oasis_test_v2 2.2.12 → 2.2.13

package/dist/index.js

@@ -201815,6 +201815,15 @@ var init_provision = __esm({
 });
 
 // ../connectors/src/prepare-job.ts
+function loginShellShadow(commandName) {
+  const home2 = process.env["HOME"];
+  if (!home2) return "";
+  for (const dir of [(0, import_node_path17.join)(home2, ".local", "bin"), (0, import_node_path17.join)(home2, "bin")]) {
+    const candidate = (0, import_node_path17.join)(dir, commandName);
+    if ((0, import_node_fs11.existsSync)(candidate)) return candidate;
+  }
+  return "";
+}
 async function prepareConnectorsForJob(job, deps) {
   const creds = job.connectorCreds ?? [];
   const remoteWrappers = job.wrapperPaths ?? [];
@@ -201850,7 +201859,16 @@ async function prepareConnectorsForJob(job, deps) {
         localWrappers.push(staged);
         status.wrapperReady = true;
       }
-      log("[node-connectors]", `${slug6}: creds + wrapper \u5DF2\u843D\u5728\u672C\u673A`);
+      const shadow = loginShellShadow(connector.commandName);
+      if (shadow) {
+        status.shadowedBy = shadow;
+        log(
+          "[node-connectors]",
+          `\u26A0 ${slug6}: creds + wrapper \u5DF2\u843D\u5728\u672C\u673A\uFF0C\u4F46 **${shadow} \u4F1A\u5728\u767B\u5F55 shell \u91CC\u6321\u4F4F wrapper**\u2014\u2014Ubuntu \u7684 ~/.profile \u628A $HOME/.local/bin \u524D\u7F6E\u5230 PATH \u6700\u524D\u3002agent \u4E00\u65E6\u7528 \`bash -lc\` \u8C03 ${connector.commandName}\uFF0C\u8D70\u5230\u7684\u662F\u90A3\u4E2A\u5BBF\u4E3B\u526F\u672C\u3001\u914D\u7F6E\u76EE\u5F55\u53C8\u88AB\u9694\u79BB\u6210\u7A7A\u7684\uFF0C\u7ED3\u679C\u5C31\u662F\u300C\u672A\u914D\u7F6E\u300D\u3002\u5904\u7406\u529E\u6CD5\uFF1A\u5220\u6389 ${shadow}\uFF08\u8FDE\u63A5\u5668\u81EA\u5E26\u7684\u771F CLI \u5728 ~/.oasis/connector-tools/bin \u4E0B\uFF0C\u4E0D\u53D7\u5F71\u54CD\uFF09\u3002`
+        );
+      } else {
+        log("[node-connectors]", `${slug6}: creds + wrapper \u5DF2\u843D\u5728\u672C\u673A`);
+      }
     } catch (err) {
       status.error = String(err);
       log(
@@ -206756,6 +206774,52 @@ ${composed}`;
           }
           return;
         }
+        if (url.pathname.startsWith("/api/connectors/") && /\/auth\/(begin|rollback|commit)$/.test(url.pathname) && req.method === "POST") {
+          const m2 = url.pathname.match(/^\/api\/connectors\/([^/]+)\/auth\/(begin|rollback|commit)$/);
+          try {
+            if (!m2) throw new Error("bad path");
+            const connectorId = decodeURIComponent(m2[1]);
+            const op = m2[2];
+            const { actorId } = JSON.parse(rawBody || "{}");
+            if (!actorId) {
+              res.writeHead(400).end(JSON.stringify({ error: "actorId required" }));
+              return;
+            }
+            const svc = await connectorActorsService();
+            if (!svc) throw new Error("actors service unavailable");
+            const cacheKey = `${currentCompanyId ?? ""}::${actorId}::${connectorId}`;
+            const now = Date.now();
+            for (const [k2, v2] of connectorAuthSnapshots) {
+              if (now - v2.at > CONNECTOR_AUTH_SNAPSHOT_TTL_MS) connectorAuthSnapshots.delete(k2);
+            }
+            if (op === "begin") {
+              const rows = await svc.snapshotActorConnectorVars(actorId, connectorId);
+              connectorAuthSnapshots.set(cacheKey, { rows, at: now });
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true, snapshot: rows.length }));
+              return;
+            }
+            if (op === "commit") {
+              connectorAuthSnapshots.delete(cacheKey);
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true }));
+              return;
+            }
+            const snap = connectorAuthSnapshots.get(cacheKey);
+            if (!snap) {
+              res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: false, reason: "no_snapshot" }));
+              return;
+            }
+            const out = await svc.restoreActorConnectorVars(
+              actorId,
+              connectorId,
+              snap.rows
+            );
+            connectorAuthSnapshots.delete(cacheKey);
+            res.writeHead(200, { "content-type": "application/json" }).end(JSON.stringify({ ok: true, ...out }));
+          } catch (e) {
+            res.writeHead(500).end(JSON.stringify({ error: String(e) }));
+          }
+          return;
+        }
         if (req.method === "POST" && /^\/api\/connectors\/[^/]+\/disconnect$/.test(url.pathname)) {
           const connId = decodeURIComponent(url.pathname.split("/")[3] ?? "");
           const svc = await connectorActorsService();
@@ -207193,7 +207257,7 @@ ${composed}`;
                 grantedFrom = "installation";
               }
             }
-            const missing = missingAppPermissions(effective);
+            const missing = missingAppPermissions({ ...meta.permissions, ...effective });
             const requestedAll = Object.entries(meta.permissions).filter(([, level]) => Boolean(level)).map(([key, level]) => ({ key, level: String(level) })).sort((a, b2) => a.key.localeCompare(b2.key));
             const grantedKeys = new Set(
               Object.entries(effective).filter(([, level]) => Boolean(level)).map(([k2]) => k2)
@@ -207218,13 +207282,19 @@ ${composed}`;
                */
               otherInstallations: installs.filter((i) => i.installationId !== installationId).map((i) => ({ account: i.account, count: Object.keys(i.permissions).length })),
               /**
-               * App 申请了、但**这一处安装铸出来的 token 里没有**。
-               * **在全集上做差**，不再只看本仓必需的那八项（否则人另外勾的永远报不出来）。
-               *
-               * ⚠ 差集只说明「这一处安装现在给不了」，不等于「人没批」——同一个 App 装多处时
-               * 批准是逐处的（见 `otherInstallations`）。界面别把这层推断说死。
+               * ⚠ 保留只为**兼容老前端**（新卡片不再读它）：新口径不分「已授权 / 申请中」，
+               * 见 `detected`。这一格哪天确认没有旧客户端在读了就可以删。
                */
               awaitingApproval: requestedAll.filter((r) => !grantedKeys.has(r.key)).map((r) => r.key),
+              /**
+               * **检测到的全部权限**（App 申请的 ∪ 真拿得到的），英文原名 + 级别，按名排序。
+               * 界面就照这一份平铺成一排 chip，不分组、不计数、不解释审批状态。
+               */
+              detected: [.../* @__PURE__ */ new Set([...requestedAll.map((r) => r.key), ...grantedKeys])].sort((a, b2) => a.localeCompare(b2)).map((key) => ({
+                key,
+                // 真给的级别优先；只在 App 侧见过的才回落成它申请的级别。
+                level: String(effective[key] ?? meta.permissions[key] ?? "")
+              })),
               /**
                * agent **真正拿得到**的全部权限（优先读 token 自己的权限位），一律用 GitHub 的英文原名 + 级别
                * （2026-09-10 发起人：「所有权限都用英文原文，不区分是不是八项权限」）。
@@ -207661,7 +207731,7 @@ ${composed}`;
     }
   };
 }
-var http, import_node_crypto37, githubAppPending, defaultResolveActor, enc, CHAT_OUTPUT_LIMIT, STREAMING_PATHS, PLANNER_BLOCKING_CODES, WILL_VERBS, GOVERNANCE_COMMANDS, READ_ONLY_COMMANDS, isAgent, isHuman;
+var http, import_node_crypto37, githubAppPending, connectorAuthSnapshots, CONNECTOR_AUTH_SNAPSHOT_TTL_MS, defaultResolveActor, enc, CHAT_OUTPUT_LIMIT, STREAMING_PATHS, PLANNER_BLOCKING_CODES, WILL_VERBS, GOVERNANCE_COMMANDS, READ_ONLY_COMMANDS, isAgent, isHuman;
 var init_server3 = __esm({
   "../server/src/server.ts"() {
     "use strict";
@@ -207719,6 +207789,8 @@ var init_server3 = __esm({
     init_src8();
     init_continuation();
     githubAppPending = new PendingAppCreations();
+    connectorAuthSnapshots = /* @__PURE__ */ new Map();
+    CONNECTOR_AUTH_SNAPSHOT_TTL_MS = 30 * 60 * 1e3;
     defaultResolveActor = (token) => token.startsWith("token:") ? token.slice("token:".length) : null;
     enc = (s2) => new TextEncoder().encode(s2);
     CHAT_OUTPUT_LIMIT = 16e3;
@@ -219564,6 +219636,46 @@ ${input.description}
       listActorConnectorConnections(actorId) {
         return this.opts.store.listActorConnectorConnections(actorId);
       }
+      /**
+       * 授权流程**开始前**给这名员工在这个连接器下的全部个人变量拍一张快照（原样密文，不解密）。
+       *
+       * 为什么需要它（2026-09-10 发起人：「如果本身已经有连接器身份，如果重新连接没走完，
+       * 则保留原身份不覆盖，之前重连到一半把原来的身份覆盖了」）：
+       * 「重新连接」是**边走边落库**的——飞书在「创建应用」那一步就把 `FEISHU_APP_ID` /
+       * `FEISHU_APP_SECRET` 覆盖掉了，GitHub 在 manifest 回调那一步就把 `GITHUB_APP_*` 覆盖掉了，
+       * 而这两步都在「用户完成授权」**之前**。人中途关掉弹窗，旧身份就已经没了。
+       *
+       * 前端此前的回滚只删「这次新增的键」（基线差集），**对已存在的键无能为力**——它拿不到旧值
+       * （读侧永远只给掩码）。所以快照必须在服务端拍、也在服务端写回。
+       */
+      async snapshotActorConnectorVars(actorId, connectorId) {
+        const rows = await this.opts.store.listVariables(actorId);
+        return rows.filter((v2) => v2.scope === "personal" && v2.actorId === actorId && v2.connectorId === connectorId);
+      }
+      /**
+       * 把快照原样写回：**快照里有的恢复旧值，快照之后新冒出来的键删掉**。
+       *
+       * 密文原样搬运，不经解密再加密——少一次明文落到内存里，也不受密钥轮换影响。
+       * 返回改了几行，调用方好把「回滚做了什么」如实说出来（回滚静默是上一版的毛病）。
+       */
+      async restoreActorConnectorVars(actorId, connectorId, snapshot) {
+        const keep = new Map(snapshot.map((r) => [r.key, r]));
+        const now = await this.snapshotActorConnectorVars(actorId, connectorId);
+        let removed = 0;
+        for (const row of now) {
+          if (keep.has(row.key)) continue;
+          await this.deleteVariable(row.key, actorId);
+          removed += 1;
+        }
+        let restored = 0;
+        for (const row of keep.values()) {
+          const current = now.find((r) => r.key === row.key);
+          if (current && current.valueEncrypted === row.valueEncrypted) continue;
+          await this.opts.store.putVariable({ ...row, updatedAt: this.now() });
+          restored += 1;
+        }
+        return { restored, removed };
+      }
       /**
        * 员工连接器面板所需状态：连接记录 + 组织级已连接集合 + 该员工已授权（有个人 connector 变量）集合。
        * 前端据此算每个 connector 的 hasRecord / 有效 enabled / connected（actor 或 global）。
@@ -271244,7 +271356,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.12" : "dev";
+var PKG_VERSION = true ? "2.2.13" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "oasis_test_v2",
-  "version": "2.2.12",
+  "version": "2.2.13",
   "description": "Oasis node daemon + CLI — background daemon, auto-start, full server CLI",
   "bin": {
     "oasis": "./dist/index.js"
@@ -26,6 +26,6 @@
     "node": ">=20"
   },
   "oasisRelease": {
-    "sourceHead": "ae18ecf5995f37b7a3f14b601e3a87c21d91ab03"
+    "sourceHead": "b907ec1d1a0ae4a57e7eb938c477f05323b84590"
   }
 }