specific-ai-cli 0.0.0-stage → 0.1.1

package/dist/platforms/xianyu/web/api.js

@@ -0,0 +1,312 @@
+import { SpecificAIError } from '../../../core/errors.js';
+import { jsonDumps, pyStr, quote } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import {} from './client.js';
+import { API_HEADERS, APP_KEY, H5API, IM_APP_KEY, LOCATION_HEADERS, merge, PASSPORT, PASSPORT_HEADERS, SESSION_HEADERS, TOKEN_HEADERS, UA, UPLOAD_HEADERS, UPLOAD_URL, } from './profile.js';
+import { generateSign } from './sign.js';
+const IM_SPM = { spmCnt: 'a21ybx.im.0.0', spmPre: 'a21ybx.item.want.1.12523da6waCtUp', logId: '12523da6waCtUp' };
+function query(api, t, sign, o) {
+    const q = [
+        ['jsv', '2.7.2'],
+        ['appKey', APP_KEY],
+        ['t', t],
+    ];
+    if (!o.signLast)
+        q.push(['sign', sign]);
+    q.push(['v', o.v ?? '1.0'], ['type', 'originaljson'], ['accountSite', 'xianyu'], ['dataType', 'json'], ['timeout', '20000'], ['api', api], ['sessionOption', 'AutoLoginOnly'], ['spm_cnt', o.spmCnt], ['spm_pre', o.spmPre], ['log_id', o.logId]);
+    if (o.signLast)
+        q.push(['sign', sign]);
+    return q;
+}
+/** 签名的 mtop POST：`t` 是秒数乘 1000（上游 `str(int(time.time()) * 1000)`），表单只有一个 data 字段。 */
+function signed(x, api, dataVal, headers, o) {
+    return x.mtop((token) => {
+        const t = String(rand.nowSeconds() * 1000);
+        return {
+            method: 'POST',
+            url: `${H5API}/${api}/${o.v ?? '1.0'}/`,
+            query: query(api, t, generateSign(t, token, dataVal), o),
+            headers,
+            form: [['data', dataVal]],
+        };
+    });
+}
+// ================================================================ XianyuApis
+/** 私信的 accessToken（上游 get_token）。 */
+export function getToken(x) {
+    const dataVal = '{"appKey":"' + IM_APP_KEY + '","deviceId":"' + x.deviceId + '"}';
+    return signed(x, 'mtop.taobao.idlemessage.pc.login.token', dataVal, TOKEN_HEADERS, {
+        spmCnt: 'a21ybx.im.0.0',
+        spmPre: 'a21ybx.item.want.1.14ad3da6ALVq3n',
+        logId: '14ad3da6ALVq3n',
+    });
+}
+/** 当前登录用户，同时续期 cookie（上游 refresh_token，常驻进程每 10 分钟调一次）。 */
+export function refreshToken(x) {
+    return signed(x, 'mtop.taobao.idlemessage.pc.loginuser.get', '{}', API_HEADERS, { ...IM_SPM, signLast: true });
+}
+/**
+ * 商品详情（上游 get_item_info）。上游这个请求本身不带请求头，只有 session 上的 User-Agent
+ * （扫码登录、游客的 session 来自 build_initial_cookies）。实测游客带上 Origin / Referer / sec-ch-ua
+ * 这组浏览器头反而会被风控（RGV587），照上游只发 UA。
+ */
+export function itemInfo(x, itemId) {
+    return signed(x, 'mtop.taobao.idle.pc.detail', '{"itemId":"' + itemId + '"}', SESSION_HEADERS, IM_SPM);
+}
+function imageInfo(image) {
+    return {
+        extraInfo: { isH: 'false', isT: 'false', raw: 'false' },
+        isQrCode: false,
+        url: image.url,
+        heightSize: image.height,
+        widthSize: image.width,
+        major: true,
+        type: 0,
+        status: 'done',
+    };
+}
+/** 按标题和图片推荐类目与属性（上游 get_public_channel）。 */
+export function publicChannel(x, title, images) {
+    const data = {
+        title,
+        lockCpv: false,
+        multiSKU: false,
+        publishScene: 'mainPublish',
+        scene: 'newPublishChoice',
+        description: title,
+        imageInfos: images.map(imageInfo),
+        uniqueCode: '1775905618164677',
+    };
+    return signed(x, 'mtop.taobao.idle.kgraph.property.recommend', jsonDumps(data, { separators: [',', ':'] }), API_HEADERS, {
+        v: '2.0',
+        spmCnt: 'a21ybx.publish.0.0',
+        spmPre: 'a21ybx.item.sidebar.1.67321598K9Vgx8',
+        logId: '67321598K9Vgx8',
+    });
+}
+/** 发布地址：上游写死了一个坐标，取返回的第一个常用地址（上游 get_default_location）。 */
+export function defaultLocation(x) {
+    return signed(x, 'mtop.taobao.idle.local.poi.get', '{"longitude":118.78248347393424,"latitude":31.91629189813543}', LOCATION_HEADERS, {
+        spmCnt: 'a21ybx.publish.0.0',
+        spmPre: 'a21ybx.item.sidebar.1.38262218ame5nr',
+        logId: '38262218ame5nr',
+    });
+}
+/** 上传图片（上游 upload_media）。content type 上游固定写 image/png。 */
+export async function uploadMedia(x, file) {
+    const res = await x.http.json({
+        method: 'POST',
+        url: UPLOAD_URL,
+        query: [
+            ['floderId', '0'],
+            ['appkey', 'xy_chat'],
+            ['_input_charset', 'utf-8'],
+        ],
+        headers: UPLOAD_HEADERS,
+        multipart: [{ name: 'file', filename: file.filename, contentType: 'image/png', data: file.data }],
+    });
+    if (!res?.object?.url)
+        throw new SpecificAIError('UPSTREAM', `上传失败：${res?.message ?? res?.errorMessage ?? '响应里没有 object.url'}`, { detail: res });
+    return res;
+}
+/** 发布闲置（上游 public）：先传图，再按标题推荐类目、取默认地址，最后提交。 */
+export async function publish(x, input) {
+    const data = {
+        freebies: false,
+        itemTypeStr: 'b',
+        quantity: '1',
+        simpleItem: 'true',
+        imageInfoDOList: [],
+        itemTextDTO: { desc: input.desc, title: input.desc, titleDescSeparate: false },
+        itemLabelExtList: [],
+        itemPriceDTO: {},
+        userRightsProtocols: [{ enable: false, serviceCode: 'SKILL_PLAY_NO_MIND' }],
+        itemPostFeeDTO: { canFreeShipping: false, supportFreight: false, onlyTakeSelf: false },
+        itemAddrDTO: {},
+        defaultPrice: false,
+        itemCatDTO: {},
+        uniqueCode: '1775897582791680',
+        sourceId: 'pcMainPublish',
+        bizcode: 'pcMainPublish',
+        publishScene: 'pcMainPublish',
+    };
+    const images = [];
+    for (const file of input.images) {
+        const obj = (await uploadMedia(x, file)).object;
+        const [width, height] = String(obj.pix).split('x').map((s) => Math.trunc(Number(s)));
+        const image = { url: obj.url, height: height, width: width };
+        images.push(image);
+        data.imageInfoDOList.push(imageInfo(image));
+    }
+    const fee = data.itemPostFeeDTO;
+    if (input.shipping === 'free') {
+        fee.canFreeShipping = true;
+        fee.supportFreight = true;
+    }
+    else if (input.shipping === 'distance') {
+        fee.supportFreight = true;
+        fee.templateId = '-100';
+    }
+    else if (input.shipping === 'fixed') {
+        fee.supportFreight = true;
+        fee.postPriceInCent = String(Math.trunc(input.postage * 100));
+        fee.templateId = '0';
+    }
+    else
+        fee.templateId = '0';
+    // 上游写在顶层，不是 itemPostFeeDTO 里（照抄）
+    if (input.pickup)
+        data.onlyTakeSelf = true;
+    if (input.price) {
+        if (input.price.current > 0)
+            data.itemPriceDTO.priceInCent = String(Math.trunc(input.price.current * 100));
+        if (input.price.original > 0)
+            data.itemPriceDTO.origPriceInCent = String(Math.trunc(input.price.original * 100));
+    }
+    else
+        data.defaultPrice = true;
+    const channel = (await publicChannel(x, input.desc, images)).data;
+    for (const card of channel.cardList ?? []) {
+        const cd = card.cardData;
+        for (const value of cd.valuesList ?? []) {
+            if (!value.isClicked)
+                continue;
+            data.itemLabelExtList.push({
+                channelCateName: value.catName,
+                valueId: null,
+                channelCateId: value.channelCatId,
+                valueName: null,
+                tbCatId: value.tbCatId,
+                subPropertyId: null,
+                labelType: 'common',
+                subValueId: null,
+                labelId: null,
+                propertyName: cd.propertyName,
+                isUserClick: '1',
+                isUserCancel: null,
+                from: 'newPublishChoice',
+                propertyId: cd.propertyId,
+                labelFrom: 'newPublish',
+                text: value.catName,
+                properties: `${pyStr(cd.propertyId)}##${pyStr(cd.propertyName)}:${pyStr(value.channelCatId)}##${pyStr(value.catName)}`,
+            });
+            break;
+        }
+    }
+    const cat = channel.categoryPredictResult;
+    data.itemCatDTO = { catId: pyStr(cat.catId), catName: pyStr(cat.catName), channelCatId: pyStr(cat.channelCatId), tbCatId: pyStr(cat.tbCatId) };
+    const loc = (await defaultLocation(x)).data.commonAddresses[0];
+    data.itemAddrDTO = {
+        area: loc.area,
+        city: loc.city,
+        divisionId: loc.divisionId,
+        gps: `${pyStr(loc.longitude)},${pyStr(loc.latitude)}`,
+        poiId: loc.poiId,
+        poiName: loc.poi,
+        prov: loc.prov,
+    };
+    return signed(x, 'mtop.idle.pc.idleitem.publish', jsonDumps(data, { separators: [',', ':'] }), API_HEADERS, {
+        spmCnt: 'a21ybx.publish.0.0',
+        spmPre: 'a21ybx.home.sidebar.1.46413da6EPl7v5',
+        logId: '46413da6EPl7v5',
+    });
+}
+// ================================================================ 扫码登录（上游 qrcode_login）
+const BIZ_PARAMS = `taobaoBizLoginFrom=web&renderRefer=${quote('https://www.goofish.com/')}`;
+const MINI_LOGIN = `${PASSPORT}/mini_login.htm`;
+const passportHeaders = (extra) => merge(SESSION_HEADERS, merge(PASSPORT_HEADERS, extra));
+/** 加载 mini_login 页面，拿 passport 域的 XSRF-TOKEN 等 cookie。 */
+export function miniLogin(x) {
+    return x.http.request({
+        url: MINI_LOGIN,
+        query: [
+            ['lang', 'zh_cn'],
+            ['appName', 'xianyu'],
+            ['appEntrance', 'web'],
+            ['styleType', 'vertical'],
+            ['bizParams', ''],
+            ['notLoadSsoView', 'false'],
+            ['notKeepLogin', 'false'],
+            ['isMobile', 'false'],
+            ['qrCodeFirst', 'false'],
+            ['stie', '77'],
+            ['rnd', '0.6842814084442211'],
+        ],
+        headers: passportHeaders([
+            ['Referer', 'https://www.goofish.com/'],
+            ['sec-fetch-site', 'same-site'],
+            ['sec-fetch-dest', 'iframe'],
+            ['sec-fetch-mode', 'navigate'],
+        ]),
+    });
+}
+function loginParams(csrf, cookie2) {
+    return [
+        ['appName', 'xianyu'],
+        ['fromSite', '77'],
+        ['appEntrance', 'web'],
+        ['_csrf_token', csrf],
+        ['umidToken', ''],
+        ['hsiz', cookie2],
+        ['bizParams', BIZ_PARAMS],
+        ['mainPage', 'false'],
+        ['isMobile', 'false'],
+        ['lang', 'zh_CN'],
+        ['returnUrl', ''],
+        ['umidTag', 'SERVER'],
+    ];
+}
+/** 生成二维码。 */
+export async function qrGenerate(x, csrf, cookie2) {
+    const res = await x.http.json({
+        url: `${PASSPORT}/newlogin/qrcode/generate.do`,
+        query: loginParams(csrf, cookie2),
+        headers: passportHeaders([['Referer', MINI_LOGIN]]),
+    });
+    const data = res?.content?.data;
+    if (!data?.codeContent)
+        throw new SpecificAIError('UPSTREAM', '生成二维码失败', { detail: res });
+    return data;
+}
+const postHeaders = () => passportHeaders([
+    ['Content-Type', 'application/x-www-form-urlencoded'],
+    ['Origin', PASSPORT],
+    ['Referer', MINI_LOGIN],
+]);
+/** 查询扫码状态：NEW / SCANNED / CONFIRMED / EXPIRED。 */
+export async function qrQuery(x, csrf, cookie2, cna, qr) {
+    const res = await x.http.json({
+        method: 'POST',
+        url: `${PASSPORT}/newlogin/qrcode/query.do?appName=xianyu&fromSite=77`,
+        form: [
+            ...loginParams(csrf, cookie2),
+            ['navlanguage', 'en'],
+            ['navUserAgent', UA],
+            ['navPlatform', 'Win32'],
+            ['isIframe', 'true'],
+            ['documentReferer', 'https://www.goofish.com/'],
+            ['defaultView', 'sms'],
+            ['deviceId', cna],
+            ['t', pyStr(qr.t)],
+            ['ck', qr.ck],
+        ],
+        headers: postHeaders(),
+    });
+    return res?.content?.data ?? {};
+}
+/** 用扫码确认后的 token 完成登录。 */
+export function loginByToken(x, token, cna) {
+    return x.http.request({
+        method: 'POST',
+        url: `${PASSPORT}/login_token/login.do`,
+        query: [
+            ['token', token],
+            ['subFlow', 'DIALOG_CHECK_LOGIN_RPC'],
+            ['nextCode', '0018'],
+            ['bizScene', 'qrcode'],
+            ['confirm', 'true'],
+        ],
+        form: [['deviceId', cna]],
+        headers: postHeaders(),
+    });
+}

package/dist/platforms/xianyu/web/client.js

@@ -0,0 +1,134 @@
+import { SpecificAIError } from '../../../core/errors.js';
+import { parseJson } from '../../../core/http.js';
+import { unquote } from '../../../core/py.js';
+import * as rand from '../../../core/rand.js';
+import { authError, httpClient } from '../../../core/toolkit.js';
+import { APP_KEY, BROWSER, COOKIE_DOMAIN, H5API, merge, MTOP_HEADERS, SESSION_HEADERS, userUrl } from './profile.js';
+import { generateDeviceId, genTfstk } from './sign.js';
+/** 令牌过期 / 为空：响应的 Set-Cookie 已经带来新的 `_m_h5_tk`，换新令牌重签一次。 */
+const TOKEN_RE = /FAIL_SYS_TOKEN_EXOIRED|FAIL_SYS_TOKEN_EMPTY|FAIL_SYS_TOKEN_ILLEGAL|令牌过期|令牌为空/;
+const SESSION_RE = /FAIL_SYS_SESSION_EXPIRED|SESSION_EXPIRED|FAIL_SYS_LOGIN|未登录|请重新登录|请登录/;
+const CAPTCHA_RE = /RGV587_ERROR|FAIL_SYS_USER_VALIDATE/;
+const LIMIT_RE = /FAIL_SYS_TRAFFIC_LIMIT|FAIL_SYS_FLOWLIMIT/;
+export class Xianyu {
+    ctx;
+    http;
+    jar;
+    constructor(ctx) {
+        this.ctx = ctx;
+        this.http = httpClient(ctx, { browser: BROWSER, os: 'windows' });
+        this.jar = this.http.jar;
+    }
+    /** 当前账号的用户 ID（cookie `unb`）。 */
+    get myId() {
+        return this.jar.get('unb') ?? '';
+    }
+    /** 昵称（cookie `tracknick`，可能是 URL 编码或 `\uXXXX` 转义过的）。 */
+    get nick() {
+        const raw = this.jar.get('tracknick');
+        if (!raw)
+            return null;
+        const s = unquote(raw);
+        return s.replace(/\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)));
+    }
+    me() {
+        return { id: this.myId, name: this.nick, url: userUrl(this.myId) };
+    }
+    /** 私信用的设备 ID：上游每次按 `unb` 随机生成；这里生成一次后存在凭证的 device 里。 */
+    get deviceId() {
+        const device = this.ctx.credential.device;
+        return (device.device_id ??= generateDeviceId(this.myId));
+    }
+    /** mtop 签名用的令牌：cookie `_m_h5_tk` 下划线前的部分，没有（或已过期）时为空串。 */
+    token() {
+        const c = this.jar.forUrl(`${H5API}/`).find((x) => x.name === '_m_h5_tk');
+        return (c?.value ?? '').split('_')[0];
+    }
+    /** 全部 cookie 拼成一个 Cookie 头（上游 get_session_cookies_str，不分域名）。 */
+    cookieString() {
+        return Object.entries(this.jar.toObject())
+            .map(([k, v]) => `${k}=${v}`)
+            .join('; ');
+    }
+    /**
+     * 纯 HTTP 获取初始 cookie，不含登录态（上游 build_initial_cookies，扫码登录前用）：
+     * eg.js 拿 `cna`，两次空签名的 mtop 拿 `_m_h5_tk` 和 `cookie2`，最后跑 JS 生成 `tfstk`。
+     */
+    async buildInitialCookies() {
+        await this.http.request({ url: 'https://log.mmstat.com/eg.js', headers: SESSION_HEADERS });
+        const cna = this.jar.get('cna', '.mmstat.com');
+        if (cna)
+            this.jar.set('cna', cna, COOKIE_DOMAIN);
+        for (const api of ['mtop.taobao.idlehome.home.webpc.feed', 'mtop.gaia.nodejs.gaia.idle.data.gw.v2.index.get']) {
+            await this.http.request(unsignedMtop(api));
+        }
+        const tfstk = await genTfstk((line) => this.ctx.log.debug(line));
+        if (tfstk)
+            this.jar.set('tfstk', tfstk, COOKIE_DOMAIN);
+    }
+    /**
+     * 发一个 mtop 请求并检查业务码。build 拿当前令牌构造请求（签名在里面算）；
+     * 令牌过期或为空时用 Set-Cookie 带回的新令牌重签一次（上游只在 get_token 里这样做）。
+     */
+    async mtop(build) {
+        for (let attempt = 0;; attempt++) {
+            const body = await parseJson(await this.http.request(build(this.token())));
+            const ret = (body.ret ?? []).join(';');
+            if (attempt === 0 && TOKEN_RE.test(ret)) {
+                this.ctx.log.debug(`mtop 令牌失效，重签：${ret}`);
+                continue;
+            }
+            check(this.ctx, body);
+            return body;
+        }
+    }
+    /** 写操作和私信前检查登录态（registry 已保证不是游客，这里防 cookie 不全）。 */
+    requireLogin() {
+        if (!this.myId)
+            throw authError(this.ctx, '当前账号的 cookie 里没有 unb，请重新登录');
+    }
+}
+/** 空签名的 mtop 请求（build_initial_cookies、qrcode_login 最后一步），只为拿响应里的 cookie。 */
+export function unsignedMtop(api) {
+    return {
+        method: 'POST',
+        url: `${H5API}/${api}/1.0/`,
+        query: [
+            ['jsv', '2.7.2'],
+            ['appKey', APP_KEY],
+            ['t', String(rand.now())],
+            ['sign', ''],
+            ['v', '1.0'],
+            ['type', 'originaljson'],
+            ['dataType', 'json'],
+            ['timeout', '20000'],
+            ['api', api],
+            ['sessionOption', 'AutoLoginOnly'],
+            ['spm_cnt', 'a21ybx.home.0.0'],
+        ],
+        body: 'data=%7B%7D',
+        headers: merge(SESSION_HEADERS, MTOP_HEADERS),
+    };
+}
+/** mtop 的 ret 映射成 specific-ai 的错误（AGENTS 6.4）。 */
+function check(ctx, body) {
+    const ret = body?.ret ?? [];
+    const first = String(ret[0] ?? '');
+    if (first.startsWith('SUCCESS'))
+        return;
+    const all = ret.join(';');
+    const message = first.split('::').slice(1).join('::') || first || '闲鱼返回了空的 ret';
+    const detail = { ret, api: body?.api ?? null };
+    if (SESSION_RE.test(all))
+        throw authError(ctx, `闲鱼登录态无效：${message}`);
+    if (CAPTCHA_RE.test(all)) {
+        throw new SpecificAIError('RISK_CONTROL', `闲鱼风控拦截，需要滑块验证：${message}`, { detail: { kind: 'captcha', ...detail, url: body?.data?.url ?? null } });
+    }
+    if (LIMIT_RE.test(all))
+        throw new SpecificAIError('RISK_CONTROL', `闲鱼限流：${message}`, { detail: { kind: 'rate_limit', ...detail } });
+    throw new SpecificAIError('UPSTREAM', `闲鱼返回错误：${message}`, { detail });
+}
+/** 建立会话。web 端不支持游客态（AGENTS 5.2），除 auth 外的命令都已登录。 */
+export function xianyu(ctx) {
+    return new Xianyu(ctx);
+}