oasis_test 0.1.90 → 0.1.91

package/dist/index.js

@@ -159207,15 +159207,43 @@ function actorsDomain(opts) {
       const conn = await service.setActorConnectorEnabled(req.params.id, req.params.connectorId, b2.enabled);
       return { status: 200, body: conn };
     });
+    const requireVariableManager = (req) => {
+      if (!isHumanActor(req.auth.actor)) {
+        throw new ApiError(
+          403,
+          "VARIABLE_MANAGEMENT_FORBIDDEN",
+          "\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF1Bagent \u8BFB\u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`"
+        );
+      }
+    };
+    const auditVariableChange = async (req, kind, variableKey, targetScope) => {
+      await opts.credentialAudit?.({
+        kind,
+        actor: req.auth.actor,
+        variableKey,
+        targetScope,
+        source: "console",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
     router.get("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables() } };
     });
     router.post("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
-      const scope = b2.scope ?? "global";
+      if (b2.scope !== "global" && b2.scope !== "personal" && b2.scope !== "project") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B scope\uFF08global | personal | project\uFF09\u2014\u2014\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
+        );
+      }
+      const scope = b2.scope;
       if (scope === "project" && !b2.projectId) {
         throw new ApiError(400, "BAD_REQUEST", "scope=project \u5FC5\u987B\u63D0\u4F9B projectId");
       }
@@ -159225,6 +159253,13 @@ function actorsDomain(opts) {
       if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref") {
         throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env \u6216 ref");
       }
+      if (scope === "personal") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "personal \u53D8\u91CF\u8BF7\u8D70 POST /api/actors/:id/variables\uFF08\u672C\u7AEF\u70B9\u65E0 actorId\uFF0C\u5199\u5165\u4F1A\u843D\u4E0B\u65E0\u5F52\u5C5E\u7684\u7578\u5F62\u884C\uFF09"
+        );
+      }
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       await service.putVariable({
         key: b2.key,
@@ -159236,9 +159271,16 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(
+        req,
+        "credential_write",
+        b2.key,
+        scope === "project" ? `project:${b2.projectId}` : "global"
+      );
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const projectId = req.query.get("projectId") ?? void 0;
       await service.deleteVariable(
@@ -159246,13 +159288,21 @@ function actorsDomain(opts) {
         void 0,
         projectId ? { projectId } : void 0
       );
+      await auditVariableChange(
+        req,
+        "credential_delete",
+        req.params.key,
+        projectId ? `project:${projectId}` : "global"
+      );
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables(req.params.id) } };
     });
     router.post("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const actorId = req.params.id;
       const b2 = req.body;
@@ -159282,11 +159332,14 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(req, "credential_write", b2.key, `personal:${actorId}`);
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/actors/:id/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       await service.deleteVariable(req.params.key, req.params.id);
+      await auditVariableChange(req, "credential_delete", req.params.key, `personal:${req.params.id}`);
       return { status: 200, body: { ok: true } };
     });
     router.post("/api/variables/reveal", async (req) => {
@@ -184502,17 +184555,53 @@ var COMMAND_DECLS = {
     examples: ['oasis artifact revision register --project oasis --artifact-id artifact:dev:abc --type dev --title "v1.0" --version 1 --content-ref ref-001']
   },
   var: {
-    usage: "oasis var <reveal> ...",
-    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF1A\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u660E\u6587\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 \xA74.5\uFF09\u3002",
-    subCommands: ["var reveal"],
-    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD"]
+    usage: "oasis var <reveal|list|set|rm> ...",
+    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 / ADR 0125\uFF09\u3002reveal \u662F agent \u53D6\u660E\u6587\u7684\u5165\u53E3\uFF1Blist/set/rm \u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    subCommands: ["var reveal", "var list", "var set", "var rm"],
+    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var list --scope project --project oasis"]
   },
   "var reveal": {
     usage: "oasis var reveal <key> [--source <tag>]",
-    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002\u660E\u6587\u53EA\u8F93\u51FA\u5230 stdout\u3002",
+    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002**\u8F93\u51FA\u4F1A\u8FDB\u5165\u4F1A\u8BDD\u8BB0\u5F55\u4E0E trace**\u2014\u2014\u80FD\u5305\u8FDB\u5B50\u8FDB\u7A0B\u5C31\u522B\u88F8\u8DD1\uFF0C\u7528 X=$(oasis var reveal K) \u63A5\u4F4F\u3002",
     positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key\uFF08\u53EF\u4F20\u88F8 key \u6216 oasis://var/<key> \u5F15\u7528\uFF0C\u4E8C\u8005\u7B49\u4EF7\uFF09" }],
     flags: [{ name: "source", desc: "\u8C03\u7528\u6765\u6E90\u6807\u8BB0\uFF08\u5BA1\u8BA1\u7528\uFF0C\u5982 smoke-test\uFF1B\u7F3A\u7701 agent-cli\uFF09", own: true }],
     examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var reveal oasis://var/GLM_API_KEY --source smoke-test"]
+  },
+  "var list": {
+    usage: "oasis var list [--scope global|project|personal] [--project <id>] [--actor <actorId>]",
+    description: "\u5217\u51FA\u53D8\u91CF\u5143\u6570\u636E\uFF08key / \u4F5C\u7528\u57DF / \u5F52\u5C5E / \u6295\u9012\u6A21\u5F0F\uFF09\u3002**\u503C\u4E0D\u51FA\u73B0**\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\uFF1Bagent \u8C03\u4F1A\u5F97\u5230 403\u3002",
+    flags: [
+      { name: "scope", desc: "\u53EA\u5217\u8FD9\u4E00\u6863\uFF1Aglobal | project | personal", own: true },
+      { name: "project", desc: "\u53EA\u5217\u8BE5\u9879\u76EE\u7684 project \u53D8\u91CF", own: true },
+      { name: "actor", desc: "\u5217\u8BE5\u5458\u5DE5\u53EF\u89C1\u7684\u53D8\u91CF\uFF08personal + global\uFF09", own: true }
+    ],
+    examples: ["oasis var list", "oasis var list --scope project --project oasis"]
+  },
+  "var set": {
+    usage: "oasis var set <key> --scope global|project|personal [--project <id>] [--actor <actorId>] [--delivery env|ref]",
+    description: "\u5199\u5165\u53D8\u91CF\u3002**\u503C\u53EA\u4ECE stdin \u8BFB**\u2014\u2014\u547D\u4EE4\u884C\u53C2\u6570\u4F1A\u8FDB shell history\u3001\u4E5F\u4F1A\u88AB\u540C\u673A\u4EFB\u4F55\u4EBA ps aux \u770B\u89C1\u3002--scope \u5FC5\u586B\u4E0D\u8BBE\u7F3A\u7701\uFF08\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF09\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "global=\u5168\u7EC4\u7EC7 / project=\u6302\u9879\u76EE / personal=\u6302\u5458\u5DE5\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "delivery", desc: "\u6295\u9012\u6A21\u5F0F\uFF1Aenv=\u660E\u6587\u6CE8\u5165 / ref=\u5F15\u7528\u6CE8\u5165\uFF08\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09\uFF1B\u7F3A\u7701 env", own: true }
+    ],
+    examples: [
+      'printf %s "$SECRET" | oasis var set DEV_SPA_LOGIN_PASSWORD --scope project --project oasis --delivery ref',
+      "oasis var set TAVILY_API_KEY --scope global < key.txt"
+    ]
+  },
+  "var rm": {
+    usage: "oasis var rm <key> --scope global|project|personal [--project <id>] [--actor <actorId>]",
+    description: "\u5220\u9664\u4E00\u884C\u53D8\u91CF\u3002--scope \u5FC5\u586B\u2014\u2014\u540C\u4E00\u4E2A key \u53EF\u4EE5\u5728\u4E09\u6863\u5404\u6709\u4E00\u884C\uFF0C\u4E0D\u6307\u660E\u4F1A\u5220\u9519\u884C\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "\u8981\u5220\u54EA\u4E00\u6863\uFF1Aglobal | project | personal\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true }
+    ],
+    examples: ["oasis var rm STALE_KEY --scope project --project oasis"]
   }
 };
 function formatCommandHelp(decl) {
@@ -184731,6 +184820,12 @@ function needPos(positional, i, usage) {
   if (v2 === void 0) throw new Error(`\u7528\u6CD5: ${usage}`);
   return v2;
 }
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(Buffer.from(c));
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
 function slugId(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || `artifact-${Date.now()}`;
 }
@@ -186202,8 +186297,98 @@ ${res.warning}`);
         }
         break;
       }
+      const forbidden = (e) => e instanceof ApiRequestError && e.status === 403 ? new Error("\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF08operator token\uFF09\u3002agent \u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`\u3002") : void 0;
+      const readScope = () => {
+        const scope = flags.get("scope");
+        if (scope !== "global" && scope !== "project" && scope !== "personal") {
+          throw new Error("--scope \u5FC5\u586B\uFF0C\u53D6\u503C global | project | personal\n  global   \u5168\u7EC4\u7EC7\u901A\u7528\uFF0C\u6240\u6709 agent \u90FD\u62FF\u5F97\u5230\n  project  \u6302\u5728\u9879\u76EE\u4E0A\uFF08\u914D --project <id>\uFF09\uFF0C\u6D3E\u5230\u8BE5\u9879\u76EE\u7684 agent \u81EA\u52A8\u83B7\u5F97\n  personal \u6302\u5728\u5458\u5DE5\u4E0A\uFF08\u914D --actor <actorId>\uFF09\uFF0C\u53EA\u6709\u90A3\u4E2A agent \u62FF\u5F97\u5230\n\uFF08\u4E0D\u8BBE\u7F3A\u7701\uFF1A\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u731C\u9519\u5C31\u662F\u628A\u5B83\u53D1\u7ED9\u5168\u7EC4\u7EC7\u3002\uFF09");
+        }
+        if (scope === "project" && !flags.get("project")) throw new Error("--scope project \u5FC5\u987B\u914D --project <projectId>");
+        if (scope === "personal" && !flags.get("actor")) throw new Error("--scope personal \u5FC5\u987B\u914D --actor <actorId>");
+        return {
+          scope,
+          ...flags.get("project") ? { projectId: flags.get("project") } : {},
+          ...flags.get("actor") ? { actorId: flags.get("actor") } : {}
+        };
+      };
+      if (sub === "list") {
+        const want = flags.get("scope");
+        const actorFilter = flags.get("actor");
+        const path30 = actorFilter ? `/api/actors/${encodeURIComponent(actorFilter)}/variables` : "/api/variables";
+        let items;
+        try {
+          ({ items } = await api.request("GET", path30));
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const rows = items.filter((v2) => !want || v2.scope === want).filter((v2) => !flags.get("project") || v2.projectId === flags.get("project"));
+        if (rows.length === 0) {
+          println("\u6CA1\u6709\u5339\u914D\u7684\u53D8\u91CF");
+          break;
+        }
+        for (const v2 of rows) {
+          const owner = v2.scope === "project" ? v2.projectId ?? "?" : v2.scope === "personal" ? v2.actorId ?? "?" : "-";
+          println(`${v2.key}	${v2.scope}	${owner}	${v2.deliveryMode ?? "env"}${v2.connectorId ? `	[connector:${v2.connectorId}]` : ""}`);
+        }
+        break;
+      }
+      if (sub === "set") {
+        const key = needPos(positional, 1, "oasis var set <key> --scope \u2026 \uFF08\u503C\u4ECE stdin \u8BFB\uFF09");
+        const { scope, projectId, actorId } = readScope();
+        const delivery = flags.get("delivery") ?? flags.get("delivery-mode");
+        if (delivery !== void 0 && delivery !== "env" && delivery !== "ref") {
+          throw new Error("--delivery \u53EA\u80FD\u662F env\uFF08\u660E\u6587\u6CE8\u5165\uFF09\u6216 ref\uFF08\u5F15\u7528\u6CE8\u5165\uFF0C\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09");
+        }
+        const value = await readStdin();
+        if (!value) {
+          throw new Error(`\u503C\u4ECE stdin \u8BFB\uFF0C\u547D\u4EE4\u884C\u4E0D\u63A5\u53D7 --value\uFF08\u4F1A\u8FDB shell history \u548C ps aux\uFF09\u3002\u7528\u6CD5\uFF1A
+  printf %s "$SECRET" | oasis var set ${key} --scope ${scope}${projectId ? ` --project ${projectId}` : ""}
+  oasis var set ${key} --scope ${scope} < secret.txt`);
+        }
+        const body = {
+          key,
+          value,
+          scope,
+          ...projectId ? { projectId } : {},
+          ...delivery ? { deliveryMode: delivery } : {},
+          encrypted: true
+        };
+        try {
+          if (scope === "personal") {
+            await api.request("POST", `/api/actors/${encodeURIComponent(actorId)}/variables`, { ...body, scope: "personal" });
+          } else {
+            await api.request("POST", "/api/variables", body);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const where = scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7";
+        println(`\u5DF2\u5199\u5165 ${key}\uFF08${where}\uFF0C\u6295\u9012=${delivery ?? "env"}\uFF09`);
+        break;
+      }
+      if (sub === "rm") {
+        const key = needPos(positional, 1, "oasis var rm <key> --scope \u2026");
+        const { scope, projectId, actorId } = readScope();
+        try {
+          if (scope === "personal") {
+            await api.request("DELETE", `/api/actors/${encodeURIComponent(actorId)}/variables/${encodeURIComponent(key)}`);
+          } else {
+            const q = scope === "project" ? `?projectId=${encodeURIComponent(projectId)}` : "";
+            await api.request("DELETE", `/api/variables/${encodeURIComponent(key)}${q}`);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        println(`\u5DF2\u5220\u9664 ${key}\uFF08${scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7"}\uFF09`);
+        break;
+      }
       throw new Error(`\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aoasis var ${sub ?? ""}
-\u53EF\u7528\uFF1Aoasis var reveal <key> [--source <tag>]`);
+\u53EF\u7528\uFF1A
+  oasis var reveal <key> [--source <tag>]        \u53D6\u660E\u6587\uFF08agent \u7528\uFF09
+  oasis var list [--scope s] [--project p] [--actor a]
+  oasis var set <key> --scope \u2026 [--delivery env|ref]   \uFF08\u503C\u4ECE stdin\uFF09
+  oasis var rm <key> --scope \u2026
+\u540E\u4E09\u4E2A\u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002`);
     }
     case "pin": {
       const { message } = await api.cmd("pin", {
@@ -186904,7 +187089,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.90" : "dev";
+var PKG_VERSION = true ? "0.1.91" : "dev";
 var OASIS_DIR = path29.join(os9.homedir(), ".oasis");
 var CONFIG_FILE = path29.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path29.join(OASIS_DIR, "node.pid");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test",
-  "version": "0.1.90",
+  "version": "0.1.91",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"