tyc-cli 0.3.7 → 0.3.9

package/dist/commands/capabilities.js

@@ -25,8 +25,7 @@ export function registerCompanyCapabilitiesCommand(companyCmd, program) {
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`请求失败: ${msg}`);
-            process.exit(1);
+            throw new Error(`请求失败: ${msg}`, { cause: err });
         }
     });
 }

package/dist/commands/category.js

@@ -36,7 +36,7 @@ function bindMethod(catCmd, tool, program) {
     // 都能直观看到分层信息；徽章不影响 Agent 对 description 的语义理解。
     let methodCmd = catCmd
         .command(tool.cliMethod)
-        .description(`[${tool.layer}] ${tool.description}`);
+        .description(`[${tool.layer}] ${tool.description} 调用额度：成功且返回有效结果计 1 次；报错、全部无结果和系统异常计 0 次。`);
     if (positional) {
         methodCmd = methodCmd.argument(`<${positional.name}>`, positional.description);
     }
@@ -63,8 +63,7 @@ function bindMethod(catCmd, tool, program) {
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`请求失败: ${msg}`);
-            process.exit(1);
+            throw new Error(`请求失败: ${msg}`, { cause: err });
         }
     });
 }

package/dist/commands/init.js

@@ -1,9 +1,10 @@
-import { DEFAULT_MCP_URL, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
-import { verifyCoreEndpoint } from "../coreClient.js";
+import { DEFAULT_MCP_URL, defaultCoreURL, loadConfig, saveConfig, } from "../config.js";
+import { verifyCoreAuthEndpoint, verifyCoreEndpoint } from "../coreClient.js";
+import { printLoginSuccessBanner } from "../logo.js";
 export function registerInitCommand(program) {
     program
         .command("init")
-        .description("配置 endpoint / Authorization（保存到 ~/.tyc/config.json，并校验 shared core 连通性）")
+        .description("配置 endpoint / Authorization（保存到 ~/.tyc/config.json，并校验配置）")
         .option("--authorization <token>", "tyc OpenAPI Authorization（写入 headers.Authorization）")
         .option("--url <url>", `MCP endpoint（默认 ${DEFAULT_MCP_URL}）`)
         .option("--core-url <url>", "Shared Core HTTP endpoint（默认从 --url 推导 /v1/core/tools/call）")
@@ -52,22 +53,45 @@ export function registerInitCommand(program) {
         }
         if (resetOAuth)
             delete cfg.oauth;
+        const persistedAuthorization = cfg.headers.Authorization?.trim();
         saveConfig(cfg);
-        console.log(`已保存 ~/.tyc/config.json  (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
+        const verbose = !!program.opts().verbose;
+        if (verbose) {
+            console.error(`> config saved to ~/.tyc/config.json (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
+        }
         if (opts.verify === false) {
+            console.log(`已保存 ~/.tyc/config.json  (url=${cfg.url}, coreUrl=${cfg.coreUrl})`);
             return;
         }
         try {
-            const resolved = resolveConfig();
-            const verbose = !!program.opts().verbose;
-            await verifyCoreEndpoint(resolved, verbose);
-            console.log("Shared Core endpoint 校验通过");
+            const verifyConfig = {
+                url: cfg.url,
+                coreUrl: cfg.coreUrl || defaultCoreURL(cfg.url),
+                headers: { ...(cfg.headers || {}) },
+            };
+            if (!verifyConfig.headers.Authorization && process.env.TYC_AUTHORIZATION) {
+                verifyConfig.headers.Authorization = process.env.TYC_AUTHORIZATION;
+            }
+            if (verifyConfig.headers.Authorization?.trim()) {
+                await verifyCoreAuthEndpoint(verifyConfig, verbose);
+                if (verbose) {
+                    console.error("> Shared Core auth check passed");
+                }
+                if (persistedAuthorization) {
+                    printLoginSuccessBanner();
+                }
+                else {
+                    console.log("Authorization 校验通过（来自 TYC_AUTHORIZATION；未写入 ~/.tyc/config.json）");
+                }
+            }
+            else {
+                await verifyCoreEndpoint(verifyConfig, verbose);
+                console.log("Shared Core endpoint 校验通过");
+            }
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);
-            console.error(`连通性校验失败：${msg}`);
-            console.error("配置已保存；确认 --url 可达后重新运行 tyc init，或加 --no-verify 跳过校验。");
-            process.exit(1);
+            throw new Error(`配置校验失败：${msg}\n配置已保存；确认 --url 可达且 Authorization 有效后重新运行 tyc init，或加 --no-verify 跳过校验。`, { cause: err });
         }
     });
 }

package/dist/commands/login.js

@@ -1,6 +1,6 @@
 import { DEFAULT_MCP_URL, applyOAuthTokenToConfig, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
 import { verifyCoreAuthEndpoint } from "../coreClient.js";
-import { buildAuthorizationURL, buildCliCallbackRedirectUri, createPKCE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, knownOAuthDefaultsForMcpURL, openBrowser, parseAuthorizationCallbackCode, randomState, registerDynamicOAuthClient, startCallbackServer, } from "../oauth.js";
+import { buildAuthorizationURL, buildCliCallbackRedirectUri, createPKCE, DEVICE_CODE_GRANT_TYPE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, exchangeDeviceCode, knownOAuthDefaultsForMcpURL, OAuthTokenEndpointError, openBrowser, parseAuthorizationCallbackCode, randomState, registerDynamicOAuthClient, requestDeviceAuthorization, startCallbackServer, } from "../oauth.js";
 import { clearPendingOAuthLogin, loadPendingOAuthLogin, savePendingOAuthLogin, } from "../oauthPending.js";
 import { printLoginSuccessBanner } from "../logo.js";
 function parsePort(raw) {
@@ -45,6 +45,15 @@ async function verifySavedOAuthLogin(verify, verbose) {
     }
     printLoginSuccessBanner();
 }
+function isPendingDeviceLogin(pending) {
+    return pending.version === 2;
+}
+function isPendingPKCELogin(pending) {
+    return pending.version === 1;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 async function completePendingOAuthLogin(pending, callbackToken, verify, verbose) {
     const code = parseAuthorizationCallbackCode(callbackToken, pending.state);
     if (verbose) {
@@ -68,6 +77,63 @@ async function completePendingOAuthLogin(pending, callbackToken, verify, verbose
     clearPendingOAuthLogin(verbose);
     await verifySavedOAuthLogin(verify, verbose);
 }
+async function completePendingDeviceLogin(pending, verify, verbose) {
+    if (pending.expiresAt <= Date.now()) {
+        clearPendingOAuthLogin(verbose);
+        throw new Error("OAuth device 授权已过期，请重新运行 tyc login --no-block。");
+    }
+    let intervalMs = Math.max(1, pending.interval || 5) * 1000;
+    const deadline = Date.now() + 30_000;
+    for (;;) {
+        try {
+            if (verbose) {
+                console.error("> polling OAuth device token endpoint");
+            }
+            const token = await exchangeDeviceCode({
+                tokenEndpoint: pending.tokenEndpoint,
+                clientId: pending.clientId,
+                clientSecret: pending.clientSecret,
+                deviceCode: pending.deviceCode,
+                resource: pending.resource,
+            });
+            saveOAuthTokenConfig(pending.mcpURL, token, {
+                tokenEndpoint: pending.tokenEndpoint,
+                clientId: pending.clientId,
+                clientSecret: pending.clientSecret,
+                resource: pending.resource,
+                scope: pending.scope,
+            }, verbose);
+            clearPendingOAuthLogin(verbose);
+            await verifySavedOAuthLogin(verify, verbose);
+            return;
+        }
+        catch (err) {
+            if (!(err instanceof OAuthTokenEndpointError)) {
+                throw err;
+            }
+            if (err.error === "authorization_pending" || err.error === "slow_down") {
+                if (err.error === "slow_down") {
+                    intervalMs += 5_000;
+                }
+                if (Date.now() + intervalMs > deadline) {
+                    throw new Error("授权尚未完成。请在网页输入 6 位验证码并确认后，再运行 tyc login --resume。");
+                }
+                await sleep(intervalMs);
+                continue;
+            }
+            if (["expired_token", "access_denied", "invalid_grant"].includes(err.error)) {
+                clearPendingOAuthLogin(verbose);
+            }
+            if (err.error === "expired_token") {
+                throw new Error("OAuth device 授权已过期，请重新运行 tyc login --no-block。");
+            }
+            if (err.error === "access_denied") {
+                throw new Error("OAuth device 授权已被拒绝，请重新运行 tyc login --no-block。");
+            }
+            throw err;
+        }
+    }
+}
 export function registerLoginCommand(program) {
     program
         .command("login")
@@ -81,21 +147,40 @@ export function registerLoginCommand(program) {
         .option("--resource-metadata-url <url>", "手动指定 MCP protected resource metadata URL")
         .option("--authorization-endpoint <url>", "手动指定 OAuth authorization endpoint")
         .option("--token-endpoint <url>", "手动指定 OAuth token endpoint")
+        .option("--device-authorization-endpoint <url>", "手动指定 OAuth device authorization endpoint")
         .option("--redirect-host <host>", "本地回调 host（默认 localhost）")
         .option("--redirect-port <port>", "本地回调端口（默认 7078）")
         .option("--callback-path <path>", "本地回调路径（默认 /oauth/callback）")
         .option("--callback-token <code-or-url>", "继续非阻塞登录：传入授权回调 code 或包含 code 的完整 callback URL")
         .option("--token <code-or-url>", "同 --callback-token（兼容别名；仍需传授权回调 code）")
+        .option("--resume", "继续 RFC 8628 device flow 非阻塞登录")
         .option("--no-open", "不自动打开浏览器，只打印授权 URL")
-        .option("--no-block", "配合 --no-open：打印授权 URL 并保存 pending 状态后立即退出")
+        .option("--no-block", "打印 Device Flow 授权 URL 和 6 位验证码并保存 pending 状态后立即退出")
         .option("--no-verify", "保存 token 后跳过 shared core 鉴权校验")
         .action(async (opts) => {
         const verbose = !!program.opts().verbose;
         const callbackToken = pickCallbackToken(opts);
+        if (opts.resume) {
+            if (callbackToken) {
+                throw new Error("--resume 不能与 --callback-token/--token 同时使用。");
+            }
+            const pending = loadPendingOAuthLogin();
+            if (!pending) {
+                throw new Error("未找到待完成的 OAuth device 登录状态。请先运行 tyc login --no-block。");
+            }
+            if (!isPendingDeviceLogin(pending)) {
+                throw new Error("当前待完成的是旧版 callback 登录，请使用 tyc login --callback-token <code-or-url>。");
+            }
+            await completePendingDeviceLogin(pending, opts.verify !== false && pending.verify !== false, verbose);
+            return;
+        }
         if (callbackToken) {
             const pending = loadPendingOAuthLogin();
             if (!pending) {
-                throw new Error("未找到待完成的 OAuth 登录状态。请先运行 tyc login --no-open --no-block。");
+                throw new Error("未找到待完成的 OAuth 登录状态。请先运行 tyc login --no-block。");
+            }
+            if (!isPendingPKCELogin(pending)) {
+                throw new Error("当前待完成的是 device 登录，请在网页确认后运行 tyc login --resume。");
             }
             if (verbose) {
                 console.error(`> loaded pending OAuth login from ~/.tyc/oauth_pending.json (url=${pending.mcpURL})`);
@@ -104,9 +189,6 @@ export function registerLoginCommand(program) {
             return;
         }
         const noBlock = opts.block === false;
-        if (noBlock && opts.open !== false) {
-            throw new Error("--no-block 需要与 --no-open 一起使用。");
-        }
         const current = loadConfig() || {};
         const mcpURL = opts.url || process.env.TYC_MCP_ENDPOINT || current.url || DEFAULT_MCP_URL;
         const knownDefaults = knownOAuthDefaultsForMcpURL(mcpURL);
@@ -158,6 +240,7 @@ export function registerLoginCommand(program) {
             endpoints = {
                 authorizationEndpoint: opts.authorizationEndpoint,
                 tokenEndpoint: opts.tokenEndpoint,
+                deviceAuthorizationEndpoint: opts.deviceAuthorizationEndpoint,
                 issuer,
             };
         }
@@ -166,11 +249,16 @@ export function registerLoginCommand(program) {
             endpoints.authorizationEndpoint =
                 opts.authorizationEndpoint || endpoints.authorizationEndpoint;
             endpoints.tokenEndpoint = opts.tokenEndpoint || endpoints.tokenEndpoint;
+            endpoints.deviceAuthorizationEndpoint =
+                opts.deviceAuthorizationEndpoint || endpoints.deviceAuthorizationEndpoint;
         }
         resource ||= endpoints.resourceDocumentation || mcpURL;
         if (verbose) {
             console.error(`> authorization endpoint: ${endpoints.authorizationEndpoint}`);
             console.error(`> token endpoint: ${endpoints.tokenEndpoint}`);
+            if (endpoints.deviceAuthorizationEndpoint) {
+                console.error(`> device authorization endpoint: ${endpoints.deviceAuthorizationEndpoint}`);
+            }
             if (endpoints.registrationEndpoint) {
                 console.error(`> registration endpoint: ${endpoints.registrationEndpoint}`);
             }
@@ -187,98 +275,114 @@ export function registerLoginCommand(program) {
                 state,
                 timeoutMs: 5 * 60 * 1000,
             })).redirectUri;
-        if (!clientId) {
-            if (!endpoints.registrationEndpoint) {
-                callback?.close();
-                throw new Error("OAuth metadata 未提供 registration_endpoint，请用 --client-id 指定预注册客户端。");
-            }
-            if (verbose) {
-                console.error("> registering OAuth client via Dynamic Client Registration");
-            }
-            let registeredClient;
-            try {
-                registeredClient = await registerDynamicOAuthClient({
+        try {
+            if (!clientId) {
+                if (!endpoints.registrationEndpoint) {
+                    throw new Error("OAuth metadata 未提供 registration_endpoint，请用 --client-id 指定预注册客户端。");
+                }
+                if (verbose) {
+                    console.error("> registering OAuth client via Dynamic Client Registration");
+                }
+                const registeredClient = await registerDynamicOAuthClient({
                     registrationEndpoint: endpoints.registrationEndpoint,
                     clientName: "tyc-cli",
                     redirectUris: [redirectUri],
+                    grantTypes: noBlock
+                        ? ["authorization_code", "refresh_token", DEVICE_CODE_GRANT_TYPE]
+                        : undefined,
+                    responseTypes: ["code"],
                     tokenEndpointAuthMethod: "none",
                 });
+                clientId = registeredClient.clientId;
+                clientSecret ||= registeredClient.clientSecret;
+                if (verbose) {
+                    console.error(`> registered client_id: ${clientId}`);
+                }
             }
-            catch (err) {
-                callback?.close();
-                throw err;
+            if (noBlock) {
+                if (!endpoints.deviceAuthorizationEndpoint) {
+                    throw new Error("OAuth metadata 未提供 device_authorization_endpoint，请升级授权服务或使用 --device-authorization-endpoint 指定。");
+                }
+                const device = await requestDeviceAuthorization({
+                    deviceAuthorizationEndpoint: endpoints.deviceAuthorizationEndpoint,
+                    clientId,
+                    clientSecret,
+                    scope,
+                    resource,
+                });
+                savePendingOAuthLogin({
+                    version: 2,
+                    flow: "device",
+                    createdAt: Date.now(),
+                    mcpURL,
+                    tokenEndpoint: endpoints.tokenEndpoint,
+                    clientId,
+                    clientSecret,
+                    deviceCode: device.device_code,
+                    userCode: device.user_code,
+                    verificationUri: device.verification_uri,
+                    expiresAt: Date.now() + device.expires_in * 1000,
+                    interval: device.interval || 5,
+                    resource,
+                    scope,
+                    verify: opts.verify !== false,
+                });
+                console.error("请在浏览器打开以下 URL 完成登录：");
+                console.error(device.verification_uri);
+                console.error("");
+                console.error(`验证码：${device.user_code}`);
+                console.error("");
+                console.error("在网页输入 6 位验证码并确认授权后，运行：");
+                console.error("tyc login --resume");
+                return;
             }
-            clientId = registeredClient.clientId;
-            clientSecret ||= registeredClient.clientSecret;
+            const authorizationURL = buildAuthorizationURL({
+                authorizationEndpoint: endpoints.authorizationEndpoint,
+                clientId,
+                redirectUri,
+                scope,
+                state,
+                codeChallenge: pkce.codeChallenge,
+                resource,
+            });
             if (verbose) {
-                console.error(`> registered client_id: ${clientId}`);
+                console.error(`> OAuth callback: ${redirectUri}`);
             }
-        }
-        const authorizationURL = buildAuthorizationURL({
-            authorizationEndpoint: endpoints.authorizationEndpoint,
-            clientId,
-            redirectUri,
-            scope,
-            state,
-            codeChallenge: pkce.codeChallenge,
-            resource,
-        });
-        if (verbose) {
-            console.error(`> OAuth callback: ${redirectUri}`);
-        }
-        if (noBlock) {
-            savePendingOAuthLogin({
-                version: 1,
-                createdAt: Date.now(),
-                mcpURL,
+            if (opts.open === false) {
+                console.error("请在浏览器打开以下 URL 完成登录：");
+                console.error(authorizationURL);
+            }
+            else {
+                console.error("正在打开浏览器完成 OAuth 登录...");
+                openBrowser(authorizationURL);
+            }
+            if (!callback) {
+                throw new Error("OAuth callback server not initialized");
+            }
+            const code = await callback.waitForCode();
+            if (verbose) {
+                console.error("> authorization code received; exchanging access token");
+            }
+            const token = await exchangeAuthorizationCode({
                 tokenEndpoint: endpoints.tokenEndpoint,
                 clientId,
                 clientSecret,
+                code,
                 redirectUri,
                 codeVerifier: pkce.codeVerifier,
                 resource,
-                state,
-                verify: opts.verify !== false,
             });
-            console.error("请在浏览器打开以下 URL 完成登录：");
-            console.error(authorizationURL);
-            console.error("");
-            console.error("完成授权后，浏览器会打开天眼查 CLI 回调页。请按页面提示复制命令到终端执行。");
-            console.error("也可以复制完整回调 URL 后运行：");
-            console.error(`tyc login --callback-token "${redirectUri}?code=...&state=..."`);
-            return;
-        }
-        if (opts.open === false) {
-            console.error("请在浏览器打开以下 URL 完成登录：");
-            console.error(authorizationURL);
-        }
-        else {
-            console.error("正在打开浏览器完成 OAuth 登录...");
-            openBrowser(authorizationURL);
-        }
-        if (!callback) {
-            throw new Error("OAuth callback server not initialized");
+            saveOAuthTokenConfig(mcpURL, token, {
+                tokenEndpoint: endpoints.tokenEndpoint,
+                clientId,
+                clientSecret,
+                resource,
+            }, verbose);
+            clearPendingOAuthLogin(verbose);
+            await verifySavedOAuthLogin(opts.verify !== false, verbose);
         }
-        const code = await callback.waitForCode();
-        if (verbose) {
-            console.error("> authorization code received; exchanging access token");
+        finally {
+            callback?.close();
         }
-        const token = await exchangeAuthorizationCode({
-            tokenEndpoint: endpoints.tokenEndpoint,
-            clientId,
-            clientSecret,
-            code,
-            redirectUri,
-            codeVerifier: pkce.codeVerifier,
-            resource,
-        });
-        saveOAuthTokenConfig(mcpURL, token, {
-            tokenEndpoint: endpoints.tokenEndpoint,
-            clientId,
-            clientSecret,
-            resource,
-        }, verbose);
-        clearPendingOAuthLogin(verbose);
-        await verifySavedOAuthLogin(opts.verify !== false, verbose);
     });
 }

package/dist/commands/output.js

@@ -3,13 +3,11 @@ import { applyTruncation, resolveOptionalInt, TRUNCATE_DEFAULTS, } from "../util
 export function emitToolResult(result, opts, toolName) {
     if (result.isError) {
         const errText = extractText(result) || "未知业务错误";
-        console.error(errText);
-        process.exit(1);
+        throw new Error(errText);
     }
     const text = extractText(result);
     if (text === null) {
-        console.error("tools/call 返回无可解析内容");
-        process.exit(1);
+        throw new Error("tools/call 返回无可解析内容");
     }
     let payload;
     try {

package/dist/config.js

@@ -109,8 +109,7 @@ export function resolveConfig() {
         headers.Authorization = process.env.TYC_AUTHORIZATION;
     }
     if (!headers.Authorization) {
-        console.error("未配置 Authorization。请先运行：tyc init --authorization YOUR_API_KEY");
-        process.exit(1);
+        throw new Error("未配置 Authorization。请先运行：tyc init --authorization YOUR_API_KEY");
     }
     return { url, coreUrl, headers, oauth: cfg.oauth ? { ...cfg.oauth } : undefined };
 }

package/dist/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { Command } from "commander";
+import { Command, CommanderError } from "commander";
 import { registerInitCommand } from "./commands/init.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerCategoryCommands } from "./commands/category.js";
@@ -67,8 +67,9 @@ ${renderCategoryLines()}
 初始化与登录
 
   tyc login                                             OAuth 浏览器登录
-  tyc login --no-open --no-block                       打印 OAuth URL 后立即退出，手动完成
-  tyc login --callback-token <CODE_OR_CALLBACK_URL>    继续非阻塞 OAuth 登录
+  tyc login --no-block                                 打印 Device Flow URL 和 6 位验证码后立即退出
+  tyc login --resume                                   继续非阻塞 Device Flow 登录
+  tyc login --callback-token <CODE_OR_CALLBACK_URL>    继续旧版 callback OAuth 登录
   tyc login --url <MCP_URL>                             登录本地、预发或自托管 MCP
   tyc init --authorization <KEY>                        使用 API Key 兼容路径
   tyc init --url <MCP_URL> --authorization <KEY>        配置本地或自托管服务
@@ -92,6 +93,7 @@ function renderPriorityLines() {
     return lines.join("\n");
 }
 const program = new Command()
+    .exitOverride()
     .name("tyc")
     .description(`天眼查 AI CLI：${getTotalCount()} 个商业数据工具 · L0=${getLayerCount("L0")} L1=${getLayerCount("L1")} L2=${getLayerCount("L2")} L3=${getLayerCount("L3")} · 面向 Agent 的 MCP 工具网关`)
     .version(VERSION, "-V, --version", "输出版本号")
@@ -124,7 +126,14 @@ registerLoginCommand(program);
 registerLayerCommands(program);
 registerCategoryCommands(program);
 program.parseAsync(process.argv).catch((err) => {
+    // Commander has already printed help/version/argument errors. Preserve its
+    // exit status without printing twice or interrupting pending stream writes.
+    if (err instanceof CommanderError) {
+        process.exitCode = err.exitCode;
+        return;
+    }
     const msg = err instanceof Error ? err.message : String(err);
     console.error(msg);
-    process.exit(1);
+    // Let Node finish asynchronous I/O and teardown (including fetch on Windows).
+    process.exitCode = 1;
 });