oasis_test_v2 2.2.106 → 2.2.107

package/dist/index.js

@@ -43276,7 +43276,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes17, createHash: createHash46 } = require("crypto");
+    var { randomBytes: randomBytes17, createHash: createHash47 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -43944,7 +43944,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash46("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash47("sha1").update(key2 + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -44313,7 +44313,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash46 } = require("crypto");
+    var { createHash: createHash47 } = require("crypto");
     var extension3 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -44620,7 +44620,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash46("sha1").update(key2 + GUID).digest("base64");
+        const digest = createHash47("sha1").update(key2 + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -220270,6 +220270,9 @@ var init_memory_control_plane_store = __esm({
       /** protected：FileControlPlaneStore 子类 open() 回放快照时直接恢复（密码须持久化）。 */
       accountSecrets = /* @__PURE__ */ new Map();
       // accountId → { passwordHash?, tokenVersion }
+      /** 已登出会话（ADR 0636；protected：文件版子类回放快照时直接恢复——不持久化的话重启即「复活」）。 */
+      revokedSessions = /* @__PURE__ */ new Map();
+      // tokenHash → record
       verificationCodes = /* @__PURE__ */ new Map();
       // email → record（短 TTL，文件版不持久化）
       /** 组织模型三表（protected：文件版子类回放快照时直接恢复）。 */
@@ -220631,6 +220634,15 @@ var init_memory_control_plane_store = __esm({
         this.accountSecrets.set(accountId, { ...cur, tokenVersion: next });
         return next;
       }
+      // —— 已登出会话（ADR 0636）——
+      async revokeSession(rec2) {
+        const cutoff = Date.parse(rec2.revokedAt);
+        for (const [k2, r] of this.revokedSessions) if (Date.parse(r.expiresAt) < cutoff) this.revokedSessions.delete(k2);
+        if (!this.revokedSessions.has(rec2.tokenHash)) this.revokedSessions.set(rec2.tokenHash, { ...rec2 });
+      }
+      async isSessionRevoked(tokenHash) {
+        return this.revokedSessions.has(tokenHash);
+      }
       // —— 邮箱验证码（单邮箱一条 active）——
       async putVerificationCode(rec2) {
         this.verificationCodes.set(rec2.email, { ...rec2 });
@@ -225833,6 +225845,7 @@ var init_control_plane_file_store = __esm({
       "upsertAccount",
       "setAccountPassword",
       "bumpAccountTokenVersion",
+      "revokeSession",
       "upsertDigitalEmployee",
       "patchDigitalEmployee",
       "putAgentCredential",
@@ -225872,6 +225885,7 @@ var init_control_plane_file_store = __esm({
           for (const link of snap.inviteLinks ?? []) await MemoryControlPlaneStore.prototype.createInviteLink.call(store, link);
           for (const a of snap.accounts ?? []) await MemoryControlPlaneStore.prototype.upsertAccount.call(store, a);
           for (const e of snap.accountSecrets ?? []) store.accountSecrets.set(e.accountId, { ...e.secret });
+          for (const r of snap.revokedSessions ?? []) store.revokedSessions.set(r.tokenHash, { ...r });
           for (const e of snap.digitalEmployees ?? []) await MemoryControlPlaneStore.prototype.upsertDigitalEmployee.call(store, e);
           for (const c of snap.agentCredentials ?? []) await MemoryControlPlaneStore.prototype.putAgentCredential.call(store, c);
           for (const b2 of snap.principalBridges ?? []) await MemoryControlPlaneStore.prototype.putPrincipalBridge.call(store, b2);
@@ -225910,6 +225924,8 @@ var init_control_plane_file_store = __esm({
           inviteLinks: [...this.inviteLinks.values()],
           accounts,
           accountSecrets,
+          // 只有按哈希查的读面，直接读 protected map（同 offboardings）。
+          revokedSessions: [...this.revokedSessions.values()],
           digitalEmployees,
           agentCredentials,
           principalBridges,
@@ -230576,6 +230592,12 @@ function verifySession(token2, secret, nowMs) {
   if (typeof claims.exp !== "number" || claims.exp <= nowMs) return null;
   return claims;
 }
+function sessionTokenHash(token2) {
+  return (0, import_node_crypto54.createHash)("sha256").update(token2).digest("base64url");
+}
+function newSessionId() {
+  return (0, import_node_crypto54.randomBytes)(16).toString("base64url");
+}
 function generateCode() {
   return String((0, import_node_crypto54.randomInt)(0, 1e6)).padStart(6, "0");
 }
@@ -246652,7 +246674,7 @@ function createAuth(opts) {
   const passwordFailures = /* @__PURE__ */ new Map();
   const sessionCookie = (accountId, tokenVersion) => {
     const t = now();
-    const jwt = signSession({ sub: accountId, tokenVersion, iat: t, exp: t + sessionTtlMs }, jwtSecret);
+    const jwt = signSession({ sub: accountId, tokenVersion, iat: t, exp: t + sessionTtlMs, jti: newSessionId() }, jwtSecret);
     const attrs = [`${cookieName}=${jwt}`, "Path=/", "HttpOnly", "SameSite=Lax", `Max-Age=${Math.floor(sessionTtlMs / 1e3)}`];
     if (opts.secureCookie) attrs.push("Secure");
     return attrs.join("; ");
@@ -246710,11 +246732,13 @@ function createAuth(opts) {
     await store.deleteVerificationCode(key2);
     return "ok";
   };
+  const sessionToken = (headers) => parseCookies(typeof headers.cookie === "string" ? headers.cookie : void 0)[cookieName];
   const currentAccount = async (headers) => {
-    const raw = parseCookies(typeof headers.cookie === "string" ? headers.cookie : void 0)[cookieName];
+    const raw = sessionToken(headers);
     if (!raw) return null;
     const claims = verifySession(raw, jwtSecret, now());
     if (!claims) return null;
+    if (await store.isSessionRevoked(sessionTokenHash(raw))) return null;
     const sec = await store.getAccountSecret(claims.sub);
     if (!sec || sec.tokenVersion !== claims.tokenVersion) return null;
     const account = await store.getAccount(claims.sub);
@@ -246891,6 +246915,21 @@ function createAuth(opts) {
         return { status: 200, body: { ticket, expiresAt: new Date(exp).toISOString() } };
       }
       if (route2 === "logout") {
+        const raw = sessionToken(headers);
+        const claims = raw ? verifySession(raw, jwtSecret, now()) : null;
+        if (raw && claims) {
+          try {
+            await store.revokeSession({
+              tokenHash: sessionTokenHash(raw),
+              accountId: claims.sub,
+              revokedAt: new Date(now()).toISOString(),
+              expiresAt: new Date(claims.exp).toISOString()
+            });
+          } catch (e) {
+            console.error(`[auth] \u767B\u51FA\u540A\u9500\u5931\u8D25 ${claims.sub}: ${e instanceof Error ? e.message : String(e)}`);
+            return { status: 500, body: { error: { code: "LOGOUT_REVOKE_FAILED", message: "\u767B\u51FA\u672A\u5B8C\u6210\uFF0C\u8BF7\u91CD\u8BD5" } }, setCookie: clearCookie() };
+          }
+        }
         return { status: 200, body: { ok: true }, setCookie: clearCookie() };
       }
       return { status: 404, body: { error: { code: "NOT_FOUND", message: pathname } } };
@@ -264917,6 +264956,14 @@ var init_postgres_control_plane = __esm({
         expires_at timestamptz NOT NULL,
         attempts   int  NOT NULL DEFAULT 0
       )`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".revoked_sessions (
+        token_hash text PRIMARY KEY,             -- SHA-256(base64url) of the oasis_auth JWT
+        account_id text NOT NULL,
+        revoked_at timestamptz NOT NULL,
+        expires_at timestamptz NOT NULL          -- = \u4EE4\u724C exp\uFF1B\u8FC7\u4E86\u4EE4\u724C\u672C\u6765\u5C31\u9A8C\u4E0D\u8FC7\uFF0C\u884C\u53EF\u5220
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS revoked_sessions_expires_idx ON "${s2}".revoked_sessions (expires_at)`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS display_name text`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS created_at timestamptz`);
         await pool.query(`ALTER TABLE "${s2}".company_members ADD COLUMN IF NOT EXISTS updated_at timestamptz`);
@@ -265807,6 +265854,19 @@ var init_postgres_control_plane = __esm({
         if (r.rowCount === 0) throw new Error(`account not found: ${accountId}`);
         return Number(r.rows[0].token_version);
       }
+      // —— 已登出会话（ADR 0636）——
+      async revokeSession(rec2) {
+        await this.pool.query(`DELETE FROM ${this.s}.revoked_sessions WHERE expires_at < $1`, [rec2.revokedAt]);
+        await this.pool.query(
+          `INSERT INTO ${this.s}.revoked_sessions (token_hash, account_id, revoked_at, expires_at) VALUES ($1,$2,$3,$4)
+       ON CONFLICT (token_hash) DO NOTHING`,
+          [rec2.tokenHash, rec2.accountId, rec2.revokedAt, rec2.expiresAt]
+        );
+      }
+      async isSessionRevoked(tokenHash) {
+        const r = await this.pool.query(`SELECT 1 FROM ${this.s}.revoked_sessions WHERE token_hash = $1`, [tokenHash]);
+        return (r.rowCount ?? 0) > 0;
+      }
       // —— 邮箱验证码（单邮箱一条 active）——
       async putVerificationCode(rec2) {
         await this.pool.query(
@@ -298359,12 +298419,13 @@ var COMMAND_DECLS = {
   //    填（agent 调 = 它绑定的那个真人），命令行不收。开关 OASIS_PERSONAL_TODO=off 时服务端 404。 ——
   todo: {
     group: "\u4E2A\u4EBA\u5F85\u529E",
-    usage: "oasis todo <add|list|edit|done|cancel|reopen> ...",
+    usage: "oasis todo <add|list|show|edit|done|cancel|reopen> ...",
     description: "\u4E2A\u4EBA\u5F85\u529E\uFF1A\u66FF\u4F60\u7ED1\u5B9A\u7684\u90A3\u4E2A\u771F\u4EBA\u8BB0\u4E0B\u6709\u622A\u6B62\u65E5\u7684\u4E8B\uFF0C\u5230\u671F\u524D\u4E00\u5929 09:00\u3001\u5F53\u5929 09:00 \u7CFB\u7EDF\u4F1A\u63D0\u9192 TA\uFF08\u8BBE\u4E86\u5F00\u59CB\u65E5\u7684\uFF0C\u5F00\u59CB\u5F53\u5929 09:00 \u4E5F\u63D0\u9192\u4E00\u6B21\uFF09\u3002\u6BCF\u6761\u8F93\u51FA\u7B2C\u4E00\u884C\u662F\u300C\u4ECA\u5929\uFF1AYYYY-MM-DD \u5468X\uFF08\u65F6\u533A\uFF09\u300D\u2014\u2014\u6362\u7B97\u300C\u8FD9\u5468\u4E94\u300D\u300C\u6708\u5E95\u300D\u4E00\u5F8B\u4EE5\u5B83\u4E3A\u51C6\u3002**\u6CA1\u6709 `oasis todo` \u547D\u4EE4\u6267\u884C\u6210\u529F\uFF0C\u5C31\u4E0D\u80FD\u8BF4\u8BB0\u4E0B\u4E86\u3002**",
-    subCommands: ["todo add", "todo list", "todo edit", "todo done", "todo cancel", "todo reopen"],
+    subCommands: ["todo add", "todo list", "todo show", "todo edit", "todo done", "todo cancel", "todo reopen"],
     examples: [
       'oasis todo add --title "\u4EA4 Q3 \u590D\u76D8\u62A5\u544A" --note "\u738B\u603B\u8981\uFF0C\u5468\u4F1A\u524D\u8FC7\u4E00\u904D" --due 2026-10-09',
       "oasis todo list",
+      "oasis todo show td_3f9a1c2b",
       'oasis todo edit td_3f9a1c2b --due 2026-10-12 --reason "\u6392\u671F\u8C03\u6574"',
       "oasis todo done td_3f9a1c2b"
     ]
@@ -298389,6 +298450,13 @@ var COMMAND_DECLS = {
     description: "\u5217\u51FA\u5F85\u529E\uFF0C\u6309\u622A\u6B62\u65E5\u6392\u5E8F\uFF0C\u8FC7\u671F\u7684\u6807\u300C\u5DF2\u8FC7\u671F\u300D\uFF1B\u8BBE\u4E86\u5F00\u59CB\u65E5\u7684\u663E\u793A\u300CX \u6708 X \u65E5\u5F00\u59CB \u2192 X \u6708 X \u65E5\u622A\u6B62\u300D\u3002\u9ED8\u8BA4\u53EA\u5217\u672A\u5B8C\u6210\u7684\uFF1B--all \u8FDE\u5DF2\u5B8C\u6210\u3001\u5DF2\u53D6\u6D88\u7684\u4E00\u8D77\u5217\u3002",
     flags: [{ name: "all", desc: "\u8FDE\u5DF2\u5B8C\u6210 / \u5DF2\u53D6\u6D88\u7684\u4E00\u8D77\u5217", boolean: true, own: true }]
   },
+  "todo show": {
+    group: "\u4E2A\u4EBA\u5F85\u529E",
+    usage: "oasis todo show <id>",
+    description: "\u770B\u4E00\u6761\u5F85\u529E\u7684\u5168\u8C8C\uFF1A\u6807\u9898\u3001\u5F00\u59CB \u2192 \u622A\u6B62\u3001\u72B6\u6001\u3001\u5907\u6CE8\u5168\u6587\uFF0C\u4EE5\u53CA\u53D8\u66F4\u8BB0\u5F55\uFF08\u65F6\u95F4\u3001\u8C01\u6539\u7684 / \u7ECF\u624B agent\u3001\u5B57\u6BB5\u3001\u65E7\u503C \u2192 \u65B0\u503C\u3001\u539F\u56E0\uFF0C\u65B0\u7684\u5728\u524D\uFF09\u3002\u6539\u5907\u6CE8\u524D\u5148\u7528\u5B83\u8BFB\u51FA\u5F53\u524D\u5907\u6CE8\u5168\u6587\uFF1B\u7528\u6237\u95EE\u300C\u4E4B\u524D\u5199\u7684\u662F\u4EC0\u4E48\u300D\u4E5F\u67E5\u8FD9\u91CC\u3002",
+    positional: [{ name: "<id>", required: true, desc: "\u5F85\u529E id\uFF08oasis todo list \u7B2C\u4E00\u5217\uFF09" }],
+    examples: ["oasis todo show td_3f9a1c2b"]
+  },
   "todo edit": {
     group: "\u4E2A\u4EBA\u5F85\u529E",
     usage: "oasis todo edit <id> [--title \u2026] [--note \u2026] [--start YYYY-MM-DD|none] [--start-time HH:mm|none] [--due YYYY-MM-DD] [--time HH:mm|none] [--workorder <\u5DE5\u5355 id>|none] [--reason \u2026]",
@@ -299279,7 +299347,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.106" ? "2.2.106" : "dev";
+var CLI_VERSION = "2.2.107" ? "2.2.107" : "dev";
 function apiHeaders(token2, company) {
   const headers = {
     authorization: `Bearer ${token2}`,
@@ -301711,6 +301779,52 @@ ${res.warning}`);
         }
         break;
       }
+      if (sub === "show") {
+        const id = idOf();
+        const [one2, day] = await Promise.all([
+          call("GET", todoPath(id)),
+          call("GET", "/api/todos")
+        ]);
+        const t = one2.todo;
+        const statusText = t.status === "done" ? "\u5DF2\u5B8C\u6210" : t.status === "cancelled" ? "\u5DF2\u53D6\u6D88" : t.dueDate < day.today.date ? "\u672A\u5B8C\u6210\uFF08\u5DF2\u8FC7\u671F\uFF09" : "\u672A\u5B8C\u6210";
+        println(day.todayLine);
+        println(`${t.id}  ${t.title}`);
+        println(`\u65F6\u95F4\uFF1A${due(t)}`);
+        println(`\u72B6\u6001\uFF1A${statusText}`);
+        if (t.linkedWorkorderId) println(`\u5DE5\u5355\uFF1A${t.linkedWorkorderId}`);
+        println("\u5907\u6CE8\uFF1A");
+        println(t.note ? t.note : "\uFF08\u65E0\uFF09");
+        const FIELD = {
+          created: "\u8BB0\u4E0B",
+          status: "\u72B6\u6001",
+          title: "\u6807\u9898",
+          note: "\u5907\u6CE8",
+          startDate: "\u5F00\u59CB\u65E5",
+          startTime: "\u5F00\u59CB\u65F6\u523B",
+          dueDate: "\u622A\u6B62\u65E5",
+          dueTime: "\u622A\u6B62\u65F6\u523B",
+          linkedWorkorderId: "\u5DE5\u5355"
+        };
+        const STATUS = { open: "\u672A\u5B8C\u6210", done: "\u5DF2\u5B8C\u6210", cancelled: "\u5DF2\u53D6\u6D88" };
+        const val = (field, v2) => v2 === void 0 || v2 === "" ? "\uFF08\u7A7A\uFF09" : field === "status" ? STATUS[v2] ?? v2 : v2;
+        const fmtAt = (iso9) => new Intl.DateTimeFormat("sv-SE", {
+          timeZone: day.today.timeZone,
+          year: "numeric",
+          month: "2-digit",
+          day: "2-digit",
+          hour: "2-digit",
+          minute: "2-digit",
+          hour12: false
+        }).format(new Date(iso9));
+        const changes = [...one2.changes].sort((a, b2) => b2.at.localeCompare(a.at));
+        println(`\u53D8\u66F4\u8BB0\u5F55\uFF08${changes.length} \u6761\uFF0C\u65B0\u7684\u5728\u524D\uFF09\uFF1A`);
+        for (const c of changes) {
+          const who = c.handActorId ? `${c.actorId}\uFF08\u7ECF\u624B ${c.handActorId}\uFF09` : c.actorId;
+          const what = c.field === "created" ? `\u8BB0\u4E0B\uFF1A${c.newValue ?? ""}` : `${FIELD[c.field] ?? c.field}\uFF1A${val(c.field, c.oldValue)} \u2192 ${val(c.field, c.newValue)}`;
+          println(`- ${fmtAt(c.at)}  ${who}  ${what}${c.reason ? `  \u539F\u56E0\uFF1A${c.reason}` : ""}`);
+        }
+        break;
+      }
       if (sub === "edit") {
         const id = idOf();
         const body2 = {};
@@ -301736,7 +301850,7 @@ ${res.warning}`);
         println(`${sub === "done" ? "\u5DF2\u5B8C\u6210" : sub === "cancel" ? "\u5DF2\u53D6\u6D88" : "\u5DF2\u91CD\u65B0\u6253\u5F00"}\uFF1A${r.todo.title}\uFF0C${due(r.todo)}`);
         break;
       }
-      throw new Error("\u7528\u6CD5: oasis todo <add|list|edit|done|cancel|reopen> \u2026\uFF08oasis todo --help \u770B\u8BE6\u60C5\uFF09");
+      throw new Error("\u7528\u6CD5: oasis todo <add|list|show|edit|done|cancel|reopen> \u2026\uFF08oasis todo --help \u770B\u8BE6\u60C5\uFF09");
     }
     case "skill": {
       const sub = positional[0];
@@ -303404,7 +303518,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.106" : "dev";
+var PKG_VERSION = true ? "2.2.107" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.106",
+  "version": "2.2.107",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "f251b7721412da1529673cd12039208906bb0a6e"
+    "sourceHead": "180e4e814716f1a7eb4870a1f88cd4d10398d726"
   }
 }