vps-work 2.4.1 → 2.5.1

package/dist/packages/vps-work/src/core/mcp-client.js

@@ -0,0 +1,129 @@
+import { VertuError } from './errors.js';
+const PROTOCOL = '2025-03-26';
+const MAX_RESPONSE_BYTES = 8 * 1024 * 1024;
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+function rpcResult(value, id) {
+    const rpc = record(value);
+    if (rpc.id !== id)
+        return undefined;
+    if (rpc.error)
+        throw new VertuError('MCP 请求失败，请检查工具参数和服务端授权。');
+    if (!('result' in rpc))
+        throw new VertuError('MCP 返回了无效响应。');
+    return record(rpc.result);
+}
+async function readResult(response, id) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new VertuError('MCP 返回了空响应。');
+    const sse = response.headers.get('content-type')?.includes('text/event-stream');
+    const decoder = new TextDecoder();
+    let buffer = '';
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done) {
+                buffer += decoder.decode();
+                break;
+            }
+            size += chunk.value.byteLength;
+            if (size > MAX_RESPONSE_BYTES)
+                throw new VertuError('MCP 结果过大，请缩小查询范围。');
+            buffer += decoder.decode(chunk.value, { stream: true });
+            if (sse) {
+                let boundary;
+                while ((boundary = /\r?\n\r?\n/.exec(buffer))) {
+                    const frame = buffer.slice(0, boundary.index);
+                    buffer = buffer.slice(boundary.index + boundary[0].length);
+                    const data = frame.split(/\r?\n/).filter(line => line.startsWith('data:'))
+                        .map(line => line.slice(5).replace(/^ /, '')).join('\n');
+                    if (!data)
+                        continue;
+                    const result = rpcResult(JSON.parse(data), id);
+                    if (result)
+                        return result;
+                }
+            }
+        }
+        if (!sse) {
+            const result = rpcResult(JSON.parse(buffer), id);
+            if (result)
+                return result;
+        }
+        throw new VertuError('MCP 未返回匹配的请求结果。');
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+}
+export async function runMcp(endpoint, authorizationHeaders, allowedTools, operation) {
+    let sessionId;
+    let protocol = PROTOCOL;
+    let nextId = 0;
+    const headers = () => ({
+        ...authorizationHeaders, 'content-type': 'application/json', accept: 'application/json, text/event-stream',
+        'mcp-protocol-version': protocol, ...(sessionId ? { 'mcp-session-id': sessionId } : {}),
+    });
+    const send = async (method, params, notification = false) => {
+        const id = ++nextId;
+        const response = await fetch(endpoint, {
+            method: 'POST', headers: headers(), redirect: 'error', signal: AbortSignal.timeout(60_000),
+            body: JSON.stringify({ jsonrpc: '2.0', ...(notification ? {} : { id }), method, params }),
+        });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new VertuError(`MCP 请求被拒绝或服务不可用（HTTP ${response.status}）。`, { statusCode: response.status });
+        }
+        if (method === 'initialize')
+            sessionId = response.headers.get('mcp-session-id') || undefined;
+        if (notification) {
+            await response.body?.cancel();
+            return {};
+        }
+        return readResult(response, id);
+    };
+    try {
+        const initialized = await send('initialize', {
+            protocolVersion: PROTOCOL, capabilities: {}, clientInfo: { name: 'vps-work', version: '1' },
+        });
+        if (initialized.protocolVersion !== PROTOCOL)
+            throw new VertuError('MCP 协议版本不兼容。');
+        protocol = initialized.protocolVersion;
+        await send('notifications/initialized', undefined, true);
+        const tools = [];
+        const cursors = new Set();
+        let cursor;
+        do {
+            const page = await send('tools/list', cursor ? { cursor } : {});
+            if (!Array.isArray(page.tools))
+                throw new VertuError('MCP 工具目录无效。');
+            tools.push(...page.tools.map(record).filter(tool => allowedTools.has(String(tool.name))));
+            cursor = typeof page.nextCursor === 'string' && page.nextCursor ? page.nextCursor : undefined;
+            if (cursor && (cursors.has(cursor) || cursors.size >= 100))
+                throw new VertuError('MCP 工具目录分页异常。');
+            if (cursor)
+                cursors.add(cursor);
+        } while (cursor);
+        if (!operation)
+            return { tools };
+        if (!tools.some(tool => tool.name === operation.tool))
+            throw new VertuError('当前 MCP 未开放该工具。');
+        const result = await send('tools/call', { name: operation.tool, arguments: operation.arguments });
+        if (result.isError === true)
+            throw new VertuError('MCP 工具执行失败，请检查参数、SQL 和服务端授权。');
+        return result;
+    }
+    catch (error) {
+        if (error instanceof VertuError)
+            throw error;
+        // Transport/parser exceptions must not expose credentials or request bodies.
+        throw new VertuError('MCP 通信失败，请检查网络和服务状态。');
+    }
+    finally {
+        if (sessionId) {
+            await fetch(endpoint, { method: 'DELETE', headers: headers(), redirect: 'error', signal: AbortSignal.timeout(5_000) })
+                .then(response => response.body?.cancel()).catch(() => { });
+        }
+    }
+}

package/dist/packages/vps-work/src/core/office-client.js

@@ -0,0 +1,25 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homeDir } from './paths.js';
+/** Credentials stay in a mode-0600 file; never accept remote URLs for local file authority. */
+export async function officeRequest(action, body = {}, connectionFile) {
+    const path = connectionFile ?? process.env.VPS_OFFICE_CONNECTION_FILE ?? join(homeDir(), 'office.json');
+    let config;
+    try {
+        config = JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch {
+        throw new Error('未发现本机 VPS Office。请启动新版 VPS 桌面端，或设置 VPS_OFFICE_CONNECTION_FILE。');
+    }
+    const url = new URL(config.url);
+    if (url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.username || url.password || !config.token || config.protocolVersion !== 1)
+        throw new Error('Office 连接配置无效。');
+    const response = await fetch(new URL(`/office/${action}`, url), {
+        method: 'POST', redirect: 'error', signal: AbortSignal.timeout(120000),
+        headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${config.token}` }, body: JSON.stringify(body),
+    });
+    const result = await response.json();
+    if (!response.ok)
+        throw new Error(result.error ?? `Office HTTP ${response.status}`);
+    return result;
+}

package/dist/packages/vps-work/src/core/office-files.js

@@ -0,0 +1,82 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { open, readFile, realpath, rename, rm, stat, link } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, extname, join, resolve } from 'node:path';
+import { packageRootDir } from './paths.js';
+export function officeRuntime() {
+    const path = join(packageRootDir(), 'dist/office-runtime.cjs');
+    try {
+        return createRequire(path)(path);
+    }
+    catch (error) {
+        throw new Error(`Office runtime 无法加载，请重新安装完整 vps-work 包（源码开发先 npm run build）。${String(error)}`);
+    }
+}
+export function officeFormat(path) {
+    const format = extname(path).slice(1).toLowerCase();
+    if (!['docx', 'xlsx', 'pptx', 'md'].includes(format))
+        throw new Error('支持 .docx / .xlsx / .pptx / .md。');
+    return format;
+}
+export function officeVersion(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+export async function readOfficeFile(path) {
+    const file = await realpath(path);
+    const bytes = await readFile(file);
+    const format = officeFormat(file);
+    return { file, format, version: officeVersion(bytes), content: await officeRuntime().readDocument(format, bytes) };
+}
+/** Lock cooperating writers, compare immediately before rename, never truncate the source. */
+async function writeAtomic(path, bytes, expected) {
+    const file = expected === undefined ? resolve(path) : await realpath(path);
+    const lock = `${file}.vps-office.lock`;
+    const handle = await open(lock, 'wx', 0o600).catch(() => { throw new Error(`文件正在修改或存在未清理锁：${lock}`); });
+    const temp = join(dirname(file), `.${randomUUID()}.office.tmp`);
+    try {
+        const mode = expected === undefined ? 0o600 : (await stat(file)).mode;
+        const output = await open(temp, 'wx', mode);
+        try {
+            await output.writeFile(bytes);
+            await output.sync();
+        }
+        finally {
+            await output.close();
+        }
+        if (expected !== undefined) {
+            if (officeVersion(await readFile(file)) !== expected)
+                throw new Error('文件版本冲突，请重新读取后修改。');
+            await rename(temp, file);
+        }
+        else {
+            // Hard link gives atomic create-if-absent, including races with other processes.
+            await link(temp, file);
+        }
+    }
+    finally {
+        await rm(temp, { force: true });
+        await handle.close();
+        await rm(lock, { force: true });
+    }
+}
+export async function createOfficeFile(path, spec) {
+    const format = officeFormat(path);
+    const bytes = await officeRuntime().createDocument(format, spec);
+    await officeRuntime().readDocument(format, bytes);
+    await writeAtomic(path, bytes);
+    return { file: resolve(path), format, version: officeVersion(bytes), size: bytes.length };
+}
+export async function applyOfficeFile(path, changes, expected, output, dryRun = false) {
+    const file = await realpath(path);
+    const format = officeFormat(file);
+    if (output && officeFormat(output) !== format)
+        throw new Error('输出文件扩展名必须与源文件相同。');
+    const original = await readFile(file);
+    if (officeVersion(original) !== expected)
+        throw new Error('文件版本冲突，请重新读取后修改。');
+    const bytes = await officeRuntime().applyDocument(format, original, changes);
+    const content = await officeRuntime().readDocument(format, bytes);
+    if (!dryRun)
+        await writeAtomic(output ?? file, bytes, output && resolve(output) !== file ? undefined : expected);
+    return { file: resolve(output ?? file), format, version: officeVersion(bytes), previousVersion: expected, dryRun, content };
+}

package/dist/packages/vps-work/src/core/paths.js

@@ -0,0 +1,70 @@
+import { createHash } from 'node:crypto';
+import { realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+/** 本包独立会话目录，不共用 vertu-cli 的 `~/.vertu`。 */
+const HOME_DIR_NAME = '.vps-work';
+/** 与 larksuite/cli 一致：包根目录下的 skill 源目录名。 */
+export const PACKAGE_SKILLS_DIR_NAME = 'skills';
+/**
+ * 从已解析的入口脚本路径推导 npm 包根（`dist/vps-work.cjs` 或 `src/bin/vps-work.ts` 的上一级）。
+ */
+function packageRootFromEntryScript(resolvedEntry) {
+    const entryBase = basename(resolvedEntry);
+    const entryDir = dirname(resolvedEntry);
+    const entryParent = basename(entryDir);
+    if (entryBase === 'vps-work.cjs' && entryParent === 'dist') {
+        return join(entryDir, '..');
+    }
+    if (entryBase === 'vps-work.ts' && entryParent === 'bin') {
+        return join(entryDir, '..', '..');
+    }
+    return undefined;
+}
+/**
+ * 当前运行的 `vps-work` npm 包根目录（`dist/vps-work.cjs` 的上一级）。
+ * 全局安装时 `argv[1]` 常为 `.../bin/vps-work` 符号链接，须 `realpath` 后再推导。
+ */
+export function packageRootDir() {
+    const bin = process.argv[1];
+    if (bin) {
+        try {
+            const resolved = realpathSync(resolve(bin));
+            const fromEntry = packageRootFromEntryScript(resolved);
+            if (fromEntry) {
+                return fromEntry;
+            }
+        }
+        catch {
+            // 入口路径不可读时走下方回退
+        }
+    }
+    if (typeof __dirname !== 'undefined' && basename(__dirname) === 'dist') {
+        return join(__dirname, '..');
+    }
+    return process.cwd();
+}
+/** 包内 `skills/` 绝对路径（随 npm 包分发，供 Agent 只读引用）。 */
+export function packageSkillsDir() {
+    return join(packageRootDir(), PACKAGE_SKILLS_DIR_NAME);
+}
+export function homeDir() {
+    const configured = process.env.VPS_WORK_HOME?.trim();
+    if (configured) {
+        if (!isAbsolute(configured))
+            throw new Error('VPS_WORK_HOME must be an absolute directory');
+        return configured;
+    }
+    return join(homedir(), HOME_DIR_NAME);
+}
+export function configFilePath() {
+    return join(homeDir(), 'config.json');
+}
+/** vps-work → 独立 vps-service 连接配置（与 Odoo login 的 config.json 分离）。 */
+export function vpsServiceConfigFilePath() {
+    return join(homeDir(), 'vps-service.json');
+}
+export function hashBaseUrl(baseUrl) {
+    const normalized = baseUrl.replace(/\/+$/, '').toLowerCase();
+    return createHash('sha1').update(normalized).digest('hex').slice(0, 12);
+}

package/dist/packages/vps-work/src/core/public-result.js

@@ -0,0 +1,43 @@
+/** Keep infrastructure provenance out of CLI-visible business responses. */
+export function publicBusinessResult(value) {
+    if (Array.isArray(value))
+        return value.map(publicBusinessResult);
+    if (!value || typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        if (key === 'odoo_user_id') {
+            out.user_id ??= publicBusinessResult(item);
+            continue;
+        }
+        if ((key === 'database' || key === 'db') && typeof item === 'string' && /^odoo$/i.test(item))
+            continue;
+        if (key === 'source' && typeof item === 'string' && /^odoo(?:\b|[_-])/i.test(item)) {
+            out.source = 'vps';
+            continue;
+        }
+        if (key === 'source' && item && typeof item === 'object' && !Array.isArray(item)) {
+            const { db: _db, database: _database, login: _login, base_url: _baseUrl, ...source } = item;
+            out.source = publicBusinessResult(source);
+            continue;
+        }
+        out[key] = publicBusinessResult(item);
+    }
+    return out;
+}
+export function publicBusinessErrorMessage(value) {
+    const message = String(value ?? '');
+    if (!/odoo/i.test(message))
+        return message;
+    const status = /HTTP\s+(\d{3})\b/i.exec(message)?.[0];
+    const detail = status ? `（${status}）` : '';
+    if (/AccessDenied|forbidden|权限|HTTP\s+403\b/i.test(message))
+        return `无权访问该业务数据${detail}`;
+    if (/session|not authenticated|unauthorized|登录|会话|HTTP\s+401\b/i.test(message))
+        return `VPS 登录凭证已失效，请通过宿主刷新${detail}`;
+    if (/RATE_LIMITED|rate.?limit|限流/i.test(message)) {
+        const fields = message.match(/(?:limit_type|retry_after_seconds)=[\w]+/g) ?? [];
+        return `业务查询触发限流${detail}${fields.length ? `：${fields.join(' ')}` : ''}`;
+    }
+    return `业务数据服务暂不可用${detail}`;
+}

package/dist/packages/vps-work/src/core/sales-invoice-attachments-client.js

@@ -0,0 +1,75 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { request } from 'undici';
+import { VertuError } from './errors.js';
+import { resolveVpsServiceIdentity } from './sales-query-client.js';
+import { vpsServiceAuthHeaders } from './vps-service-http.js';
+async function errorMessage(status, text) {
+    try {
+        const payload = JSON.parse(text);
+        return new VertuError(payload.error ? String(payload.error) : `HTTP ${status}`);
+    }
+    catch {
+        return new VertuError(`Invoice attachment request failed: HTTP ${status}`);
+    }
+}
+function safeFileName(value) {
+    return value.replace(/[\r\n"\\/:*?<>|]/g, '_').slice(0, 180) || 'invoice-attachment';
+}
+function serviceHeaders(extra) {
+    const headers = { ...vpsServiceAuthHeaders(), ...extra };
+    const identity = resolveVpsServiceIdentity();
+    if (identity.login && !headers['x-vertu-user-login']) {
+        headers['x-vps-user-login'] = encodeURIComponent(identity.login);
+    }
+    return headers;
+}
+export async function listSalesInvoiceAttachments(baseUrl, orderNo) {
+    const query = new URLSearchParams({ order_no: orderNo });
+    const response = await request(`${baseUrl}/v1/sales/invoice-attachments?${query}`, {
+        method: 'GET',
+        headers: serviceHeaders({ accept: 'application/json' }),
+    });
+    const text = await response.body.text();
+    if (response.statusCode >= 400)
+        throw await errorMessage(response.statusCode, text);
+    try {
+        const payload = JSON.parse(text);
+        if (!payload.result)
+            throw new Error('missing result');
+        return payload.result;
+    }
+    catch {
+        throw new VertuError('Invoice attachment list returned invalid JSON.');
+    }
+}
+export async function downloadSalesInvoiceAttachments(baseUrl, items, outputDir) {
+    const directory = resolve(outputDir);
+    await mkdir(directory, { recursive: true });
+    const outputs = [];
+    for (const item of items) {
+        const fallback = `${item.order_no}_${item.move_id}_${item.index + 1}.${item.file_type || 'bin'}`;
+        const prefix = `${safeFileName(item.order_no)}_${item.move_id}_${item.index + 1}_`;
+        const output = join(directory, `${prefix}${safeFileName(item.name || fallback)}`);
+        const response = await request(`${baseUrl}/v1/sales/invoice-attachments/download`, {
+            method: 'POST',
+            headers: serviceHeaders({ 'content-type': 'application/json' }),
+            body: JSON.stringify({ order_no: item.order_no, move_id: item.move_id, index: item.index }),
+        });
+        const bytes = Buffer.from(await response.body.arrayBuffer());
+        if (response.statusCode >= 400)
+            throw await errorMessage(response.statusCode, bytes.toString('utf8'));
+        await writeFile(output, bytes, { flag: 'wx' }).catch((error) => {
+            if (error.code === 'EEXIST')
+                throw new VertuError(`Output already exists: ${output}`);
+            throw error;
+        });
+        outputs.push({
+            output,
+            bytes: bytes.length,
+            contentType: typeof response.headers['content-type'] === 'string'
+                ? response.headers['content-type'] : null,
+        });
+    }
+    return outputs;
+}