tyc-cli 0.3.5 → 0.3.6

package/dist/index.js

@@ -6,98 +6,72 @@ import { registerCategoryCommands } from "./commands/category.js";
 import { registerLayerCommands } from "./commands/layers.js";
 import { getCategories, getLayerCount, getPriorityTools, getTotalCount, } from "./registry.js";
 import { VERSION } from "./version.js";
-// 顶层 help：把"最懂 AI 的 CLI"落在 4 层架构 + 调用顺序 + 可发现性上。
-// Agent 看 tyc --help 时应立刻读懂"先 L0 锚定企业，再 L1 概览，再 L2 下钻，最后 L3 详情"这条主线。
+// 顶层 help 保持为快速入口：讲清分层、调用顺序、发现命令和输出控制；
+// 更完整的架构说明放在 `tyc layers`。
 const helpText = `
-ARCHITECTURE — Layered Tool Discovery for LLM Agents
-
-  Cognitive research shows LLM tool-selection accuracy collapses above
-  30 tools (>95% at 10, ~70% at 30, <50% at 100+). tyc counters this with
-  a 4-layer progressive-disclosure architecture, led by a dedicated
-  entity-resolution layer:
-
-    ┌─ L0  Resolve       ${pad(getLayerCount("L0"), 3)} tool    entity resolution · 简称/曾用名/模糊名 → 精确企业
-    ├─ L1  Overview     ${pad(getLayerCount("L1"), 3)} tools   one captain per facet · returns _summary for routing
-    ├─ L2  Drill-down   ${pad(getLayerCount("L2"), 3)} tools   one-hop into a specific data dimension (★ = L2 优先, see below)
-    └─ L3  Specialized  ${pad(getLayerCount("L3"), 3)} tools   id-based detail · search_* · vertical SKILLs
-
-  Recommended call order:
-
-    0. Anchor at L0.   Feed the user's raw company name (可能是简称/曾用名/模糊
-                        指代) into \`search_companies\`; lock onto one entity
-                        with a USCC + official name before anything else.
-    1. Ascend to L1.   Pick ONE of the ${getLayerCount("L1")} overview tools with the
-                        anchored USCC. Read _summary, then use layer lists or
-                        MCP get_company_capabilities for the next tool.
-    2. Descend to L2.  Pick a specific dimension
-                        (shareholders / litigation / patents / annual reports …).
-                        If unsure which L2, default to that facet's L2★ 优先 (below).
-    3. Land on L3.     When L2 returns a list item with an \`id\`, a \`search_*\`
-                        need arises, or a vertical SKILL is activated.
-
-  Rule of thumb: the smaller the layer number, the higher the information
-  density per token. L0 is MANDATORY — skipping it (without a USCC already
-  in hand) wastes downstream calls on the wrong entity.
-  Default LLM surface = L0 + L1 = ${getLayerCount("L0") + getLayerCount("L1")} tools (≤ 15-tool exposure limit).
-
-L2 优先 ★ — \`L2★ 队副\`（${getPriorityTools().length} 个，每 facet 1 个）
+工具分层
+
+  tyc 采用 4 层渐进发现，默认只把 L0 + L1 的 ${getLayerCount("L0") + getLayerCount("L1")} 个高密度工具暴露给 Agent，再按需下钻到 L2/L3。
+
+    ┌─ L0  实体锚定    ${pad(getLayerCount("L0"), 3)} 个工具   简称 / 曾用名 / 模糊名 → 精确企业
+    ├─ L1  概要总览    ${pad(getLayerCount("L1"), 3)} 个工具   每个 facet 1 个总览工具，返回 _summary
+    ├─ L2  维度下钻    ${pad(getLayerCount("L2"), 3)} 个工具   股东、诉讼、商标、招投标、年报等明细维度
+    └─ L3  专项工具    ${pad(getLayerCount("L3"), 3)} 个工具   id 详情、search_*、垂直场景和专业查询
+
+推荐调用顺序
+
+  0. 先做 L0：用用户给出的原始企业名调用 \`search_companies\`，确认唯一企业、
+              统一社会信用代码和企业全名。
+  1. 再看 L1：按问题选择 1 个概要工具，读取 _summary 判断下一步。
+  2. 下钻 L2：选择具体数据维度；不确定时优先用对应 facet 的 L2★ 工具。
+  3. 进入 L3：需要记录 id 详情、跨主体 search_* 或垂直 SKILL 时再使用。
+
+L2 优先 ★（${getPriorityTools().length} 个，每个 facet 1 个）
 
   Agent 拿到 L1 _summary 后若不确定走哪个 L2，对应 facet 的"L2 优先"是默认下钻：
 
 ${renderPriorityLines()}
 
-  Detail: tyc layers / tyc L2 list   (★ marks priority rows)
-
-DISCOVER BY LAYER
+按层发现
 
-  tyc layers              one-screen architecture map (含 L2 优先映射)
-  tyc L0 list             list the ${getLayerCount("L0")} L0 tool (entity-resolve layer)
-  tyc L1 list             list all ${getLayerCount("L1")} L1 tools (overview, grouped)
-  tyc L2 list             list all ${getLayerCount("L2")} L2 tools (drill-down; ★ priority pinned to top)
-  tyc L3 list             list all ${getLayerCount("L3")} L3 tools (specialized, grouped)
-  tyc L0 list --md        Markdown tables (agent on-screen)
-  tyc L0 list --json      machine-readable JSON (id · cli · params · description · priority)
+  tyc layers              查看一屏架构图和推荐调用顺序
+  tyc L0 list             列出 ${getLayerCount("L0")} 个 L0 工具
+  tyc L1 list             列出 ${getLayerCount("L1")} 个 L1 工具
+  tyc L2 list             列出 ${getLayerCount("L2")} 个 L2 工具（★ 优先工具置顶）
+  tyc L3 list             列出 ${getLayerCount("L3")} 个 L3 工具
+  tyc L0 list --md        输出 Markdown 表格
+  tyc L0 list --json      输出 JSON（含工具名、CLI、参数、描述、优先级）
+  tyc company capabilities <company_id> --company-name <name>
+                         根据 L0 返回的 company_id 打印可直接执行的工具清单
 
-DISCOVER BY CATEGORY (orthogonal to layers, 6 groups)
+按分类发现（与层级正交，共 6 组）
 
 ${renderCategoryLines()}
 
-OUTPUT FORMATS (mutually exclusive, priority: --md > --compact > --pretty / default)
-
-  (default)    indented JSON (pretty) — readable for both humans and agents
-  --pretty     same as default (kept for backward compatibility / explicit intent)
-  --compact    compact single-line JSON (pipe / jq friendly; old default behavior)
-  --md         Markdown tables (human + agent on-screen)
-  --verbose    also print core/MCP request details to stderr (orthogonal to above)
-
-OUTPUT TRUNCATION & DUMP  (orthogonal — apply to any sub-command)
-
-  --head [N]            print only the first N lines  (N defaults to 50 if flag given alone)
-  --tail [M]            print only the last M lines   (M defaults to 20 if flag given alone)
-                          · --head + --tail together: head + "... omitted ..." + tail
-                          · either flag alone: that side only
-  --full                force-print the FULL rendered content (no truncation; highest priority)
-  --threshold <BYTES>   master switch for byte-truncation. Without --threshold there is
-                        NO automatic truncation, regardless of output size.
-                        With --threshold N: when rendered output > N bytes, byte-truncate
-                        from the head; --head / --tail are IGNORED in this mode.
-  --output-file <PATH>  write the FULL rendered content to PATH. **No file is written
-                        unless --output-file is explicitly passed** (no auto-dump).
-                        Combine with --head/--tail/--threshold to keep stdout terse
-                        while preserving the full result on disk.
-
-SETUP
-
-  tyc login                                             OAuth browser login
-  tyc login --url <MCP_URL>                             OAuth for local / pre / self-hosted
-  tyc init --authorization <KEY>                        API-key compatibility path (default transport: core)
-  tyc init --transport mcp --authorization <KEY>        legacy MCP session transport
-  tyc init --url <MCP_URL> --authorization <KEY>        local / self-hosted service
-
-Every tool returns tyc OpenAPI native English keys verbatim. The MCP Server
-handles multi-source merge, Asia/Shanghai timestamp formatting, _summary
-injection, and empty-result normalization — the CLI just tells the Agent
-where the data is and what it looks like.
+全局输出选项（所有工具命令均可使用）
+
+  以下选项可用于所有工具调用；具体工具 help 不重复展开完整列表。
+
+  默认        缩进 JSON，兼顾人类阅读和 Agent 解析
+  --pretty    同默认输出，保留用于显式声明意图
+  --compact   单行紧凑 JSON，适合管道和 jq
+  --md        Markdown 表格，适合终端阅读或粘贴给 Agent
+  --verbose   额外把 shared core 请求详情打印到 stderr
+
+  --head [N]            只输出前 N 行；只写 flag 时默认 50 行
+  --tail [M]            只输出后 M 行；只写 flag 时默认 20 行
+  --full                强制输出完整内容，优先级最高
+  --threshold <BYTES>   超过指定字节数时从头截断；不传则不自动截断
+  --output-file <PATH>  把完整结果写入文件；必须显式指定才会落盘
+
+初始化与登录
+
+  tyc login                                             OAuth 浏览器登录
+  tyc login --no-open --no-block                       打印 OAuth URL 后立即退出，手动完成
+  tyc login --callback-token <CODE_OR_CALLBACK_URL>    继续非阻塞 OAuth 登录
+  tyc login --url <MCP_URL>                             登录本地、预发或自托管 MCP
+  tyc init --authorization <KEY>                        使用 API Key 兼容路径
+  tyc init --url <MCP_URL> --authorization <KEY>        配置本地或自托管服务
 `;
 function pad(n, width) {
     const s = String(n);
@@ -106,7 +80,7 @@ function pad(n, width) {
 function renderCategoryLines() {
     const lines = [];
     for (const c of getCategories()) {
-        lines.push(`  tyc ${c.group.padEnd(22)} ${c.name_zh}  (${c.tool_count} tools)`);
+        lines.push(`  tyc ${c.group.padEnd(22)} ${c.name_zh}  (${c.tool_count} 个工具)`);
     }
     return lines.join("\n");
 }
@@ -119,12 +93,26 @@ function renderPriorityLines() {
 }
 const program = new Command()
     .name("tyc")
-    .description(`Tianyan AI CLI — ${getTotalCount()} commercial-data tools · L0=${getLayerCount("L0")} L1=${getLayerCount("L1")} L2=${getLayerCount("L2")} L3=${getLayerCount("L3")} · the AI-native gateway (pair with the TA MCP Server)`)
-    .version(VERSION)
+    .description(`天眼查 AI CLI：${getTotalCount()} 个商业数据工具 · L0=${getLayerCount("L0")} L1=${getLayerCount("L1")} L2=${getLayerCount("L2")} L3=${getLayerCount("L3")} · 面向 Agent 的 MCP 工具网关`)
+    .version(VERSION, "-V, --version", "输出版本号")
+    .helpOption("-h, --help", "显示命令帮助")
+    .addHelpCommand("help [command]", "显示命令帮助")
+    .configureHelp({
+    styleTitle(title) {
+        const titleMap = {
+            "Usage:": "用法:",
+            "Arguments:": "参数:",
+            "Options:": "选项:",
+            "Global Options:": "全局选项:",
+            "Commands:": "命令:",
+        };
+        return titleMap[title] || title;
+    },
+})
     .option("--pretty", "缩进 JSON 输出（默认行为，flag 保留以保持向后兼容）")
     .option("--md", "Markdown 表格化输出（适合人类阅读 / Agent 上屏）")
     .option("--compact", "紧凑单行 JSON（管道 / jq 场景；为旧默认行为）")
-    .option("--verbose", "打印 core/MCP 请求详情到 stderr")
+    .option("--verbose", "打印 shared core 请求详情到 stderr")
     .option("--head [n]", "仅输出前 N 行（不传值默认 50；与 --tail 同时给则同时输出两端）")
     .option("--tail [m]", "仅输出后 M 行（不传值默认 20；与 --head 同时给则同时输出两端）")
     .option("--full", "强制输出完整内容（最高优先级，覆盖 --head/--tail/--threshold）")

package/dist/oauth.js

@@ -340,6 +340,72 @@ export async function exchangeAuthorizationCode(opts) {
     }
     return token;
 }
+export async function exchangeRefreshToken(opts) {
+    const body = new URLSearchParams();
+    body.set("grant_type", "refresh_token");
+    body.set("client_id", opts.clientId);
+    body.set("refresh_token", opts.refreshToken);
+    if (opts.clientSecret)
+        body.set("client_secret", opts.clientSecret);
+    if (opts.resource)
+        body.set("resource", opts.resource);
+    const resp = await fetch(opts.tokenEndpoint, {
+        method: "POST",
+        headers: {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        },
+        body,
+    });
+    const text = await resp.text();
+    if (resp.status < 200 || resp.status >= 300) {
+        throw new Error(`token refresh HTTP ${resp.status}: ${text.slice(0, 500)}`);
+    }
+    const token = JSON.parse(text);
+    if (!token.access_token) {
+        throw new Error("token refresh response missing access_token");
+    }
+    return token;
+}
+function callbackSearchParams(raw) {
+    try {
+        const url = new URL(raw);
+        if (url.search)
+            return url.searchParams;
+        if (url.hash.includes("="))
+            return new URLSearchParams(url.hash.replace(/^#/, ""));
+        return null;
+    }
+    catch {
+        if (raw.startsWith("?") || raw.includes("code=") || raw.includes("error=")) {
+            return new URLSearchParams(raw.replace(/^[?#]/, ""));
+        }
+        return null;
+    }
+}
+export function parseAuthorizationCallbackCode(raw, expectedState) {
+    const trimmed = raw.trim();
+    if (!trimmed) {
+        throw new Error("empty callback token");
+    }
+    const params = callbackSearchParams(trimmed);
+    if (!params) {
+        return trimmed;
+    }
+    const error = params.get("error");
+    if (error) {
+        throw new Error(`OAuth error: ${params.get("error_description") || error}`);
+    }
+    const state = params.get("state");
+    if (expectedState && state && state !== expectedState) {
+        throw new Error("OAuth state mismatch");
+    }
+    const code = params.get("code");
+    if (!code) {
+        throw new Error("callback URL missing code");
+    }
+    return code;
+}
 export function openBrowser(url) {
     const platform = process.platform;
     let command;

package/dist/oauthPending.js

@@ -0,0 +1,41 @@
+// ~/.tyc/oauth_pending.json 读写
+//
+// 非阻塞 OAuth 登录会先保存 PKCE code_verifier、state、client_id 等一次性上下文；
+// 用户完成浏览器授权后，再用 tyc login --callback-token <code_or_callback_url> 继续换取 access token。
+import { chmodSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+const PENDING_DIR = join(homedir(), ".tyc");
+export const PENDING_FILE = join(PENDING_DIR, "oauth_pending.json");
+export function loadPendingOAuthLogin() {
+    if (!existsSync(PENDING_FILE))
+        return null;
+    try {
+        const raw = readFileSync(PENDING_FILE, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`读取 OAuth pending 状态失败：${PENDING_FILE}：${msg}`);
+    }
+}
+export function savePendingOAuthLogin(pending) {
+    if (!existsSync(PENDING_DIR))
+        mkdirSync(PENDING_DIR, { recursive: true, mode: 0o700 });
+    writeFileSync(PENDING_FILE, JSON.stringify(pending, null, 2) + "\n", "utf-8");
+    try {
+        chmodSync(PENDING_FILE, 0o600);
+    }
+    catch { /* best effort */ }
+}
+export function clearPendingOAuthLogin(verbose = false) {
+    try {
+        rmSync(PENDING_FILE, { force: true });
+    }
+    catch (err) {
+        if (verbose) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`> 清理 OAuth pending 状态失败（忽略）：${PENDING_FILE}：${msg}`);
+        }
+    }
+}

package/dist/types.js

@@ -2,8 +2,7 @@
 //
 // CLI 运行时模型：
 //  - Catalog：构建时由 apimcp 主仓生成，打包在 src/catalog.json，用于构建命令树
-//  - MCP 层类型：JSON-RPC 请求/响应、tools/call 结果
-//  - Session：本地缓存的 MCP 会话状态（~/.tyc/session.json）
-//  - Config：CLI 配置（~/.tyc/config.json），与主流 MCP 客户端配置风格一致
-//    { url, headers }
+//  - Tool call 结果：沿用 MCP content shape，便于共享输出逻辑
+//  - Config：CLI 配置（~/.tyc/config.json），{ url, coreUrl, headers }；
+//    OAuth 登录会额外保存 oauth 刷新上下文
 export {};

package/dist/version.js

@@ -1,6 +1,6 @@
 // CLI 版本号单一来源：从 package.json 读取
 //
-// 历史上 index.ts 与 mcpClient.ts 各自硬编码版本字符串，多处漂移。
+// 历史上 index.ts 与 client 实现各自硬编码版本字符串，多处漂移。
 // 收敛到 package.json 一处后，bump 版本只需 npm version <x>。
 // 运行时 fs 读：dev (`tsx src/version.ts`) 与 dist (`dist/version.js`) 与
 // package.json 都同级 (cli/t1_1/{src,dist} ↔ cli/t1_1/package.json)，

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tyc-cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "天眼查 AI CLI — 162 个业务语义聚合工具 · 默认 Shared Core 调用 · 兼容 MCP transport",
   "main": "dist/index.js",
   "bin": {

package/dist/mcpClient.js

@@ -1,146 +0,0 @@
-// MCP JSON-RPC over Streamable HTTP 客户端
-//
-// 职责：
-//   1. initialize：拿 Mcp-Session-Id（服务端在响应 header 下发）
-//   2. tools/call：透传 Authorization + Mcp-Session-Id，解析 SSE/JSON 响应
-//   3. Session 失效（404/410 或服务端 "session not found"）→ 清 session → 重试 1 次
-//
-// 不做：
-//   - 不维护 tools/list 缓存（CLI 命令树从本地 catalog.json 构建）
-//   - 不做业务聚合/时间戳格式化（由 MCP Server 完成）
-//   - 不做 Authorization 解析/验签
-import { clearSession, isSessionFresh, loadSession, saveSession } from "./session.js";
-import { VERSION } from "./version.js";
-const PROTOCOL_VERSION = "2024-11-05";
-function maskToken(v) {
-    if (!v)
-        return "";
-    if (v.length <= 8)
-        return "****";
-    return v.slice(0, 4) + "****" + v.slice(-4);
-}
-function logVerbose(cfg, title, extra) {
-    const masked = {};
-    for (const [k, v] of Object.entries(cfg.headers)) {
-        masked[k] = k.toLowerCase() === "authorization" ? maskToken(v) : v;
-    }
-    console.error(`> ${title}`);
-    console.error(`> headers: ${JSON.stringify(masked)}`);
-    if (extra)
-        console.error(extra);
-}
-/** 解析 MCP Streamable HTTP 响应——server 端实测固定回 application/json 单包，
- *  无论 client Accept 头声明什么。SSE 路径不存在，所以只解析 JSON。 */
-function parseJsonRpc(raw) {
-    const trimmed = raw.trim();
-    if (!trimmed.startsWith("{")) {
-        throw new Error(`Unparseable MCP response: ${trimmed.slice(0, 200)}`);
-    }
-    return JSON.parse(trimmed);
-}
-async function httpPost(url, headers, body, verbose) {
-    const h = {
-        "Content-Type": "application/json",
-        "Accept": "application/json",
-        ...headers,
-    };
-    if (verbose) {
-        console.error(`> POST ${url}`);
-        const masked = {};
-        for (const [k, v] of Object.entries(h)) {
-            masked[k] = k.toLowerCase() === "authorization" ? maskToken(v) : v;
-        }
-        console.error(`> headers: ${JSON.stringify(masked)}`);
-        console.error(`> body: ${JSON.stringify(body)}`);
-    }
-    const resp = await fetch(url, {
-        method: "POST",
-        headers: h,
-        body: JSON.stringify(body),
-    });
-    const text = await resp.text();
-    if (verbose) {
-        console.error(`< ${resp.status} ${resp.statusText}`);
-        console.error(`< body: ${text.slice(0, 2000)}`);
-    }
-    return { status: resp.status, text, headers: resp.headers };
-}
-async function doInitialize(cfg, verbose) {
-    if (verbose)
-        logVerbose(cfg, `MCP initialize → ${cfg.url}`);
-    const { status, text, headers } = await httpPost(cfg.url, cfg.headers, {
-        jsonrpc: "2.0",
-        id: 1,
-        method: "initialize",
-        params: {
-            protocolVersion: PROTOCOL_VERSION,
-            capabilities: {},
-            clientInfo: { name: "tyc-cli", version: VERSION },
-        },
-    }, verbose);
-    if (status < 200 || status >= 300) {
-        throw new Error(`initialize 失败：HTTP ${status}\n${text.slice(0, 500)}`);
-    }
-    const sessionId = headers.get("Mcp-Session-Id") || headers.get("mcp-session-id");
-    if (!sessionId) {
-        throw new Error(`initialize 响应未包含 Mcp-Session-Id header。请确认 ${cfg.url} 是 Streamable HTTP MCP Server。`);
-    }
-    const rpc = parseJsonRpc(text);
-    if (rpc.error) {
-        throw new Error(`initialize JSON-RPC error: ${rpc.error.message}`);
-    }
-    const s = {
-        url: cfg.url,
-        sessionId,
-        initializedAt: Date.now(),
-        protocolVersion: rpc.result?.protocolVersion,
-    };
-    saveSession(s);
-    return s;
-}
-/** 获取可用 session：若缓存新鲜则复用，否则 initialize + 落盘。 */
-export async function ensureSession(cfg, opts) {
-    const cached = loadSession();
-    if (isSessionFresh(cached, cfg.url))
-        return cached;
-    return doInitialize(cfg, !!opts?.verbose);
-}
-function isSessionInvalidResponse(status, text) {
-    if (status === 404 || status === 410)
-        return true;
-    const lower = text.toLowerCase();
-    return lower.includes("session not found") || lower.includes("invalid session");
-}
-/** 调用 MCP tool；透明处理 session 失效重建。 */
-export async function callTool(cfg, name, args, opts) {
-    const verbose = !!opts?.verbose;
-    let session = await ensureSession(cfg, opts);
-    const doCall = async (s) => {
-        const h = { ...cfg.headers, "Mcp-Session-Id": s.sessionId };
-        return httpPost(cfg.url, h, {
-            jsonrpc: "2.0",
-            id: 2,
-            method: "tools/call",
-            params: { name, arguments: args },
-        }, verbose);
-    };
-    let resp = await doCall(session);
-    if (isSessionInvalidResponse(resp.status, resp.text)) {
-        if (verbose)
-            console.error("> session invalid, re-initializing …");
-        clearSession();
-        session = await doInitialize(cfg, verbose);
-        resp = await doCall(session);
-    }
-    if (resp.status < 200 || resp.status >= 300) {
-        throw new Error(`tools/call HTTP ${resp.status}\n${resp.text.slice(0, 500)}`);
-    }
-    const rpc = parseJsonRpc(resp.text);
-    if (rpc.error) {
-        throw new Error(`MCP error ${rpc.error.code}: ${rpc.error.message}`);
-    }
-    if (!rpc.result) {
-        throw new Error("tools/call 响应缺少 result 字段");
-    }
-    return rpc.result;
-}

package/dist/session.js

@@ -1,47 +0,0 @@
-// ~/.tyc/session.json 读写 + 24h TTL
-//
-// TTL 规则（按字面 24h，从 initializedAt 起）：
-//   - 命中：复用 sessionId，跳过 initialize
-//   - 过期 / url 变化：强制重新 initialize
-//   - 服务端主动失效（4xx + session 提示）：mcpClient 调 clearSession 后重建
-import { readFileSync, writeFileSync, mkdirSync, existsSync, rmSync, chmodSync } from "node:fs";
-import { join } from "node:path";
-import { homedir } from "node:os";
-const SESSION_DIR = join(homedir(), ".tyc");
-const SESSION_FILE = join(SESSION_DIR, "session.json");
-export const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24h 字面
-export function loadSession() {
-    if (!existsSync(SESSION_FILE))
-        return null;
-    try {
-        const raw = readFileSync(SESSION_FILE, "utf-8");
-        return JSON.parse(raw);
-    }
-    catch {
-        return null;
-    }
-}
-export function saveSession(s) {
-    if (!existsSync(SESSION_DIR))
-        mkdirSync(SESSION_DIR, { recursive: true, mode: 0o700 });
-    writeFileSync(SESSION_FILE, JSON.stringify(s, null, 2) + "\n", "utf-8");
-    try {
-        chmodSync(SESSION_FILE, 0o600);
-    }
-    catch { /* best effort */ }
-}
-export function clearSession() {
-    try {
-        rmSync(SESSION_FILE, { force: true });
-    }
-    catch { /* ignore */ }
-}
-export function isSessionFresh(s, url, now = Date.now()) {
-    if (!s)
-        return false;
-    if (s.url !== url)
-        return false;
-    if (!s.sessionId)
-        return false;
-    return now - s.initializedAt < SESSION_TTL_MS;
-}