publishport-opencli 1.8.4-pp.1

package/clis/sinablog/utils.js

@@ -0,0 +1,186 @@
+import { clamp } from '../_shared/common.js';
+const clampLimit = (limit) => clamp(limit || 20, 1, 50);
+export function buildSinaBlogSearchUrl(keyword) {
+    return `https://search.sina.com.cn/search?q=${encodeURIComponent(keyword)}&tp=mix`;
+}
+export function buildSinaBlogUserUrl(uid) {
+    return `https://blog.sina.com.cn/s/articlelist_${encodeURIComponent(uid)}_0_1.html`;
+}
+export async function loadSinaBlogArticle(page, url) {
+    await page.goto(url);
+    await page.wait({ selector: 'h1', timeout: 3 });
+    return page.evaluate(`
+    (async () => {
+      await new Promise((resolve) => setTimeout(resolve, 1500));
+      const normalize = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+      const title = normalize(document.querySelector('.articalTitle h2, .title h2, h1, h2.titName')?.textContent);
+      const titleParts = normalize(document.title).split('_').map((part) => normalize(part)).filter(Boolean);
+      const author = titleParts[1] || title.split(/[：:]/)[0] || '';
+      const timeText = normalize(document.querySelector('.time, .articalInfo .time')?.textContent).replace(/[()]/g, '');
+      const date = timeText || normalize(document.body.innerText.match(/\\b\\d{4}-\\d{2}-\\d{2}(?:\\s+\\d{2}:\\d{2}:\\d{2})?\\b/)?.[0]);
+      const category = normalize(document.querySelector('.articalTag .blog_class a, .blog_class a')?.textContent);
+      const tags = Array.from(document.querySelectorAll('.blog_tag h3, .blog_tag a, .tag a, .artical_tag a'))
+        .map((node) => normalize(node.textContent))
+        .filter(Boolean);
+      const content = normalize(document.querySelector('.articalContent, .blog_content, .content, #sina_keyword_ad_area2')?.textContent).slice(0, 500);
+      const images = Array.from(document.querySelectorAll('.articalContent img, .blog_content img, .content img'))
+        .map((img) => img.getAttribute('src') || img.getAttribute('real_src') || '')
+        .filter((src) => src && !src.includes('icon'))
+        .slice(0, 5);
+      return {
+        title,
+        author,
+        date,
+        category,
+        tags: tags.join(', '),
+        readCount: '',
+        commentCount: '',
+        content: content + (content.length >= 500 ? '...' : ''),
+        images: images.join(', '),
+        url: ${JSON.stringify(url)},
+      };
+    })()
+  `);
+}
+export async function loadSinaBlogHot(page, limit) {
+    const safeLimit = clampLimit(limit);
+    await page.goto('https://blog.sina.com.cn/');
+    await page.wait({ selector: 'h1', timeout: 3 });
+    const data = await page.evaluate(`
+    (async () => {
+      await new Promise((resolve) => setTimeout(resolve, 1500));
+      const normalize = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+      const limit = ${safeLimit};
+      const abs = (href) => {
+        if (!href) return '';
+        if (href.startsWith('//')) return 'https:' + href;
+        if (href.startsWith('http')) return href;
+        return 'https://blog.sina.com.cn' + (href.startsWith('/') ? '' : '/') + href;
+      };
+      const parseArticle = (doc, fallback) => {
+        const title = normalize(doc.querySelector('.articalTitle h2, .title h2, h1, h2.titName')?.textContent) || fallback.title;
+        const titleParts = normalize(doc.title).split('_').map((part) => normalize(part)).filter(Boolean);
+        const timeText = normalize(doc.querySelector('.time, .articalInfo .time')?.textContent).replace(/[()]/g, '');
+        const articleId = fallback.url.match(/blog_([a-zA-Z0-9]+)\\.html/)?.[1] || '';
+        return {
+          articleId,
+          title,
+          author: titleParts[1] || title.split(/[：:]/)[0] || '',
+          date: timeText || '',
+          readCount: '',
+          description: normalize(doc.querySelector('.articalContent, .blog_content, .content, #sina_keyword_ad_area2')?.textContent).slice(0, 150),
+        };
+      };
+
+      const seeds = [];
+      const seen = new Set();
+      for (const link of Array.from(document.querySelectorAll('.day-hot-rank .art-list a[href*="/s/blog_"], .hot-rank .art-list a[href*="/s/blog_"]'))) {
+        const title = normalize(link.textContent);
+        const url = abs(link.getAttribute('href') || '');
+        if (!title || !url || seen.has(url)) continue;
+        seen.add(url);
+        seeds.push({ rank: seeds.length + 1, title, url });
+        if (seeds.length >= limit) break;
+      }
+
+      const results = [];
+      for (const item of seeds) {
+        let merged = {
+          rank: item.rank,
+          articleId: item.url.match(/blog_([a-zA-Z0-9]+)\\.html/)?.[1] || '',
+          title: item.title,
+          author: '',
+          date: '',
+          readCount: '',
+          description: '',
+          url: item.url,
+        };
+        try {
+          const resp = await fetch(item.url, { credentials: 'include' });
+          if (resp.ok) {
+            const html = await resp.text();
+            const doc = new DOMParser().parseFromString(html, 'text/html');
+            merged = Object.assign(merged, parseArticle(doc, item));
+          }
+        } catch {}
+        results.push(merged);
+      }
+      return results;
+    })()
+  `);
+    return Array.isArray(data) ? data : [];
+}
+export async function loadSinaBlogSearch(page, keyword, limit) {
+    const safeLimit = clampLimit(limit);
+    await page.goto(buildSinaBlogSearchUrl(keyword));
+    await page.wait({ selector: '.result-item', timeout: 5 });
+    const data = await page.evaluate(`
+    (async () => {
+      const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+      for (let i = 0; i < 20; i += 1) {
+        if (document.querySelector('.result-item')) break;
+        await sleep(500);
+      }
+      const normalize = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+      const limit = ${safeLimit};
+      const items = Array.from(document.querySelectorAll('.result-item'));
+      const results = [];
+      for (const item of items) {
+        const link = item.querySelector('.result-title a[href*="blog.sina.com.cn/s/blog_"]');
+        const title = normalize(link?.textContent);
+        const url = link?.getAttribute('href') || '';
+        if (!title || !url) continue;
+        results.push({
+          rank: results.length + 1,
+          title,
+          author: normalize(item.querySelector('.result-meta .source')?.textContent),
+          date: normalize(item.querySelector('.result-meta .time')?.textContent),
+          description: normalize(item.querySelector('.result-intro')?.textContent).slice(0, 150),
+          url,
+        });
+        if (results.length >= limit) break;
+      }
+      return results;
+    })()
+  `);
+    return Array.isArray(data) ? data : [];
+}
+export async function loadSinaBlogUser(page, uid, limit) {
+    const safeLimit = clampLimit(limit);
+    await page.goto(buildSinaBlogUserUrl(uid));
+    await page.wait({ selector: 'h1', timeout: 3 });
+    const data = await page.evaluate(`
+    (async () => {
+      await new Promise((resolve) => setTimeout(resolve, 1000));
+      const normalize = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+      const limit = ${safeLimit};
+      const author = normalize(document.title).split('_').map((part) => normalize(part)).filter(Boolean)[1] || '';
+      const abs = (href) => {
+        if (!href) return '';
+        if (href.startsWith('//')) return 'https:' + href;
+        if (href.startsWith('http')) return href;
+        return 'https://blog.sina.com.cn' + (href.startsWith('/') ? '' : '/') + href;
+      };
+      const results = [];
+      for (const item of Array.from(document.querySelectorAll('.articleList .articleCell'))) {
+        const link = item.querySelector('.atc_title a[href*="/s/blog_"]');
+        const title = normalize(link?.textContent);
+        const url = abs(link?.getAttribute('href') || '');
+        if (!title || !url) continue;
+        results.push({
+          rank: results.length + 1,
+          articleId: url.match(/blog_([a-zA-Z0-9]+)\\.html/)?.[1] || '',
+          title,
+          author,
+          date: normalize(item.querySelector('.atc_tm')?.textContent),
+          readCount: '',
+          description: '',
+          url,
+        });
+        if (results.length >= limit) break;
+      }
+      return results;
+    })()
+  `);
+    return Array.isArray(data) ? data : [];
+}

package/clis/sinafinance/news.js

@@ -0,0 +1,62 @@
+/**
+ * Sina Finance 7x24 live news feed.
+ *
+ * Uses the public CJ API — no key or browser required.
+ * https://app.cj.sina.com.cn/api/news/pc
+ */
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { CliError } from '@jackwener/opencli/errors';
+// User-facing type (0-9) → Sina API tag ID
+const TYPE_MAP = [
+    0, // 0: 全部
+    10, // 1: A股
+    1, // 2: 宏观
+    3, // 3: 公司
+    4, // 4: 数据
+    5, // 5: 市场
+    102, // 6: 国际
+    6, // 7: 观点
+    6, // 8: 央行
+    8, // 9: 其它
+];
+function stripHtml(html) {
+    return html.replace(/<[^>]+>/g, '').trim();
+}
+cli({
+    site: 'sinafinance',
+    name: 'news',
+    access: 'read',
+    description: '新浪财经 7x24 小时实时快讯',
+    domain: 'app.cj.sina.com.cn',
+    strategy: Strategy.PUBLIC,
+    browser: false,
+    args: [
+        { name: 'limit', type: 'int', default: 20, help: 'Max results (max 50)' },
+        { name: 'type', type: 'int', default: 0, help: 'News type: 0=全部 1=A股 2=宏观 3=公司 4=数据 5=市场 6=国际 7=观点 8=央行 9=其它' },
+    ],
+    columns: ['id', 'time', 'content', 'views'],
+    func: async (args) => {
+        const limit = Math.max(1, Math.min(Number(args.limit), 50));
+        const apiTag = TYPE_MAP[args.type] ?? 0;
+        const params = new URLSearchParams({
+            page: '1',
+            size: String(limit),
+            tag: String(apiTag),
+        });
+        const res = await fetch(`https://app.cj.sina.com.cn/api/news/pc?${params}`);
+        if (!res.ok) {
+            throw new CliError('FETCH_ERROR', `Sina Finance API HTTP ${res.status}`, 'Check your network connection');
+        }
+        const json = await res.json();
+        const list = json?.result?.data?.feed?.list ?? [];
+        if (!list.length) {
+            throw new CliError('NOT_FOUND', 'No news found', 'Try a different type or increase limit');
+        }
+        return list.map((item) => ({
+            id: item.id ?? '',
+            time: item.create_time ?? '',
+            content: stripHtml(item.rich_text ?? ''),
+            views: item.view_num ?? 0,
+        }));
+    },
+});

package/clis/sinafinance/rolling-news.js

@@ -0,0 +1,41 @@
+/**
+ * Sinafinance rolling news feed
+ */
+import { cli, Strategy } from '@jackwener/opencli/registry';
+cli({
+    site: 'sinafinance',
+    name: 'rolling-news',
+    access: 'read',
+    description: '新浪财经滚动新闻',
+    domain: 'finance.sina.com.cn/roll',
+    strategy: Strategy.COOKIE,
+    args: [],
+    columns: ['column', 'title', 'date', 'url'],
+    func: async (page, _args) => {
+        await page.goto(`https://finance.sina.com.cn/roll/#pageid=384&lid=2519`);
+        await page.wait({ selector: '.d_list_txt li', timeout: 10000 });
+        const payload = await page.evaluate(`
+      (() => {
+        const cleanText = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+        const results = [];
+        document.querySelectorAll('.d_list_txt li').forEach(el => {
+          const titleEl = el.querySelector('.c_tit a');
+          const columnEl = el.querySelector('.c_chl');
+          const dateEl = el.querySelector('.c_time');
+          const url = titleEl?.getAttribute('href') || '';
+          if (!url) return;
+          results.push({
+            title: cleanText(titleEl?.textContent || ''),
+            column: cleanText(columnEl?.textContent || ''),
+            date: cleanText(dateEl?.textContent || ''),
+            url: url,
+          });
+        });
+        return results;
+      })()
+    `);
+        if (!Array.isArray(payload))
+            return [];
+        return payload;
+    },
+});

package/clis/sinafinance/stock-rank.js

@@ -0,0 +1,66 @@
+/**
+ * Sinafinance stock rank
+ */
+import { cli, Strategy } from '@jackwener/opencli/registry';
+cli({
+    site: 'sinafinance',
+    name: 'stock-rank',
+    access: 'read',
+    description: '新浪财经热搜榜',
+    domain: 'finance.sina.cn',
+    strategy: Strategy.COOKIE,
+    navigateBefore: false,
+    args: [
+        { name: 'market', type: 'string', default: 'cn', choices: ['cn', 'hk', 'us', 'wh', 'ft'], help: 'Market: cn (A股), hk (港股), us (美股), wh (外汇), ft (期货)' },
+    ],
+    columns: ['rank', 'name', 'symbol', 'market', 'price', 'change', 'url'],
+    func: async (page, _args) => {
+        const market = _args.market || 'cn';
+        await page.goto('https://finance.sina.cn/');
+        await page.wait({ selector: '#actionSearch', timeout: 10000 });
+        const payload = await page.evaluate(`
+      (async () => {
+        const wait = (ms) => new Promise(r => setTimeout(r, ms));
+        const cleanText = (value) => (value || '').replace(/\\s+/g, ' ').trim();
+        const marketType = ${JSON.stringify(market)};
+
+        const searchBtn = document.querySelector('#actionSearch');
+        if (searchBtn) {
+          searchBtn.dispatchEvent(new Event('tap', { bubbles: true }));
+          await wait(3000);
+        }
+
+        const tabEl = document.querySelector('[data-type="' + marketType + '"]');
+        const marketName = tabEl?.textContent || marketType;
+        if (marketType !== 'cn' && tabEl) {
+          tabEl.click();
+          await wait(2000);
+        }
+
+        const results = [];
+        document.querySelectorAll('#stock-list .j-stock-row').forEach(el => {
+          const rankEl = el.querySelector('.rank');
+          const nameEl = el.querySelector('.j-sname');
+          const codeEl = el.querySelector('.stock-code');
+          const priceEl = el.querySelector('.j-price');
+          const changeEl = el.querySelector('.j-change');
+          const openUrl = el.getAttribute('open-url') || '';
+          const fullUrl = openUrl ? 'https:' + openUrl : '';
+          results.push({
+            rank: cleanText(rankEl?.textContent || ''),
+            name: cleanText(nameEl?.textContent || ''),
+            symbol: cleanText(codeEl?.textContent || ''),
+            market: cleanText(marketName),
+            price: cleanText(priceEl?.textContent || ''),
+            change: cleanText(changeEl?.textContent || ''),
+            url: fullUrl,
+          });
+        });
+        return results;
+      })()
+    `);
+        if (!Array.isArray(payload))
+            return [];
+        return payload;
+    },
+});

package/clis/sinafinance/stock.js

@@ -0,0 +1,121 @@
+/**
+ * Sinafinance stock quote — A股 / 港股 / 美股
+ *
+ * Uses two public Sina APIs (no browser required):
+ *   suggest3.sinajs.cn  — symbol search
+ *   hq.sinajs.cn        — real-time quote
+ */
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { CliError } from '@jackwener/opencli/errors';
+const MARKET_CN = '11';
+const MARKET_HK = '31';
+const MARKET_US = '41';
+async function fetchGBK(url) {
+    const res = await fetch(url, { headers: { Referer: 'https://finance.sina.com.cn' } });
+    if (!res.ok)
+        throw new CliError('FETCH_ERROR', `Sina API HTTP ${res.status}`, 'Check your network');
+    const buf = await res.arrayBuffer();
+    return new TextDecoder('gbk').decode(buf);
+}
+function parseSuggest(raw, markets) {
+    const m = raw.match(/suggestvalue="(.*)"/s);
+    if (!m)
+        return [];
+    return m[1].split(';').filter(Boolean).map(s => {
+        const p = s.split(',');
+        return { name: p[4] || p[0] || '', market: p[1] || '', symbol: p[3] || '' };
+    }).filter(e => markets.includes(e.market));
+}
+function hqSymbol(e) {
+    if (e.market === MARKET_HK)
+        return `hk${e.symbol}`;
+    if (e.market === MARKET_US)
+        return `gb_${e.symbol}`;
+    return e.symbol; // A股: already "sh600519" / "sz300XXX"
+}
+function parseHq(raw, sym) {
+    const escaped = sym.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const m = raw.match(new RegExp(`hq_str_${escaped}="([^"]*)"`));
+    return m ? m[1].split(',') : [];
+}
+function fmtMktCap(val) {
+    const n = parseFloat(val);
+    if (!n)
+        return '';
+    if (n >= 1e12)
+        return (n / 1e12).toFixed(2) + 'T';
+    if (n >= 1e9)
+        return (n / 1e9).toFixed(2) + 'B';
+    if (n >= 1e6)
+        return (n / 1e6).toFixed(2) + 'M';
+    return String(n);
+}
+cli({
+    site: 'sinafinance',
+    name: 'stock',
+    access: 'read',
+    description: '新浪财经行情（A股/港股/美股）',
+    domain: 'suggest3.sinajs.cn,hq.sinajs.cn',
+    strategy: Strategy.PUBLIC,
+    browser: false,
+    args: [
+        { name: 'key', type: 'string', required: true, positional: true, help: 'Stock name or code (e.g. 贵州茅台, 腾讯控股, AAPL)' },
+        { name: 'market', type: 'string', default: 'auto', help: 'Market: cn, hk, us, auto (default: auto searches cn → hk → us)' },
+    ],
+    columns: ['Symbol', 'Name', 'Price', 'Change', 'ChangePercent', 'Open', 'High', 'Low', 'Volume', 'MarketCap'],
+    func: async (args) => {
+        const key = String(args.key);
+        const market = String(args.market);
+        const marketMap = {
+            cn: [MARKET_CN], hk: [MARKET_HK], us: [MARKET_US],
+            auto: [MARKET_CN, MARKET_HK, MARKET_US],
+        };
+        const targetMarkets = marketMap[market];
+        if (!targetMarkets) {
+            throw new CliError('INPUT_ERROR', `Invalid market: "${market}"`, 'Expected cn, hk, us, or auto');
+        }
+        // 1. Search symbol — only request the markets we care about
+        const suggestRaw = await fetchGBK(`https://suggest3.sinajs.cn/suggest/type=${targetMarkets.join(',')}&key=${encodeURIComponent(key)}`);
+        const entries = parseSuggest(suggestRaw, targetMarkets);
+        if (!entries.length) {
+            throw new CliError('NOT_FOUND', `No stock found for "${key}"`, 'Try a different name, code, or --market');
+        }
+        // Pick best match: score by name/symbol similarity, tiebreak by market priority
+        const needle = key.toLowerCase();
+        const score = (e) => {
+            const n = e.name.toLowerCase();
+            const s = e.symbol.toLowerCase();
+            if (s === needle || n === needle)
+                return 1;
+            if (s.includes(needle))
+                return needle.length / s.length;
+            if (n.includes(needle))
+                return needle.length / n.length;
+            return 0;
+        };
+        const best = entries.sort((a, b) => {
+            const d = score(b) - score(a);
+            return d !== 0 ? d : targetMarkets.indexOf(a.market) - targetMarkets.indexOf(b.market);
+        })[0];
+        // 2. Fetch quote
+        const sym = hqSymbol(best);
+        const hqRaw = await fetchGBK(`https://hq.sinajs.cn/list=${sym}`);
+        const f = parseHq(hqRaw, sym);
+        if (f.length < 2 || !f[0]) {
+            throw new CliError('NOT_FOUND', `No quote data for "${key}"`, 'Market may be closed or data unavailable');
+        }
+        if (best.market === MARKET_CN) {
+            const price = parseFloat(f[3]);
+            const prev = parseFloat(f[2]);
+            const chg = (price - prev).toFixed(2);
+            const chgPct = ((price - prev) / prev * 100).toFixed(2) + '%';
+            return [{ Symbol: sym.toUpperCase(), Name: f[0], Price: f[3], Change: chg, ChangePercent: chgPct, Open: f[1], High: f[4], Low: f[5], Volume: f[8], MarketCap: '' }];
+        }
+        if (best.market === MARKET_HK) {
+            // [2]=price [4]=high [5]=low [6]=open [7]=change [8]=change% [11]=volume
+            return [{ Symbol: best.symbol, Name: f[1], Price: f[2], Change: f[7], ChangePercent: f[8] + '%', Open: f[6], High: f[4], Low: f[5], Volume: f[11], MarketCap: '' }];
+        }
+        // MARKET_US: [1]=price [2]=change% [4]=change [6]=open [7]=today_low [8]=52wH [9]=52wL [10]=volume [12]=mktcap
+        return [{ Symbol: best.symbol.toUpperCase(), Name: f[0], Price: f[1], Change: f[4], ChangePercent: f[2] + '%', Open: f[6], High: f[8], Low: f[9], Volume: f[10], MarketCap: fmtMktCap(f[12]) }];
+    },
+});

package/clis/sinafinance/stock.test.js

@@ -0,0 +1,59 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { getRegistry } from '@jackwener/opencli/registry';
+import './stock.js';
+
+function textResponse(body) {
+    return {
+        ok: true,
+        arrayBuffer: async () => Buffer.from(body, 'utf8'),
+    };
+}
+
+describe('sinafinance stock command', () => {
+    beforeEach(() => {
+        vi.restoreAllMocks();
+        vi.stubGlobal('TextDecoder', class {
+            decode(buf) {
+                return Buffer.from(buf).toString('utf8');
+            }
+        });
+    });
+
+    it('prefers exact symbol match over partial symbol and name misses', async () => {
+        const cmd = getRegistry().get('sinafinance/stock');
+        expect(cmd?.func).toBeTypeOf('function');
+
+        const fetchMock = vi.fn()
+            .mockResolvedValueOnce(textResponse('var suggestvalue="x,41,,AAPL,苹果;x,41,,AAPLU,Apple Units";'))
+            .mockResolvedValueOnce(textResponse('var hq_str_gb_AAPL="Apple Inc,189.98,1.23,0,1.56,0,188.50,180.00,195.00,175.00,1200000,0,3000000000000";'));
+        vi.stubGlobal('fetch', fetchMock);
+
+        const result = await cmd.func({ key: 'AAPL', market: 'auto' });
+
+        expect(fetchMock).toHaveBeenNthCalledWith(1, 'https://suggest3.sinajs.cn/suggest/type=11,31,41&key=AAPL', expect.any(Object));
+        expect(fetchMock).toHaveBeenNthCalledWith(2, 'https://hq.sinajs.cn/list=gb_AAPL', expect.any(Object));
+        expect(result[0]).toMatchObject({
+            Symbol: 'AAPL',
+            Name: 'Apple Inc',
+            Price: '189.98',
+        });
+    });
+
+    it('still matches by display name when the query targets the company name', async () => {
+        const cmd = getRegistry().get('sinafinance/stock');
+        expect(cmd?.func).toBeTypeOf('function');
+
+        const fetchMock = vi.fn()
+            .mockResolvedValueOnce(textResponse('var suggestvalue="x,41,,AAPL,苹果;x,41,,AAPLU,Apple Units";'))
+            .mockResolvedValueOnce(textResponse('var hq_str_gb_AAPL="苹果公司,189.98,1.23,0,1.56,0,188.50,180.00,195.00,175.00,1200000,0,3000000000000";'));
+        vi.stubGlobal('fetch', fetchMock);
+
+        const result = await cmd.func({ key: '苹果', market: 'auto' });
+
+        expect(fetchMock).toHaveBeenNthCalledWith(2, 'https://hq.sinajs.cn/list=gb_AAPL', expect.any(Object));
+        expect(result[0]).toMatchObject({
+            Symbol: 'AAPL',
+            Name: '苹果公司',
+        });
+    });
+});

package/clis/slock/api-base-canary.test.js

@@ -0,0 +1,62 @@
+// api-base-canary.test.js
+//
+// Origin drift catch: slock is split-origin (token at app.slock.ai, API at
+// api.slock.ai). Every fetch in clis/slock MUST go through SLOCK_API_BASE
+// — a hardcoded '/api/...' literal would silently land on the SPA host
+// (app.slock.ai/api/...) instead of the API host, producing the exact
+// AUTH_REQUIRED / HTML-instead-of-JSON / "identity empty" symptoms we just
+// spent hours diagnosing.
+//
+// This canary greps every slock command source file (excluding shared.js,
+// where SLOCK_API_BASE itself is defined, and the comments) for any string
+// literal that starts with '/api/' or "/api/". If anything matches, a future
+// command leaked a hardcoded path and must be re-routed through
+// SLOCK_API_BASE.
+
+import { describe, it, expect } from 'vitest';
+import { readdirSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+
+const DIR = path.dirname(fileURLToPath(import.meta.url));
+
+describe('slock SLOCK_API_BASE canary', () => {
+  it('no clis/slock/*.js file contains a hardcoded "/api/..." string literal (must use SLOCK_API_BASE)', () => {
+    const files = readdirSync(DIR)
+      .filter((f) => f.endsWith('.js') && !f.endsWith('.test.js'));
+
+    const offenders = [];
+    for (const f of files) {
+      // shared.js is the single source of truth — its constant value contains
+      // '/api' as the trailing path of the absolute URL, and its comment
+      // explicitly references the literal we are forbidding elsewhere.
+      if (f === 'shared.js') continue;
+      const src = readFileSync(path.join(DIR, f), 'utf8');
+
+      // Strip line and block comments so a comment that mentions '/api/'
+      // doesn't trip the canary. Test code, drift docs and other strings
+      // intentionally talking about '/api/' belong in comments / *.test.js.
+      const noComments = src
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .replace(/\/\/.*$/gm, '');
+
+      // Forbidden pattern: a string literal whose first chars are '/api/'.
+      // Cover single-quote, double-quote, AND backtick forms — a future
+      // refactor that pastes `\`/api/foo\`` (template literal) would slip
+      // past a char class missing the backtick.
+      const hits = (noComments.match(/(['"`])\/api\//g) || []);
+      if (hits.length) offenders.push(`${f} (${hits.length} hardcoded '/api/...' literal${hits.length === 1 ? '' : 's'})`);
+    }
+
+    expect(offenders).toEqual([]);
+  });
+
+  it('SLOCK_API_BASE is the absolute prod URL — never a relative "/api"', async () => {
+    const { SLOCK_API_BASE } = await import('./shared.js');
+    // Must start with https:// so fetches inside page.evaluate (which runs
+    // on app.slock.ai) actually hit the API host instead of the SPA.
+    expect(SLOCK_API_BASE.startsWith('https://')).toBe(true);
+    // And end in /api so concatenation with '/messages' etc gives the right path.
+    expect(SLOCK_API_BASE.endsWith('/api')).toBe(true);
+  });
+});

package/clis/slock/attachment-download.js

@@ -0,0 +1,72 @@
+// attachment-download.js
+// Save an attachment's bytes to a local file. Two-step to dodge CORS:
+//
+//   1. In page: GET /api/attachments/:id/url → { url, expiresAt }
+//      (server-scoped, header auth, JSON response — no CDN cross-origin yet.)
+//   2. In Node: fetch that signed CDN URL directly and stream to disk.
+//
+// Why not `GET /api/attachments/:id` which 302s to the CDN? Because the page
+// fetch may not follow that redirect cross-origin (CORS pre-flight on the CDN
+// host depends on its config). Going Node-side after the page hands us the
+// URL sidesteps CORS entirely — fetch in Node has no Origin to enforce.
+//
+// We keep auth strictly in the page step (where the Slock session cookie is)
+// and use no auth on the Node fetch because the URL is pre-signed (Bugen).
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { cli, Strategy } from '@jackwener/opencli/registry';
+import { ArgumentError, CommandExecutionError } from '@jackwener/opencli/errors';
+import { buildFetchSnippet } from './in-page.js';
+import { dispatchEvaluateResult } from './errors.js';
+import { SLOCK_SITE, SLOCK_DOMAIN, SLOCK_HOME_URL } from './shared.js';
+import { UUID_RE } from './resolve.js';
+
+cli({
+  site: SLOCK_SITE,
+  name: 'attachment-download',
+  access: 'read',
+  description: 'Download an attachment to a local file. Resolves a signed CDN URL in the page, then fetches bytes node-side (no CORS).',
+  domain: SLOCK_DOMAIN,
+  strategy: Strategy.COOKIE,
+  browser: true,
+  siteSession: 'persistent',
+  args: [
+    { name: 'attachmentId', positional: true, required: true, help: 'Attachment UUID' },
+    { name: 'out', help: 'Local path to write to. Defaults to ./<attachmentId>.bin' },
+    { name: 'server', help: 'Override active server slug' },
+  ],
+  columns: ['attachmentId', 'out', 'sizeBytes'],
+  func: async (page, kwargs) => {
+    const id = String(kwargs.attachmentId ?? '').trim();
+    if (!UUID_RE.test(id)) throw new ArgumentError(`attachmentId "${id}" is not a UUID`);
+    const out = path.resolve(String(kwargs.out ?? `./${id}.bin`));
+
+    // Step 1 — in-page, resolve the signed URL with the user's Slock session.
+    await page.goto(SLOCK_HOME_URL);
+    const snippet = buildFetchSnippet({
+      method: 'GET',
+      path: `/attachments/${encodeURIComponent(id)}/url`,
+      serverScoped: true,
+      serverIdOverride: kwargs.server,
+    });
+    const result = await page.evaluate(`(async () => { ${snippet} })()`);
+    const rows = dispatchEvaluateResult(result);
+    const data = Array.isArray(rows) ? rows[0] : rows;
+    const url = data?.url;
+    if (!url) throw new CommandExecutionError(`no signed url returned for attachment ${id}`);
+
+    // Step 2 — Node side, fetch the bytes from the signed CDN URL. No auth
+    // header (URL is pre-signed); no Origin (Node fetch has none) so CORS
+    // isn't in play.
+    let res;
+    try { res = await fetch(url); }
+    catch (e) { throw new CommandExecutionError(`network error fetching signed URL: ${e.message}`); }
+    if (!res.ok) {
+      throw new CommandExecutionError(`HTTP ${res.status} from signed CDN URL while downloading ${id}`);
+    }
+    const ab = await res.arrayBuffer();
+    fs.writeFileSync(out, Buffer.from(ab));
+    return [{ attachmentId: id, out, sizeBytes: ab.byteLength }];
+  },
+});