vps-work 2.5.0 → 2.5.1

package/dist/packages/vps-work/src/commands/tools/index.js

@@ -0,0 +1,127 @@
+import { readFile, stat } from 'node:fs/promises';
+import { basename, extname, resolve } from 'node:path';
+import { Command } from 'commander';
+import { FormData } from 'undici';
+import { VertuError } from '../../core/errors.js';
+import { vpsServiceGet, vpsServiceMultipartPost } from '../../core/sales-query-client.js';
+import { attachSharedShortcutOptions, parseOptionalInt, resolveShortcutVpsServiceUrl, } from '../shortcut-common.js';
+const MAX_OSS_UPLOAD_BYTES = 50 * 1024 * 1024;
+/** 平台公共工具域；后续非业务域能力统一在 `tools +…` 下扩展。 */
+export function buildToolsCommand() {
+    const command = new Command('tools')
+        .description('平台公共工具：OSS 上传、地址签名等跨业务能力。');
+    attachSharedShortcutOptions(command
+        .command('+oss-upload')
+        .description('上传文件到 OSS，返回公开地址或限时签名地址')
+        .requiredOption('--file <path>', '本地文件路径')
+        .option('--visibility <private|public>', '访问方式；默认 private', 'private')
+        .option('--object-name <path>', '身份隔离目录内的相对对象名')
+        .option('--content-type <mime>', '显式 MIME；默认按扩展名推断')
+        .option('--signed-url-expires <seconds>', '签名 URL 有效秒数（60～604800）', '3600')).action(async (opts, parent) => {
+        const filePath = resolve(opts.file?.trim() ?? '');
+        const fileStat = await stat(filePath).catch(() => null);
+        if (!fileStat?.isFile())
+            throw new VertuError(`文件不存在或不是普通文件：${filePath}`);
+        if (fileStat.size <= 0)
+            throw new VertuError('文件内容为空。');
+        if (fileStat.size > MAX_OSS_UPLOAD_BYTES)
+            throw new VertuError('文件超过 50 MiB 上限。');
+        const visibility = normalizeVisibility(opts.visibility);
+        const expires = parseOptionalInt(opts.signedUrlExpires, '--signed-url-expires') ?? 3600;
+        if (expires < 60 || expires > 7 * 24 * 60 * 60) {
+            throw new VertuError('--signed-url-expires 必须在 60 到 604800 秒之间。');
+        }
+        const baseUrl = resolveShortcutVpsServiceUrl(opts, parent);
+        const contentType = opts.contentType?.trim() || mimeType(filePath);
+        if (opts.validateOnly === true || opts.dryRun === true) {
+            print(opts, {
+                content_type: contentType,
+                endpoint: `${baseUrl}/v1/oss/upload`,
+                file: filePath,
+                object_name: opts.objectName?.trim() || null,
+                signed_url_expires: expires,
+                size: fileStat.size,
+                validateOnly: true,
+                visibility,
+            });
+            return;
+        }
+        const form = new FormData();
+        form.append('file', new Blob([await readFile(filePath)], { type: contentType }), basename(filePath));
+        form.append('visibility', visibility);
+        form.append('signed_url_expires', String(expires));
+        if (opts.objectName?.trim())
+            form.append('object_name', opts.objectName.trim());
+        const response = await vpsServiceMultipartPost('/v1/oss/upload', form, baseUrl, 'OSS 文件上传');
+        const upload = response && typeof response === 'object' && 'upload' in response
+            ? response.upload
+            : response;
+        print(opts, upload);
+    });
+    attachSharedShortcutOptions(command
+        .command('+attachment-parse')
+        .description('按 documentId 启动并读取附件解析；复杂 PDF/Office/扫描件按需调用')
+        .requiredOption('--document-id <uuid>', '附件登记返回的 documentId')
+        .option('--no-wait', '只触发/查询一次，不等待解析完成')
+        .option('--timeout <seconds>', '等待上限秒数', '600')
+        .option('--poll-interval <seconds>', '轮询间隔秒数', '2')).action(async (opts, parent) => {
+        const documentId = opts.documentId?.trim() || '';
+        if (!/^[0-9a-f-]{36}$/i.test(documentId))
+            throw new VertuError('--document-id 必须是 UUID。');
+        const timeout = parseOptionalInt(opts.timeout, '--timeout') ?? 600;
+        const pollInterval = parseOptionalInt(opts.pollInterval, '--poll-interval') ?? 2;
+        if (timeout < 1 || timeout > 600)
+            throw new VertuError('--timeout 必须在 1 到 600 秒之间。');
+        if (pollInterval < 1 || pollInterval > 30)
+            throw new VertuError('--poll-interval 必须在 1 到 30 秒之间。');
+        const baseUrl = resolveShortcutVpsServiceUrl(opts, parent);
+        if (opts.validateOnly === true || opts.dryRun === true) {
+            print(opts, { document_id: documentId, endpoint: `${baseUrl}/v1/im/agents/documents/${documentId}`, wait: opts.wait !== false, validateOnly: true });
+            return;
+        }
+        const deadline = Date.now() + timeout * 1000;
+        while (true) {
+            const result = await vpsServiceGet(`/v1/im/agents/documents/${encodeURIComponent(documentId)}`, { include_content: 1 }, baseUrl, '附件解析');
+            const status = result.document?.status || '';
+            if (status === 'ready') {
+                print(opts, result);
+                return;
+            }
+            if (status === 'failed')
+                throw new VertuError(result.document?.error_message || '附件解析失败。');
+            if (opts.wait === false || Date.now() >= deadline) {
+                if (opts.wait !== false)
+                    throw new VertuError(`附件解析等待超过 ${timeout} 秒。`);
+                print(opts, result);
+                return;
+            }
+            await new Promise((resolvePromise) => setTimeout(resolvePromise, pollInterval * 1000));
+        }
+    });
+    return command;
+}
+function normalizeVisibility(value) {
+    const normalized = value?.trim().toLowerCase() || 'private';
+    if (normalized !== 'private' && normalized !== 'public') {
+        throw new VertuError('--visibility 仅支持 private 或 public。');
+    }
+    return normalized;
+}
+function print(opts, value) {
+    console.log(opts.json === false && typeof value === 'string' ? value : JSON.stringify(value, null, 2));
+}
+function mimeType(name) {
+    const types = {
+        '.csv': 'text/csv', '.doc': 'application/msword',
+        '.docx': 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+        '.gif': 'image/gif', '.html': 'text/html', '.jpeg': 'image/jpeg', '.jpg': 'image/jpeg',
+        '.json': 'application/json', '.md': 'text/markdown', '.mp3': 'audio/mpeg',
+        '.mp4': 'video/mp4', '.pdf': 'application/pdf', '.png': 'image/png',
+        '.ppt': 'application/vnd.ms-powerpoint',
+        '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
+        '.svg': 'image/svg+xml', '.txt': 'text/plain', '.wav': 'audio/wav',
+        '.webm': 'video/webm', '.webp': 'image/webp', '.xls': 'application/vnd.ms-excel',
+        '.xlsx': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', '.zip': 'application/zip',
+    };
+    return types[extname(name).toLowerCase()] ?? 'application/octet-stream';
+}

package/dist/packages/vps-work/src/commands/vemory/index.js

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+import { attachVemoryShortcuts } from './shortcuts.js';
+export function buildVemoryCommand() {
+    const vemory = new Command('vemory').description('Legacy Vemory meeting commands (prefer: meeting +list).');
+    attachVemoryShortcuts(vemory);
+    return vemory;
+}

package/dist/packages/vps-work/src/commands/vemory/shortcuts.js

@@ -0,0 +1,53 @@
+import { VertuError } from '../../core/errors.js';
+import { vpsServiceGet } from '../../core/sales-query-client.js';
+import { attachSharedShortcutOptions, resolveShortcutVpsServiceUrl, } from '../shortcut-common.js';
+function assertYmd(raw, flag) {
+    const value = raw?.trim();
+    if (!value) {
+        return undefined;
+    }
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+        throw new VertuError(`${flag} 需为 YYYY-MM-DD。`);
+    }
+    return value;
+}
+function resolveScope(raw) {
+    const value = raw?.trim().toLowerCase();
+    if (value === 'team') {
+        return 'team';
+    }
+    if (value && value !== 'mine') {
+        throw new VertuError('--scope 仅支持 mine 或 team。');
+    }
+    return 'mine';
+}
+function printResult(opts, out) {
+    if (opts.json !== false) {
+        console.log(JSON.stringify(out, null, 2));
+    }
+    else {
+        console.log(typeof out === 'string' ? out : JSON.stringify(out));
+    }
+}
+export function attachVemoryShortcuts(parent) {
+    attachSharedShortcutOptions(parent
+        .command('+meetings')
+        .description('兼容入口：会议列表（推荐改用 meeting +list）')
+        .option('--scope <scope>', 'mine（本人）或 team（递归下属）', 'mine')
+        .option('--employee-name <name>', '按员工姓名精确查询会议')
+        .option('--start-date <ymd>', 'YYYY-MM-DD，省略=近 30 天')
+        .option('--end-date <ymd>', 'YYYY-MM-DD，省略=today')
+        .option('--template-type <type>', '按纪要模版类型精确筛选（如：团队内部会议）')
+        .option('--keyword <text>', '主题/摘要/章节/待办子串')).action(async (opts, cmd) => {
+        const serviceBaseUrl = resolveShortcutVpsServiceUrl(opts, cmd);
+        const result = await vpsServiceGet('/v1/meeting-center/meetings', {
+            scope: opts.employeeName?.trim() ? undefined : resolveScope(opts.scope),
+            employee_name: opts.employeeName?.trim() || undefined,
+            start_date: assertYmd(opts.startDate, '--start-date'),
+            end_date: assertYmd(opts.endDate, '--end-date'),
+            template_type: opts.templateType?.trim() || undefined,
+            keyword: opts.keyword?.trim() || undefined,
+        }, serviceBaseUrl, 'Vertu 会议中心');
+        printResult(opts, result);
+    });
+}

package/dist/packages/vps-work/src/commands/vertu-aisales.js

@@ -0,0 +1,30 @@
+import { Command } from 'commander';
+import { VertuError } from '../core/errors.js';
+import { listAiSalesServices, runAiSalesMcp } from '../core/aisales-mcp-client.js';
+import { expandAtFileToken } from '../utils/at-file.js';
+export function buildVertuAiSalesCommand() {
+    const command = new Command('vertu-aisales').description('VERTU 客户沟通查询（当前企业和员工数据授权）');
+    command.command('services').description('列出当前账号可用的 AI Sales 服务实例')
+        .action(async () => console.log(JSON.stringify({ items: await listAiSalesServices() }, null, 2)));
+    command.command('tools').description('发现可调用工具和参数 schema')
+        .option('--service-id <id>', '企业 MCP 服务实例 ID')
+        .action(async (opts) => console.log(JSON.stringify(await runAiSalesMcp(undefined, opts.serviceId), null, 2)));
+    command.command('call').description('调用 AINativeSales 销售只读工具；先发现业务对象与指标')
+        .requiredOption('--tool <name>', 'tools 返回的工具名')
+        .option('--args <json>', 'JSON 对象，支持 @file / @-', '{}')
+        .option('--service-id <id>', '企业 MCP 服务实例 ID')
+        .action(async (opts) => {
+        const raw = await expandAtFileToken(opts.args, '--args');
+        let args;
+        try {
+            args = JSON.parse(raw);
+        }
+        catch {
+            throw new VertuError('--args 必须是 JSON 对象。');
+        }
+        if (!args || typeof args !== 'object' || Array.isArray(args))
+            throw new VertuError('--args 必须是 JSON 对象。');
+        console.log(JSON.stringify(await runAiSalesMcp({ tool: opts.tool, arguments: args }, opts.serviceId), null, 2));
+    });
+    return command;
+}

package/dist/packages/vps-work/src/commands/vertu-erp.js

@@ -0,0 +1,30 @@
+import { Command } from 'commander';
+import { VertuError } from '../core/errors.js';
+import { runErpMcp } from '../core/erp-mcp-client.js';
+import { expandAtFileToken } from '../utils/at-file.js';
+export function buildVertuErpCommand() {
+    const command = new Command('vertu-erp').description('使用当前账号获授权的 ERP MCP（只读，不自动提权）');
+    command.command('tools').description('列出 ERP 工具及实时参数 schema')
+        .option('--hermes-base-url <url>', 'Hermes 服务根地址')
+        .action(async (opts) => {
+        console.log(JSON.stringify(await runErpMcp(undefined, opts.hermesBaseUrl), null, 2));
+    });
+    command.command('call').description('调用 ERP 只读工具；参数以 tools 返回的 schema 为准')
+        .requiredOption('--tool <name>', 'erp-query / erp-list-tables / erp-table-columns')
+        .option('--args <json>', 'JSON 参数对象，支持 @file 或 @-（标准输入）', '{}')
+        .option('--hermes-base-url <url>', 'Hermes 服务根地址')
+        .action(async (opts) => {
+        const raw = await expandAtFileToken(opts.args, '--args');
+        let args;
+        try {
+            args = JSON.parse(raw);
+        }
+        catch {
+            throw new VertuError('--args 必须是 JSON 对象。');
+        }
+        if (!args || typeof args !== 'object' || Array.isArray(args))
+            throw new VertuError('--args 必须是 JSON 对象。');
+        console.log(JSON.stringify(await runErpMcp({ tool: opts.tool, arguments: args }, opts.hermesBaseUrl), null, 2));
+    });
+    return command;
+}

package/dist/packages/vps-work/src/core/aisales-mcp-client.js

@@ -0,0 +1,35 @@
+import { VertuError } from './errors.js';
+import { runMcp } from './mcp-client.js';
+import { resolveVpsServiceUrl } from './sales-query-client.js';
+import { vpsServiceAuthHeaders } from './vps-service-http.js';
+const TENANT = '00000000-0000-4000-8000-000000000001';
+const TOOL_NAMES = new Set(['business.resolve_subject', 'business.catalog', 'business.query', 'business.compare', 'business.get_evidence', 'business.explain_metric', 'sales.operation_summary', 'sales.customer_cohort', 'sales.customer_journey']);
+export async function listAiSalesServices() {
+    const base = resolveVpsServiceUrl().replace(/\/+$/, '');
+    const headers = vpsServiceAuthHeaders(base);
+    if (!headers.authorization)
+        throw new VertuError('需要当前账号的 VPS 登录凭据。');
+    const response = await fetch(`${base}/v1/tenant/mcp/services`, {
+        headers, redirect: 'error', signal: AbortSignal.timeout(15_000),
+    });
+    if (!response.ok) {
+        await response.body?.cancel();
+        throw new VertuError(`无法读取企业 MCP 授权（HTTP ${response.status}）。`);
+    }
+    const catalog = await response.json();
+    if (catalog.tenant_id !== TENANT)
+        throw new VertuError('vertu-aisales 仅对获授权的 VERTU 企业成员开放。');
+    return (Array.isArray(catalog.items) ? catalog.items : []).filter(item => item.capability === 'vertu-aisales'
+        && /^[0-9a-f-]{36}$/i.test(item.id)).map(item => ({ id: item.id, name: item.name || 'VERTU AI Sales' }));
+}
+export async function runAiSalesMcp(operation, serviceId) {
+    if (operation && !TOOL_NAMES.has(operation.tool))
+        throw new VertuError('未知的 VERTU AI Sales 工具，请先运行 vps-work vertu-aisales tools。');
+    const services = (await listAiSalesServices()).filter(item => !serviceId || item.id === serviceId);
+    if (services.length !== 1)
+        throw new VertuError(services.length
+            ? '存在多个 AI Sales 服务，请运行 vps-work vertu-aisales services，再用 --service-id 指定实例。'
+            : '当前账号没有可用的 vertu-aisales 服务，请由管理员在企业 MCP 后台开通。');
+    const base = resolveVpsServiceUrl().replace(/\/+$/, '');
+    return runMcp(`${base}/v1/tenant/mcp/services/${services[0].id}`, vpsServiceAuthHeaders(base), TOOL_NAMES, operation);
+}

package/dist/packages/vps-work/src/core/auth.js

@@ -0,0 +1,240 @@
+import { OdooClient } from './client.js';
+import { AuthRequiredError } from './errors.js';
+import { bearerAccount, deleteSecret, getSecret, isKeychainAvailable, passwordAccount, sessionAccount, setSecret, } from './keychain.js';
+import { EMPTY_CONFIG, PRIMARY_ALIAS, deleteProfile, getEndpointBaseUrl, getProfile, readConfig, resolveEffectiveBaseUrl, setDefaultBaseUrl, upsertProfile, writeConfig, } from './config.js';
+function envBearer() {
+    return process.env.VERTU_BOT_INBOUND_KEY?.trim() || undefined;
+}
+function envBaseUrl() {
+    return process.env.VERTU_BASE_URL?.trim() || undefined;
+}
+function pickBaseUrl(config, override) {
+    return resolveEffectiveBaseUrl(config, { override, envBaseUrl: envBaseUrl() });
+}
+export async function loadCredentials(opts = {}) {
+    const config = await readConfig();
+    const baseUrl = pickBaseUrl(config, opts.baseUrlOverride);
+    const profile = getProfile(config, baseUrl) ?? { baseUrl };
+    let sessionId;
+    let sessionSource = 'none';
+    if (await isKeychainAvailable()) {
+        const fromKey = await getSecret(sessionAccount(baseUrl));
+        if (fromKey) {
+            sessionId = fromKey;
+            sessionSource = 'keychain';
+        }
+    }
+    if (!sessionId && profile.sessionId) {
+        sessionId = profile.sessionId;
+        sessionSource = 'config';
+    }
+    let bearer = envBearer();
+    let bearerSource = bearer ? 'env' : 'none';
+    if (!bearer && (await isKeychainAvailable())) {
+        const fromKey = await getSecret(bearerAccount(baseUrl));
+        if (fromKey) {
+            bearer = fromKey;
+            bearerSource = 'keychain';
+        }
+    }
+    if (!bearer && profile.bearer) {
+        bearer = profile.bearer;
+        bearerSource = 'config';
+    }
+    if (opts.requireAuth && !sessionId && !bearer) {
+        throw new AuthRequiredError();
+    }
+    return {
+        baseUrl,
+        profile,
+        auth: { sessionId, bearer },
+        sessionSource,
+        bearerSource,
+    };
+}
+export async function persistSession(baseUrl, sessionId, meta, opts) {
+    const config = await readConfig();
+    const next = {
+        baseUrl,
+        db: meta?.db ?? getProfile(config, baseUrl)?.db,
+        login: meta?.login ?? getProfile(config, baseUrl)?.login,
+        bearer: getProfile(config, baseUrl)?.bearer,
+    };
+    // A successful login should always become the active default profile;
+    // otherwise other commands keep targeting whichever host happened to be
+    // first registered.
+    // skipDefaultUpdate=true 时（联动登录次端点），保留原 defaultBaseUrl 不变。
+    const withProfile = (profile) => opts?.skipDefaultUpdate
+        ? upsertProfile(config, profile)
+        : setDefaultBaseUrl(upsertProfile(config, profile), baseUrl);
+    if (await isKeychainAvailable()) {
+        await setSecret(sessionAccount(baseUrl), sessionId);
+        // On Windows, keytar may cache the write in-process so getPassword appears
+        // to succeed immediately, but the OS credential store was never actually
+        // written. Keep a plaintext copy in config so loadCredentials can fall
+        // back to it when the keychain read returns null later.
+        if (process.platform !== 'win32') {
+            next.sessionId = undefined;
+            await writeConfig(withProfile(next));
+            return { via: 'keychain' };
+        }
+        const verified = await getSecret(sessionAccount(baseUrl));
+        if (verified === sessionId) {
+            next.sessionId = sessionId;
+            await writeConfig(withProfile(next));
+            return { via: 'keychain' };
+        }
+    }
+    next.sessionId = sessionId;
+    await writeConfig(withProfile(next));
+    return { via: 'config' };
+}
+export async function persistBearer(baseUrl, bearer) {
+    const config = await readConfig();
+    const profile = getProfile(config, baseUrl) ?? { baseUrl };
+    if (await isKeychainAvailable()) {
+        await setSecret(bearerAccount(baseUrl), bearer);
+        if (process.platform !== 'win32') {
+            profile.bearer = undefined;
+            await writeConfig(upsertProfile(config, profile));
+            return { via: 'keychain' };
+        }
+        const verified = await getSecret(bearerAccount(baseUrl));
+        if (verified === bearer) {
+            profile.bearer = bearer;
+            await writeConfig(upsertProfile(config, profile));
+            return { via: 'keychain' };
+        }
+    }
+    profile.bearer = bearer;
+    await writeConfig(upsertProfile(config, profile));
+    return { via: 'config' };
+}
+/**
+ * Persist the user's plain password so `vps-work reauth` can refresh sessions silently.
+ *
+ * Same fallback strategy as session/bearer: keychain when available; otherwise plain text in
+ * `~/.vps-work/config.json` with file mode 0600. On Windows, keytar is known to lie about
+ * write success in-process, so the value is also kept in config as a verified backup.
+ */
+export async function persistPassword(baseUrl, password) {
+    const config = await readConfig();
+    const profile = getProfile(config, baseUrl) ?? { baseUrl };
+    if (await isKeychainAvailable()) {
+        await setSecret(passwordAccount(baseUrl), password);
+        if (process.platform !== 'win32') {
+            profile.password = undefined;
+            await writeConfig(upsertProfile(config, profile));
+            return { via: 'keychain' };
+        }
+        const verified = await getSecret(passwordAccount(baseUrl));
+        if (verified === password) {
+            profile.password = password;
+            await writeConfig(upsertProfile(config, profile));
+            return { via: 'keychain' };
+        }
+    }
+    profile.password = password;
+    await writeConfig(upsertProfile(config, profile));
+    return { via: 'config' };
+}
+export async function loadPassword(baseUrl) {
+    if (await isKeychainAvailable()) {
+        const fromKey = await getSecret(passwordAccount(baseUrl));
+        if (fromKey)
+            return fromKey;
+    }
+    const config = await readConfig();
+    return getProfile(config, baseUrl)?.password ?? undefined;
+}
+export async function clearSession(baseUrl) {
+    if (await isKeychainAvailable()) {
+        await deleteSecret(sessionAccount(baseUrl));
+    }
+    const config = await readConfig();
+    const profile = getProfile(config, baseUrl);
+    if (!profile)
+        return;
+    if (profile.sessionId) {
+        profile.sessionId = undefined;
+        await writeConfig(upsertProfile(config, profile));
+    }
+}
+export async function clearBearer(baseUrl) {
+    if (await isKeychainAvailable()) {
+        await deleteSecret(bearerAccount(baseUrl));
+    }
+    const config = await readConfig();
+    const profile = getProfile(config, baseUrl);
+    if (!profile)
+        return;
+    if (profile.bearer) {
+        profile.bearer = undefined;
+        await writeConfig(upsertProfile(config, profile));
+    }
+}
+export async function clearPassword(baseUrl) {
+    if (await isKeychainAvailable()) {
+        await deleteSecret(passwordAccount(baseUrl));
+    }
+    const config = await readConfig();
+    const profile = getProfile(config, baseUrl);
+    if (!profile)
+        return;
+    if (profile.password) {
+        profile.password = undefined;
+        await writeConfig(upsertProfile(config, profile));
+    }
+}
+export async function forgetProfile(baseUrl) {
+    await clearSession(baseUrl);
+    await clearBearer(baseUrl);
+    await clearPassword(baseUrl);
+    const config = await readConfig();
+    await writeConfig(deleteProfile(config, baseUrl));
+}
+export async function buildClient(opts = {}) {
+    const resolved = await loadCredentials(opts);
+    const client = new OdooClient({ baseUrl: resolved.baseUrl, auth: resolved.auth });
+    return { client, resolved };
+}
+/**
+ * Build a client for an explicit alias (`default` or any registered endpoint).
+ *
+ * Mainly used by skill subcommands and `vps-work reauth`, where the caller already knows the
+ * target endpoint and just needs to resolve credentials. For dynamic CLI execution see
+ * {@link buildClientForLeaf} which also consumes the leaf's `endpoint_alias` hint.
+ */
+export async function buildClientForAlias(alias, opts = {}) {
+    const config = await readConfig();
+    const baseUrl = getEndpointBaseUrl(config, alias);
+    if (!baseUrl) {
+        throw new AuthRequiredError(`No base URL configured for endpoint "${alias}". ` +
+            'A human operator may configure this legacy endpoint; Agent/Bot/Hermes must use injected app_key credentials instead.');
+    }
+    const resolved = await loadCredentials({ baseUrlOverride: baseUrl, requireAuth: opts.requireAuth });
+    const client = new OdooClient({ baseUrl: resolved.baseUrl, auth: resolved.auth });
+    return { client, resolved, alias };
+}
+/**
+ * Resolve the target base URL for callers that mix `--base-url` and `--endpoint <alias>` flags
+ * but do not have a leaf hint (e.g. skill subcommands). `--base-url` wins; otherwise `--endpoint`
+ * is looked up in `config.endpoints` (or `defaultBaseUrl` for the reserved `default` alias).
+ */
+export async function buildClientFromOpts(opts) {
+    if (opts.baseUrlOverride && opts.baseUrlOverride.trim()) {
+        const resolved = await loadCredentials({
+            baseUrlOverride: opts.baseUrlOverride.trim(),
+            requireAuth: opts.requireAuth,
+        });
+        const client = new OdooClient({ baseUrl: resolved.baseUrl, auth: resolved.auth });
+        return { client, resolved };
+    }
+    if (opts.endpointOverride && opts.endpointOverride.trim()) {
+        return buildClientForAlias(opts.endpointOverride.trim(), { requireAuth: opts.requireAuth });
+    }
+    const resolved = await loadCredentials({ requireAuth: opts.requireAuth });
+    const client = new OdooClient({ baseUrl: resolved.baseUrl, auth: resolved.auth });
+    return { client, resolved };
+}
+export const __internals = { EMPTY_CONFIG, PRIMARY_ALIAS };

package/dist/packages/vps-work/src/core/cli-bin.js

@@ -0,0 +1,11 @@
+/** 全局可执行命令名（与 package.json `bin` 一致）。 */
+export const CLI_BIN = 'vps-work';
+/** 新包没有旧命令别名，避免和已安装的 vertu-cli 抢 PATH。 */
+export const CLI_BIN_ALIASES = [];
+/** 请求审计通道。 */
+export const CLI_AUTH_CHANNEL = 'vps-work';
+/** Odoo `/ai/cli/v1/execute` 的 `program`（与 capabilities.programs[].slug 一致）。 */
+export const ODOO_CLI_PROGRAM_SLUG = 'vertu';
+export const CLI_PACKAGE = 'vps-work';
+/** 系统钥匙串 / Credential Manager 服务名，与 vertu-cli 隔离。 */
+export const CLI_KEYCHAIN_SERVICE = 'vps-work';