUsageSubmitResponse,
   postJson,
+  DEFAULT_SERVER_URL,
 };