oasis_test 0.1.90 → 0.1.92

package/dist/index.js

@@ -141010,6 +141010,41 @@ var init_base = __esm({
   }
 });
 
+// ../connectors/src/logger.ts
+function ts() {
+  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
+}
+function log(tag, msg, extra) {
+  const suffix = extra ? "  " + JSON.stringify(extra) : "";
+  console.log(`[${ts()}] ${tag} ${msg}${suffix}`);
+}
+var init_logger = __esm({
+  "../connectors/src/logger.ts"() {
+    "use strict";
+  }
+});
+
+// ../connectors/src/_base/host-isolation.ts
+function hostIsolationEnabled(env = process.env) {
+  const v2 = env[HOST_ISOLATION_ENV];
+  return v2 === "1" || v2 === "true";
+}
+function logHostIdentityFallback(keys, where) {
+  if (keys.length === 0) return;
+  log(
+    where,
+    `\u26A0 \u5BBF\u4E3B\u673A\u8EAB\u4EFD\u9694\u79BB\u5DF2\u5173\u95ED\uFF08${HOST_ISOLATION_ENV} \u672A\u5F00\uFF09\uFF1A\u672A\u63A5\u901A\u7684\u8FDE\u63A5\u5668\u4E0D\u518D\u5C4F\u853D\u5BBF\u4E3B\u673A\u767B\u5F55\u6001\uFF0C\u672C\u8F6E ${keys.join(", ")} \u4FDD\u6301\u5BBF\u4E3B\u673A\u9ED8\u8BA4\u503C \u2014\u2014 agent \u8C03 gh/git \u65F6\u7528\u7684\u662F**\u8FD9\u53F0\u673A\u5668\u4E0A\u90A3\u4E2A\u8D26\u53F7**\uFF08\u6743\u9650\u901A\u5E38\u6BD4\u8FDE\u63A5\u5668\u8EAB\u4EFD\u66F4\u5927\uFF09\uFF0Ccommit \u7F72\u540D\u8D70 git config --global\u3002`
+  );
+}
+var HOST_ISOLATION_ENV;
+var init_host_isolation = __esm({
+  "../connectors/src/_base/host-isolation.ts"() {
+    "use strict";
+    init_logger();
+    HOST_ISOLATION_ENV = "OASIS_CONNECTOR_HOST_ISOLATION";
+  }
+});
+
 // ../connectors/src/feishu/index.ts
 function parseFeishuTokenResponse(data, nowMs) {
   const accessToken = String(data["access_token"] ?? "");
@@ -142025,20 +142060,6 @@ var init_registry2 = __esm({
   }
 });
 
-// ../connectors/src/logger.ts
-function ts() {
-  return (/* @__PURE__ */ new Date()).toISOString().slice(11, 23);
-}
-function log(tag, msg, extra) {
-  const suffix = extra ? "  " + JSON.stringify(extra) : "";
-  console.log(`[${ts()}] ${tag} ${msg}${suffix}`);
-}
-var init_logger = __esm({
-  "../connectors/src/logger.ts"() {
-    "use strict";
-  }
-});
-
 // ../connectors/src/provision.ts
 function collectCredentials(connector, ctx) {
   const creds = {};
@@ -142090,19 +142111,24 @@ async function buildConnectorProvision(ctx) {
       log("[provision]", `${connector.config.slug}: \u88C5\u914D\u5931\u8D25\uFF08\u8BE5\u8FDE\u63A5\u5668\u672C\u8F6E\u4E0D\u53EF\u7528\uFF09: ${String(err)}`);
     }
   }
-  const isolationRoot = await (0, import_promises5.mkdtemp)((0, import_node_path8.join)((0, import_node_os4.tmpdir)(), "oasis-isolate-"));
-  let isolationUsed = false;
-  for (const key of isolationKeys) {
-    if (envOverrides[key]) continue;
-    const dir = (0, import_node_path8.join)(isolationRoot, key.toLowerCase());
-    await (0, import_promises5.mkdir)(dir, { recursive: true, mode: 448 });
-    envOverrides[key] = dir;
-    isolationUsed = true;
+  const pendingIsolation = [...isolationKeys].filter((k2) => !envOverrides[k2]);
+  if (!hostIsolationEnabled()) {
+    logHostIdentityFallback(pendingIsolation, "[provision]");
+  } else {
+    const isolationRoot = await (0, import_promises5.mkdtemp)((0, import_node_path8.join)((0, import_node_os4.tmpdir)(), "oasis-isolate-"));
+    let isolationUsed = false;
+    for (const key of isolationKeys) {
+      if (envOverrides[key]) continue;
+      const dir = (0, import_node_path8.join)(isolationRoot, key.toLowerCase());
+      await (0, import_promises5.mkdir)(dir, { recursive: true, mode: 448 });
+      envOverrides[key] = dir;
+      isolationUsed = true;
+    }
+    if (!isolationUsed) await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
+    else cleanups.push(async () => {
+      await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
+    });
   }
-  if (!isolationUsed) await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
-  else cleanups.push(async () => {
-    await (0, import_promises5.rm)(isolationRoot, { recursive: true, force: true });
-  });
   const cleanup = async () => {
     for (const fn of cleanups) await fn().catch(() => {
     });
@@ -142122,6 +142148,7 @@ var init_provision = __esm({
     "use strict";
     init_base();
     init_registry2();
+    init_host_isolation();
     init_logger();
     import_promises5 = require("node:fs/promises");
     import_node_os4 = require("node:os");
@@ -142180,11 +142207,12 @@ async function prepareConnectorsForJob(job, deps) {
   if (droppedWrappers > 0) log("[node-connectors]", `\u4E22\u5F03 ${droppedWrappers} \u6761\u672C\u673A\u4E0D\u53EF\u7528\u7684 wrapper \u8DEF\u5F84`);
   const staleKeys = /* @__PURE__ */ new Set();
   const isolationKeys = /* @__PURE__ */ new Set();
+  const isolate = hostIsolationEnabled();
   for (const connector of createAllConnectors()) {
     if (injected.has(connector.config.slug)) continue;
     const isolation = new Set(connector.hostCredentialIsolationEnvKeys ?? []);
     for (const key of connector.injectedEnvKeys) {
-      if (isolation.has(key)) isolationKeys.add(key);
+      if (isolate && isolation.has(key)) isolationKeys.add(key);
       else staleKeys.add(key);
     }
   }
@@ -142198,7 +142226,12 @@ async function prepareConnectorsForJob(job, deps) {
     delete jobEnv[key];
     dropped++;
   }
-  if (isolationKeys.size > 0) {
+  if (!isolate) {
+    logHostIdentityFallback(
+      createAllConnectors().filter((c) => !injected.has(c.config.slug)).flatMap((c) => [...c.hostCredentialIsolationEnvKeys ?? []]),
+      "[node-connectors]"
+    );
+  } else if (isolationKeys.size > 0) {
     const isolationRoot = await (0, import_promises6.mkdtemp)((0, import_node_path9.join)((0, import_node_os5.tmpdir)(), "oasis-node-isolate-"));
     for (const key of isolationKeys) {
       const dir = (0, import_node_path9.join)(isolationRoot, key.toLowerCase());
@@ -142285,6 +142318,7 @@ var init_prepare_job = __esm({
     import_node_path9 = require("node:path");
     init_base();
     init_registry2();
+    init_host_isolation();
     init_logger();
     SESSION_CREDENTIAL_RENEW_INTERVAL_MS = 30 * 6e4;
   }
@@ -146890,6 +146924,7 @@ var init_src5 = __esm({
     init_base();
     init_base();
     init_base();
+    init_host_isolation();
     init_feishu();
     init_scopes();
     init_oauth();
@@ -159207,15 +159242,43 @@ function actorsDomain(opts) {
       const conn = await service.setActorConnectorEnabled(req.params.id, req.params.connectorId, b2.enabled);
       return { status: 200, body: conn };
     });
+    const requireVariableManager = (req) => {
+      if (!isHumanActor(req.auth.actor)) {
+        throw new ApiError(
+          403,
+          "VARIABLE_MANAGEMENT_FORBIDDEN",
+          "\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF1Bagent \u8BFB\u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`"
+        );
+      }
+    };
+    const auditVariableChange = async (req, kind, variableKey, targetScope) => {
+      await opts.credentialAudit?.({
+        kind,
+        actor: req.auth.actor,
+        variableKey,
+        targetScope,
+        source: "console",
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    };
     router.get("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables() } };
     });
     router.post("/api/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const b2 = req.body;
       if (!b2?.key) throw new ApiError(400, "BAD_REQUEST", "\u7F3A\u5C11 key");
-      const scope = b2.scope ?? "global";
+      if (b2.scope !== "global" && b2.scope !== "personal" && b2.scope !== "project") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "\u5FC5\u987B\u663E\u5F0F\u63D0\u4F9B scope\uFF08global | personal | project\uFF09\u2014\u2014\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u4E0D\u8BBE\u7F3A\u7701"
+        );
+      }
+      const scope = b2.scope;
       if (scope === "project" && !b2.projectId) {
         throw new ApiError(400, "BAD_REQUEST", "scope=project \u5FC5\u987B\u63D0\u4F9B projectId");
       }
@@ -159225,6 +159288,13 @@ function actorsDomain(opts) {
       if (b2.deliveryMode !== void 0 && b2.deliveryMode !== "env" && b2.deliveryMode !== "ref") {
         throw new ApiError(400, "BAD_REQUEST", "deliveryMode \u53EA\u80FD\u662F env \u6216 ref");
       }
+      if (scope === "personal") {
+        throw new ApiError(
+          400,
+          "BAD_REQUEST",
+          "personal \u53D8\u91CF\u8BF7\u8D70 POST /api/actors/:id/variables\uFF08\u672C\u7AEF\u70B9\u65E0 actorId\uFF0C\u5199\u5165\u4F1A\u843D\u4E0B\u65E0\u5F52\u5C5E\u7684\u7578\u5F62\u884C\uFF09"
+        );
+      }
       if (b2.value === void 0 || b2.value === "") return { status: 200, body: { ok: true } };
       await service.putVariable({
         key: b2.key,
@@ -159236,9 +159306,16 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(
+        req,
+        "credential_write",
+        b2.key,
+        scope === "project" ? `project:${b2.projectId}` : "global"
+      );
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const projectId = req.query.get("projectId") ?? void 0;
       await service.deleteVariable(
@@ -159246,13 +159323,21 @@ function actorsDomain(opts) {
         void 0,
         projectId ? { projectId } : void 0
       );
+      await auditVariableChange(
+        req,
+        "credential_delete",
+        req.params.key,
+        projectId ? `project:${projectId}` : "global"
+      );
       return { status: 200, body: { ok: true } };
     });
     router.get("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listVariables(req.params.id) } };
     });
     router.post("/api/actors/:id/variables", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       const actorId = req.params.id;
       const b2 = req.body;
@@ -159282,11 +159367,14 @@ function actorsDomain(opts) {
         ...b2.overrides !== void 0 ? { overrides: b2.overrides } : {},
         ...b2.encrypted !== void 0 ? { encrypted: b2.encrypted } : {}
       });
+      await auditVariableChange(req, "credential_write", b2.key, `personal:${actorId}`);
       return { status: 201, body: { ok: true } };
     });
     router.delete("/api/actors/:id/variables/:key", async (req) => {
+      requireVariableManager(req);
       const { service } = await resolveCtx(req.auth.companyId);
       await service.deleteVariable(req.params.key, req.params.id);
+      await auditVariableChange(req, "credential_delete", req.params.key, `personal:${req.params.id}`);
       return { status: 200, body: { ok: true } };
     });
     router.post("/api/variables/reveal", async (req) => {
@@ -184502,17 +184590,53 @@ var COMMAND_DECLS = {
     examples: ['oasis artifact revision register --project oasis --artifact-id artifact:dev:abc --type dev --title "v1.0" --version 1 --content-ref ref-001']
   },
   var: {
-    usage: "oasis var <reveal> ...",
-    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF1A\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u660E\u6587\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 \xA74.5\uFF09\u3002",
-    subCommands: ["var reveal"],
-    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD"]
+    usage: "oasis var <reveal|list|set|rm> ...",
+    description: "\u51ED\u636E\u4FDD\u9669\u5E93\uFF08ADR \u51ED\u636E\u4FDD\u9669\u5E93 / ADR 0125\uFF09\u3002reveal \u662F agent \u53D6\u660E\u6587\u7684\u5165\u53E3\uFF1Blist/set/rm \u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    subCommands: ["var reveal", "var list", "var set", "var rm"],
+    examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var list --scope project --project oasis"]
   },
   "var reveal": {
     usage: "oasis var reveal <key> [--source <tag>]",
-    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002\u660E\u6587\u53EA\u8F93\u51FA\u5230 stdout\u3002",
+    description: "\u8BFB\u53D6\u654F\u611F\u53D8\u91CF\u7684\u660E\u6587\u3002env \u91CC\u82E5\u89C1 oasis://var/X\uFF08\u5F15\u7528\u975E\u660E\u6587\uFF09\u2192 \u7528\u672C\u547D\u4EE4\u53D6\u660E\u6587\u3002\u7F3A key/\u65E0\u6743\u8FD4\u56DE denied\uFF1B\u77ED\u65F6\u8BFB\u53D6\u8FC7\u591A\u4F1A\u9650\u6D41\u3002**\u8F93\u51FA\u4F1A\u8FDB\u5165\u4F1A\u8BDD\u8BB0\u5F55\u4E0E trace**\u2014\u2014\u80FD\u5305\u8FDB\u5B50\u8FDB\u7A0B\u5C31\u522B\u88F8\u8DD1\uFF0C\u7528 X=$(oasis var reveal K) \u63A5\u4F4F\u3002",
     positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key\uFF08\u53EF\u4F20\u88F8 key \u6216 oasis://var/<key> \u5F15\u7528\uFF0C\u4E8C\u8005\u7B49\u4EF7\uFF09" }],
     flags: [{ name: "source", desc: "\u8C03\u7528\u6765\u6E90\u6807\u8BB0\uFF08\u5BA1\u8BA1\u7528\uFF0C\u5982 smoke-test\uFF1B\u7F3A\u7701 agent-cli\uFF09", own: true }],
     examples: ["oasis var reveal DEV_SPA_LOGIN_PASSWORD", "oasis var reveal oasis://var/GLM_API_KEY --source smoke-test"]
+  },
+  "var list": {
+    usage: "oasis var list [--scope global|project|personal] [--project <id>] [--actor <actorId>]",
+    description: "\u5217\u51FA\u53D8\u91CF\u5143\u6570\u636E\uFF08key / \u4F5C\u7528\u57DF / \u5F52\u5C5E / \u6295\u9012\u6A21\u5F0F\uFF09\u3002**\u503C\u4E0D\u51FA\u73B0**\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\uFF1Bagent \u8C03\u4F1A\u5F97\u5230 403\u3002",
+    flags: [
+      { name: "scope", desc: "\u53EA\u5217\u8FD9\u4E00\u6863\uFF1Aglobal | project | personal", own: true },
+      { name: "project", desc: "\u53EA\u5217\u8BE5\u9879\u76EE\u7684 project \u53D8\u91CF", own: true },
+      { name: "actor", desc: "\u5217\u8BE5\u5458\u5DE5\u53EF\u89C1\u7684\u53D8\u91CF\uFF08personal + global\uFF09", own: true }
+    ],
+    examples: ["oasis var list", "oasis var list --scope project --project oasis"]
+  },
+  "var set": {
+    usage: "oasis var set <key> --scope global|project|personal [--project <id>] [--actor <actorId>] [--delivery env|ref]",
+    description: "\u5199\u5165\u53D8\u91CF\u3002**\u503C\u53EA\u4ECE stdin \u8BFB**\u2014\u2014\u547D\u4EE4\u884C\u53C2\u6570\u4F1A\u8FDB shell history\u3001\u4E5F\u4F1A\u88AB\u540C\u673A\u4EFB\u4F55\u4EBA ps aux \u770B\u89C1\u3002--scope \u5FC5\u586B\u4E0D\u8BBE\u7F3A\u7701\uFF08\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF09\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "global=\u5168\u7EC4\u7EC7 / project=\u6302\u9879\u76EE / personal=\u6302\u5458\u5DE5\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "delivery", desc: "\u6295\u9012\u6A21\u5F0F\uFF1Aenv=\u660E\u6587\u6CE8\u5165 / ref=\u5F15\u7528\u6CE8\u5165\uFF08\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09\uFF1B\u7F3A\u7701 env", own: true }
+    ],
+    examples: [
+      'printf %s "$SECRET" | oasis var set DEV_SPA_LOGIN_PASSWORD --scope project --project oasis --delivery ref',
+      "oasis var set TAVILY_API_KEY --scope global < key.txt"
+    ]
+  },
+  "var rm": {
+    usage: "oasis var rm <key> --scope global|project|personal [--project <id>] [--actor <actorId>]",
+    description: "\u5220\u9664\u4E00\u884C\u53D8\u91CF\u3002--scope \u5FC5\u586B\u2014\u2014\u540C\u4E00\u4E2A key \u53EF\u4EE5\u5728\u4E09\u6863\u5404\u6709\u4E00\u884C\uFF0C\u4E0D\u6307\u660E\u4F1A\u5220\u9519\u884C\u3002\u7BA1\u7406\u9762\u547D\u4EE4\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002",
+    positional: [{ name: "key", required: true, desc: "\u53D8\u91CF key" }],
+    flags: [
+      { name: "scope", desc: "\u8981\u5220\u54EA\u4E00\u6863\uFF1Aglobal | project | personal\uFF08\u5FC5\u586B\uFF09", own: true },
+      { name: "project", desc: "\u9879\u76EE id\uFF08--scope project \u65F6\u5FC5\u586B\uFF09", own: true },
+      { name: "actor", desc: "\u5458\u5DE5 actorId\uFF08--scope personal \u65F6\u5FC5\u586B\uFF09", own: true }
+    ],
+    examples: ["oasis var rm STALE_KEY --scope project --project oasis"]
   }
 };
 function formatCommandHelp(decl) {
@@ -184731,6 +184855,12 @@ function needPos(positional, i, usage) {
   if (v2 === void 0) throw new Error(`\u7528\u6CD5: ${usage}`);
   return v2;
 }
+async function readStdin() {
+  if (process.stdin.isTTY) return "";
+  const chunks = [];
+  for await (const c of process.stdin) chunks.push(Buffer.from(c));
+  return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+}
 function slugId(value) {
   return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || `artifact-${Date.now()}`;
 }
@@ -186202,8 +186332,98 @@ ${res.warning}`);
         }
         break;
       }
+      const forbidden = (e) => e instanceof ApiRequestError && e.status === 403 ? new Error("\u53D8\u91CF\u7684\u5217\u51FA/\u5199\u5165/\u5220\u9664\u4EC5\u9650\u4EBA\u7C7B\u63A7\u5236\u53F0\u7528\u6237\uFF08operator token\uFF09\u3002agent \u53D6\u51ED\u636E\u8BF7\u7528 `oasis var reveal <key>`\u3002") : void 0;
+      const readScope = () => {
+        const scope = flags.get("scope");
+        if (scope !== "global" && scope !== "project" && scope !== "personal") {
+          throw new Error("--scope \u5FC5\u586B\uFF0C\u53D6\u503C global | project | personal\n  global   \u5168\u7EC4\u7EC7\u901A\u7528\uFF0C\u6240\u6709 agent \u90FD\u62FF\u5F97\u5230\n  project  \u6302\u5728\u9879\u76EE\u4E0A\uFF08\u914D --project <id>\uFF09\uFF0C\u6D3E\u5230\u8BE5\u9879\u76EE\u7684 agent \u81EA\u52A8\u83B7\u5F97\n  personal \u6302\u5728\u5458\u5DE5\u4E0A\uFF08\u914D --actor <actorId>\uFF09\uFF0C\u53EA\u6709\u90A3\u4E2A agent \u62FF\u5F97\u5230\n\uFF08\u4E0D\u8BBE\u7F3A\u7701\uFF1A\u4F5C\u7528\u57DF\u51B3\u5B9A\u8FD9\u6761\u51ED\u636E\u53D1\u7ED9\u8C01\uFF0C\u731C\u9519\u5C31\u662F\u628A\u5B83\u53D1\u7ED9\u5168\u7EC4\u7EC7\u3002\uFF09");
+        }
+        if (scope === "project" && !flags.get("project")) throw new Error("--scope project \u5FC5\u987B\u914D --project <projectId>");
+        if (scope === "personal" && !flags.get("actor")) throw new Error("--scope personal \u5FC5\u987B\u914D --actor <actorId>");
+        return {
+          scope,
+          ...flags.get("project") ? { projectId: flags.get("project") } : {},
+          ...flags.get("actor") ? { actorId: flags.get("actor") } : {}
+        };
+      };
+      if (sub === "list") {
+        const want = flags.get("scope");
+        const actorFilter = flags.get("actor");
+        const path30 = actorFilter ? `/api/actors/${encodeURIComponent(actorFilter)}/variables` : "/api/variables";
+        let items;
+        try {
+          ({ items } = await api.request("GET", path30));
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const rows = items.filter((v2) => !want || v2.scope === want).filter((v2) => !flags.get("project") || v2.projectId === flags.get("project"));
+        if (rows.length === 0) {
+          println("\u6CA1\u6709\u5339\u914D\u7684\u53D8\u91CF");
+          break;
+        }
+        for (const v2 of rows) {
+          const owner = v2.scope === "project" ? v2.projectId ?? "?" : v2.scope === "personal" ? v2.actorId ?? "?" : "-";
+          println(`${v2.key}	${v2.scope}	${owner}	${v2.deliveryMode ?? "env"}${v2.connectorId ? `	[connector:${v2.connectorId}]` : ""}`);
+        }
+        break;
+      }
+      if (sub === "set") {
+        const key = needPos(positional, 1, "oasis var set <key> --scope \u2026 \uFF08\u503C\u4ECE stdin \u8BFB\uFF09");
+        const { scope, projectId, actorId } = readScope();
+        const delivery = flags.get("delivery") ?? flags.get("delivery-mode");
+        if (delivery !== void 0 && delivery !== "env" && delivery !== "ref") {
+          throw new Error("--delivery \u53EA\u80FD\u662F env\uFF08\u660E\u6587\u6CE8\u5165\uFF09\u6216 ref\uFF08\u5F15\u7528\u6CE8\u5165\uFF0C\u654F\u611F\u9879\u7528\u8FD9\u4E2A\uFF09");
+        }
+        const value = await readStdin();
+        if (!value) {
+          throw new Error(`\u503C\u4ECE stdin \u8BFB\uFF0C\u547D\u4EE4\u884C\u4E0D\u63A5\u53D7 --value\uFF08\u4F1A\u8FDB shell history \u548C ps aux\uFF09\u3002\u7528\u6CD5\uFF1A
+  printf %s "$SECRET" | oasis var set ${key} --scope ${scope}${projectId ? ` --project ${projectId}` : ""}
+  oasis var set ${key} --scope ${scope} < secret.txt`);
+        }
+        const body = {
+          key,
+          value,
+          scope,
+          ...projectId ? { projectId } : {},
+          ...delivery ? { deliveryMode: delivery } : {},
+          encrypted: true
+        };
+        try {
+          if (scope === "personal") {
+            await api.request("POST", `/api/actors/${encodeURIComponent(actorId)}/variables`, { ...body, scope: "personal" });
+          } else {
+            await api.request("POST", "/api/variables", body);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        const where = scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7";
+        println(`\u5DF2\u5199\u5165 ${key}\uFF08${where}\uFF0C\u6295\u9012=${delivery ?? "env"}\uFF09`);
+        break;
+      }
+      if (sub === "rm") {
+        const key = needPos(positional, 1, "oasis var rm <key> --scope \u2026");
+        const { scope, projectId, actorId } = readScope();
+        try {
+          if (scope === "personal") {
+            await api.request("DELETE", `/api/actors/${encodeURIComponent(actorId)}/variables/${encodeURIComponent(key)}`);
+          } else {
+            const q = scope === "project" ? `?projectId=${encodeURIComponent(projectId)}` : "";
+            await api.request("DELETE", `/api/variables/${encodeURIComponent(key)}${q}`);
+          }
+        } catch (e) {
+          throw forbidden(e) ?? e;
+        }
+        println(`\u5DF2\u5220\u9664 ${key}\uFF08${scope === "project" ? `\u9879\u76EE ${projectId}` : scope === "personal" ? `\u5458\u5DE5 ${actorId}` : "\u5168\u7EC4\u7EC7"}\uFF09`);
+        break;
+      }
       throw new Error(`\u672A\u77E5\u5B50\u547D\u4EE4\uFF1Aoasis var ${sub ?? ""}
-\u53EF\u7528\uFF1Aoasis var reveal <key> [--source <tag>]`);
+\u53EF\u7528\uFF1A
+  oasis var reveal <key> [--source <tag>]        \u53D6\u660E\u6587\uFF08agent \u7528\uFF09
+  oasis var list [--scope s] [--project p] [--actor a]
+  oasis var set <key> --scope \u2026 [--delivery env|ref]   \uFF08\u503C\u4ECE stdin\uFF09
+  oasis var rm <key> --scope \u2026
+\u540E\u4E09\u4E2A\u662F\u7BA1\u7406\u9762\uFF0C\u4EC5\u9650\u4EBA\u7C7B operator token\u3002`);
     }
     case "pin": {
       const { message } = await api.cmd("pin", {
@@ -186904,7 +187124,7 @@ function syncRuntimeAssets(candidateRoots, binDir) {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "0.1.90" : "dev";
+var PKG_VERSION = true ? "0.1.92" : "dev";
 var OASIS_DIR = path29.join(os9.homedir(), ".oasis");
 var CONFIG_FILE = path29.join(OASIS_DIR, "node-config.json");
 var PID_FILE = path29.join(OASIS_DIR, "node.pid");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test",
-  "version": "0.1.90",
+  "version": "0.1.92",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"