vps-work 2.5.1 → 2.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vps-work",
-  "version": "2.5.1",
+  "version": "2.7.0",
   "description": "VPS Work CLI - tenant-aware domain shortcuts and bundled agent skills for Cursor / Claude Code / Trae.",
   "license": "MIT",
   "author": "he-linyan",

package/skills/vps-documents/references/api.md

@@ -142,3 +142,7 @@ vps-work docs +update-block \
 - `textAlignment` 为 `left`、`center` 或 `right`；引用和代码块不支持对齐。
 - `backgroundColor` 为 `default` 或 `yellow`；代码块不支持背景设置。
 - 版本不匹配时重新执行 `+get-blocks`，确认目标块后再提交。
+
+## 外部系统的受限多维表 Token
+
+第三方服务可在多维表「API」面板创建按表、按操作授权的 `vpsb_` Token，调用 `/v1/open/bases/:docId`。此凭证与本 CLI 的用户/Agent 鉴权分离，不能用于 `/v1/documents`。写入须提供 `Idempotency-Key`；详见仓库 `services/vps-base/EXTERNAL_API.md`。CLI 继续使用原有用户身份链路。

package/skills/vps-okr/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: vps-okr
-version: 1.0.0
-description: 部门与员工 OKR。`vps-work okr +…`。
+version: 1.1.0
+description: 部门与员工 OKR 查询及独立授权的正式 OKR 打分。`vps-work okr +…`。
 metadata:
   requires:
     bins: ['vps-work']
@@ -20,3 +20,13 @@ metadata:
 | `+personal-structured` | 同 `+employee-okr` |
 
 Agent / Bot 必须使用宿主注入的 app_key，禁止执行账号密码登录。仅人工用户可在交互终端执行 `vps-work auth login`。
+
+## 正式 OKR 打分
+
+需要独立权限 `okr.scoring:write`（角色 `vps_okr_scorer`），普通 OKR 读写权限不替代此授权。权限只开放入口，原评分人、评分阶段及窗口限制继续生效。
+
+先用 `vps-work okr +score-context --period YYYY-MM --owner-type person --owner-id ID` 读取正式评分依据；部门用 `--owner-type department`。读取 KR 本级评分的 revision；该级没有评分时使用 0，不使用计划 revision。
+
+`vps-work okr +score --key-result-id ID --level self --score 85 --comment '已核实的评分依据' --expected-revision REV` 默认仅预览；用户已授权实际打分且分数、依据明确后加 `--yes`。阶段为 self（自评）、primary（初评）、secondary（复评）。代理部门仅能使用已有授权的 `--acting-department-id`。
+
+403 停止，不换身份绕过；409 重新读取并核对差异，不盲目提高 revision 后重发。超时或连接失败可能已经提交，先读回分数与版本确认结果，不自动重复写入。不要从历史只读表猜测正式 KR ID，也不要因获准查询而自行打分。

package/skills/vps-okr-management-assistant/SKILL.md

@@ -43,3 +43,5 @@ description: "面向 Vertu 部门和员工 OKR 的结构化取数与分析。用
 - `employee_id` 是 `res.users.id`，`department_id` 是 `hr.department.id`。
 - 查询结果受当前用户权限和服务端数据范围限制。
 - 2026-07 及以后不回退 PMS；正式表不可用时服务端会明确报错。
+
+正式 OKR 打分已提供独立入口 `okr +score-context` / `okr +score`。需要打分时读取 [OKR 打分指引](../vps-okr/SKILL.md)，使用独立 `okr.scoring:write` 权限；本技能的历史/结构化查询不能用于推断评分版本或代替评分授权。

package/skills/vps-store-management/references/store-reception.md

@@ -24,8 +24,8 @@ vps-work store +reception [options]
 - 微信添加数、有效客户数、有效客户添加数、触摸人数、试用人数：累计 `crm_walk_in_portrait` 客户画像行。
 - 成交组数/成交金额：仅 `is_transaction='yes'`。
 - 成交金额按接待类型拆分：自然流、售后、邀约、下线转介绍、其他。
-- 日期按 `reception_date + 8 hours` 后的北京时间自然日归属。
-- 组织范围固定为国内渠道东/西/北/南四区，并兼容“区域直属门店”和“国内直营门店/区域/门店”两种组织层级后按区域、门店汇总。
+- 日期直接使用 `reception_date`（PostgreSQL DATE 接待自然日），含首尾日期，不叠加时区偏移。
+- 组织范围固定为国内渠道（兼容调整后名称“国内渠道中心”）东/西/北/南四区，并兼容“区域直属门店”和“国内直营门店/区域/门店”两种组织层级后按区域、门店汇总；仅包含有效组织路径，停用部门及范围外记录不自动混入。
 - 门店名称优先使用表单的 `walk_in_store`，未填写时回退组织门店；北京 SKP 旧值归入“北京SKP 老店”。
 - 代理商入口与门店共用主表，默认排除 `is_dealer_submission=true`；需要时使用 `--source dealer/all`。
 
@@ -36,5 +36,17 @@ vps-work store +reception [options]
 - `rows`：区域/门店明细。
 - `breakdowns`：接待类型、时段、状态、客户画像、微信状态和意向商品（含意向金额）。
 - `notes`：口径说明。
+- `data_status`：`ok` 表示有匹配记录；`empty` 表示组织映射有效但筛选无记录。
+- `organization_scope`：组织范围有效状态及部门、区域数量，与指标在同一数据库快照计算。
+
+组织根缺失、停用、改为未兼容名称或四区映射不完整时返回 HTTP 503、`STORE_RECEPTION_SCOPE_UNAVAILABLE`，不能显示为“零接待”。周报调用方必须保留此失败状态，显示“数据暂不可用”，不得捕获错误后把指标补零。收到 `empty` 时可显示“无匹配接待记录”；这仍不等于独立核实了业务应有值为零。
+
+显式 `department_id` 不在有效四区路径中（包括部门停用、缺失、归属范围外）时返回 HTTP 422、`STORE_RECEPTION_DEPARTMENT_OUT_OF_SCOPE`，不能与 Walk-in 的全范围部门枚举直接按零合并。开始日期晚于结束日期、无效自然日返回 HTTP 400。合并前必须核对两次查询的起止日期、source 和部门过滤；`reception.rows` 是区域／门店聚合，不含可直接联接的部门 ID，不能仅按同名门店猜测部门关系。未核实映射、接口失败或同范围 Walk-in 有客流而 reception 为空时，应保留缺失状态及原因。
+
+新版 CLI 会拒绝缺少组织健康／数据状态、筛选与请求不符的接待响应，错误为 `STORE_RECEPTION_RESULT_UNVERIFIED`。服务端与 CLI 需要配套验证；旧版服务返回的成功空结果不作为真实零值放行。脚本调用时必须检查非零退出，不得用 `catch`、空对象或 `|| 0` 将失败改成业务零值。真实原周报生成器尚需独立核对这些约束。
+
+周报合并验收还须检查：固定两来源相同的显式起止日期、source 和有效部门范围；Walk-in 分组完整翻页后按 `department_id` 去重（同名部门不能合并）；`summary` 才是完整筛选总计。接待按区域／门店聚合，必须用已核实的部门关系或逐部门查询，不能按门店文本猜联接。停用／范围外部门应单列范围说明，不能补零或擅自混入有效四区总计。
+
+接口失败、未经核实的空值及未归属项在报表中显示“暂不可用”或“—”。`empty` 只能解释为无匹配接待记录；任一转化率分母为零时应显示“—／无基数”，不能断言真实转化率为零。已有接待但无成交时，成交组数及成交额可显示真实数值 0。生成器取得前，这些页面及合并规则仍属待验收。
 
 门店接待过程数据不能与 `sales +agent-walkin` 的经销商订单金额直接相加。

package/dist/packages/vps-work/src/bin/vps-work.js

@@ -1,271 +0,0 @@
-import { Command } from 'commander';
-import { buildPurchaseCommand } from '../commands/purchase/index.js';
-import { formatErrorForCli, VertuError } from '../core/errors.js';
-import { buildAuthCommand } from '../commands/auth/index.js';
-import { buildAgentCommand } from '../commands/agent/index.js';
-import { buildApprovalCommand } from '../commands/approval/index.js';
-import { buildImCommand } from '../commands/im/index.js';
-import { buildMailCommand } from '../commands/mail/index.js';
-import { buildOkrCommand } from '../commands/okr/index.js';
-import { buildReportCommand } from '../commands/report/index.js';
-import { buildAttendanceCommand } from '../commands/attendance/index.js';
-import { buildTaskCommand } from '../commands/task/index.js';
-import { buildToolsCommand } from '../commands/tools/index.js';
-// `dev` 命令已弃用并并入 `task`（task-center / task-assistant 直连库）。
-import { buildHrCommand } from '../commands/hr/index.js';
-import { buildProductCommand } from '../commands/product/index.js';
-import { buildSalesCommand } from '../commands/sales/index.js';
-import { buildStoreCommand } from '../commands/store/index.js';
-import { buildVemoryCommand } from '../commands/vemory/index.js';
-import { buildMeetingCommand } from '../commands/meeting/index.js';
-import { buildCalendarCommand } from '../commands/calendar/index.js';
-import { buildCreativeCommand } from '../commands/creative/index.js';
-import { buildCorporateCommand } from '../commands/corporate/index.js';
-import { buildDocumentsCommand } from '../commands/documents/index.js';
-import { buildOfficeCommand } from '../commands/office/index.js';
-import { buildKnowledgeCommand } from '../commands/knowledge/index.js';
-import { buildDriveCommand } from '../commands/drive/index.js';
-import { buildPopupCommand } from '../commands/popup/index.js';
-import { buildSkillCommand } from '../commands/skill/index.js';
-import { buildCatalogCommand } from '../commands/catalog.js';
-import { buildExecCommand } from '../commands/exec.js';
-import { buildVertuAiSalesCommand } from '../commands/vertu-aisales.js';
-import { buildVertuErpCommand } from '../commands/vertu-erp.js';
-import { buildCliInstallCommand } from '../commands/cli-install.js';
-import { CLI_BIN, CLI_BIN_ALIASES } from '../core/cli-bin.js';
-import { buildCliRootHelpAfter, buildCliRootHelpBefore } from '../core/cli-root-help.js';
-import { normalizeSnakeFlags } from '../utils/normalize-argv.js';
-const PKG_VERSION = typeof __VERTU_VERSION__ === 'string' && __VERTU_VERSION__ ? __VERTU_VERSION__ : '0.0.0-dev';
-/**
- * Compute a suggestion for an unknown long flag.
- *
- * commander 13's built-in `suggestSimilar` uses Damerau–Levenshtein with a
- * hard-coded `maxDistance = 3`, which silently fails the most common AI
- * mistake on this CLI: typing the schema-shortened form (`--model`) when the
- * registered flag is the longer kebab-cased schema key (`--model-name`,
- * `--knowledge-types`, `--start-date`). The edit distance there is ≥4, so
- * commander emits no hint at all.
- *
- * We replace it with a two-stage matcher tuned for that pattern:
- *   1. **Prefix-of-candidate** (`--model` → `--model-name`): treat candidates
- *      that start with `<flag>-` as the strongest hit. AI agents typing the
- *      shortened form are almost always after the prefix-extended flag.
- *   2. **Levenshtein with cap=6**: catch typos and snake/kebab swaps the
- *      argv normalizer didn't already canonicalize. Min similarity 0.4 keeps
- *      the bar for spurious matches similar to commander's default.
- *
- * Returns the suggestion line (with leading `\n` to match commander's format)
- * or an empty string when no candidate is close enough.
- */
-function smartFlagSuggest(flag, candidates) {
-    if (!flag.startsWith('--') || flag.length < 4)
-        return '';
-    const word = flag.slice(2);
-    const stripped = candidates
-        .filter((c) => c.startsWith('--') && c.length > 3)
-        .map((c) => c.slice(2));
-    const seen = new Set();
-    // Defensively drop exact matches: in real usage commander wouldn't reach the
-    // unknown-option path for a registered flag, but keeping the suggester pure
-    // makes it safe to compose elsewhere.
-    const cands = stripped.filter((c) => {
-        if (c === word || seen.has(c))
-            return false;
-        seen.add(c);
-        return true;
-    });
-    if (cands.length === 0)
-        return '';
-    const prefixHits = cands
-        .filter((c) => c.length > word.length && c.startsWith(`${word}-`))
-        .sort();
-    if (prefixHits.length) {
-        const formatted = prefixHits.map((c) => `--${c}`);
-        return prefixHits.length === 1
-            ? `\n(Did you mean ${formatted[0]}?)`
-            : `\n(Did you mean one of ${formatted.join(', ')}?)`;
-    }
-    const editDistance = (a, b) => {
-        if (Math.abs(a.length - b.length) > 8)
-            return Math.max(a.length, b.length);
-        // Flat 1-D matrix indexed as `(rows+1) cells per row`; avoids
-        // `noUncheckedIndexedAccess` complaints from nested array slots that
-        // TypeScript otherwise types as `number | undefined`.
-        const w = b.length + 1;
-        const d = new Array((a.length + 1) * w);
-        for (let i = 0; i <= a.length; i++)
-            d[i * w] = i;
-        for (let j = 0; j <= b.length; j++)
-            d[j] = j;
-        for (let i = 1; i <= a.length; i++) {
-            for (let j = 1; j <= b.length; j++) {
-                const cost = a[i - 1] === b[j - 1] ? 0 : 1;
-                const del = d[(i - 1) * w + j] + 1;
-                const ins = d[i * w + (j - 1)] + 1;
-                const sub = d[(i - 1) * w + (j - 1)] + cost;
-                let v = Math.min(del, ins, sub);
-                if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
-                    v = Math.min(v, d[(i - 2) * w + (j - 2)] + 1);
-                }
-                d[i * w + j] = v;
-            }
-        }
-        return d[a.length * w + b.length];
-    };
-    const MAX_DIST = 6;
-    const MIN_SIM = 0.4;
-    let bestDist = MAX_DIST;
-    let best = [];
-    for (const c of cands) {
-        const dist = editDistance(word, c);
-        const len = Math.max(word.length, c.length);
-        if ((len - dist) / len <= MIN_SIM)
-            continue;
-        if (dist < bestDist) {
-            bestDist = dist;
-            best = [c];
-        }
-        else if (dist === bestDist) {
-            best.push(c);
-        }
-    }
-    if (!best.length)
-        return '';
-    best.sort();
-    const formatted = best.map((c) => `--${c}`);
-    return best.length === 1
-        ? `\n(Did you mean ${formatted[0]}?)`
-        : `\n(Did you mean one of ${formatted.join(', ')}?)`;
-}
-function asInternal(cmd) {
-    return cmd;
-}
-/** 沿命令树向上收集所有可用长选项（含 --help），供拼写建议使用。 */
-function collectLongFlags(start) {
-    const candidateFlags = [];
-    for (let cur = start; cur; cur = cur.parent ? asInternal(cur.parent) : null) {
-        for (const opt of cur.options ?? []) {
-            if (opt.long)
-                candidateFlags.push(opt.long);
-        }
-        candidateFlags.push('--help');
-    }
-    return candidateFlags;
-}
-function patchSmartSuggester(cmd) {
-    const target = asInternal(cmd);
-    const original = target.unknownOption.bind(target);
-    target.unknownOption = function patched(flag) {
-        if (this._allowUnknownOption)
-            return;
-        if (!flag.startsWith('--'))
-            return original(flag);
-        const suggestion = smartFlagSuggest(flag, collectLongFlags(this));
-        if (!suggestion)
-            return original(flag);
-        this.error(`error: unknown option '${flag}'${suggestion}`, {
-            code: 'commander.unknownOption',
-        });
-    };
-}
-/**
- * Apply commander's "did you mean" affordances to every command in the tree.
- *
- * commander 13 stores `_showSuggestionAfterError` and `_showHelpAfterError`
- * per-Command and **does not** inherit them from the parent. So setting them
- * only on the root program would leave nested subcommands
- * dynamic leaves, …) printing the bare `unknown option '--model'` without any
- * hint. We walk the registered tree once, after every subcommand has been
- * attached (built-ins + dynamic), and turn both behaviours on. We also patch
- * each command's `unknownOption` with the smarter suggester (see above).
- *
- * The tree walk is intentionally idempotent: calling `showSuggestionAfterError`
- * twice is a no-op, so re-running this after late additions stays safe.
- */
-function applyErrorAffordances(root) {
-    const stack = [root];
-    while (stack.length) {
-        const node = stack.pop();
-        if (!node)
-            continue;
-        node.showSuggestionAfterError(true);
-        node.showHelpAfterError('(use -h or --help for usage)');
-        patchSmartSuggester(node);
-        stack.push(...node.commands);
-    }
-}
-// Exposed for unit tests; keeping the implementation co-located with the
-// command-tree walker so the heuristic can evolve next to the integration.
-export { smartFlagSuggest };
-async function main() {
-    const program = new Command(CLI_BIN)
-        .version(PKG_VERSION, '-V, --version')
-        .description('VPS business CLI for enterprise tenants, employees and partners.')
-        .option('--base-url <url>', 'Override Vertu service URL for shortcuts and auth')
-        .addHelpText('beforeAll', buildCliRootHelpBefore())
-        .addHelpText('after', buildCliRootHelpAfter());
-    program.addCommand(buildCliInstallCommand());
-    program.addCommand(buildAuthCommand());
-    program.addCommand(buildAgentCommand());
-    program.addCommand(buildSalesCommand());
-    program.addCommand(buildStoreCommand());
-    program.addCommand(buildHrCommand());
-    program.addCommand(buildProductCommand());
-    program.addCommand(buildPurchaseCommand());
-    program.addCommand(buildApprovalCommand());
-    program.addCommand(buildOkrCommand());
-    program.addCommand(buildReportCommand());
-    program.addCommand(buildAttendanceCommand());
-    program.addCommand(buildTaskCommand());
-    program.addCommand(buildToolsCommand());
-    program.addCommand(buildImCommand());
-    program.addCommand(buildMailCommand());
-    program.addCommand(buildVemoryCommand());
-    program.addCommand(buildMeetingCommand());
-    program.addCommand(buildCalendarCommand());
-    program.addCommand(buildCreativeCommand());
-    program.addCommand(buildCorporateCommand());
-    program.addCommand(buildDocumentsCommand());
-    program.addCommand(buildOfficeCommand());
-    program.addCommand(buildKnowledgeCommand());
-    program.addCommand(buildDriveCommand());
-    program.addCommand(buildPopupCommand());
-    program.addCommand(buildCatalogCommand());
-    program.addCommand(buildExecCommand());
-    program.addCommand(buildVertuErpCommand());
-    program.addCommand(buildVertuAiSalesCommand());
-    program.addCommand(buildSkillCommand());
-    // Accept snake_case long flags (e.g. `--start_date`) as aliases of the
-    // canonical kebab-case form. server-side `parameters_schema` keys are
-    // snake_case, so users / AI agents reading the schema often type that form
-    // first. Normalizing once at the entry point keeps commander unaware of the
-    // alternate spelling and avoids touching every dynamic option registration.
-    const userArgv = normalizeSnakeFlags(process.argv.slice(2));
-    const fullArgv = [...process.argv.slice(0, 2), ...userArgv];
-    // Apply after built-in commands are registered, so the
-    // walker covers the whole tree in one pass.
-    applyErrorAffordances(program);
-    try {
-        await program.parseAsync(fullArgv);
-    }
-    catch (err) {
-        handleError(err);
-    }
-}
-function handleError(err) {
-    process.stderr.write(`${formatErrorForCli(err)}\n`);
-    if (err instanceof VertuError) {
-        process.exit(err.exitCode);
-    }
-    process.exit(1);
-}
-function isCliEntryPoint() {
-    const entry = process.argv[1] ?? '';
-    return (entry.includes('vps-work.ts') ||
-        entry.includes('vps-work.cjs') ||
-        entry.endsWith(`${CLI_BIN}`) ||
-        CLI_BIN_ALIASES.some((alias) => entry.endsWith(alias)));
-}
-if (isCliEntryPoint()) {
-    void main().catch(handleError);
-}

package/dist/packages/vps-work/src/commands/agent/index.js

@@ -1,264 +0,0 @@
-import { randomUUID } from 'node:crypto';
-import { setTimeout as sleep } from 'node:timers/promises';
-import { Command } from 'commander';
-import { VertuError } from '../../core/errors.js';
-import { DEFAULT_AGENT_APP_ID, formatAgentEnvExports, VERTU_APP_ID_ENV, VERTU_APP_KEY_ENV, } from '../../core/vertu-agent-env.js';
-import { bindVpsServiceAgentCredential, loadStoredAgentKey, persistVpsServiceAgentCredential, } from '../../core/vps-service-auth.js';
-import { readVpsServiceConfig } from '../../core/vps-service-config.js';
-import { resolveVpsServiceUrl } from '../../core/sales-query-client.js';
-import { promptText } from '../../utils/prompt.js';
-import { expandAtFileToken } from '../../utils/at-file.js';
-import { imRequest } from '../../core/im-client.js';
-const HARNESS_COLLABORATION_KIND = 'vps-harness-agent-collaboration';
-function isVpsSessionExpired(expiresAt) {
-    if (!expiresAt) {
-        return true;
-    }
-    const parsed = Date.parse(expiresAt);
-    return !Number.isFinite(parsed) || parsed <= Date.now() + 30_000;
-}
-function requiredUserId(raw) {
-    const value = Number(raw);
-    if (!Number.isInteger(value) || value <= 0) {
-        throw new VertuError('--user-id 必须是正整数。');
-    }
-    return value;
-}
-export function collaborationTurnFromHistory(out, requestId) {
-    if (!out || typeof out !== 'object' || !('messages' in out))
-        return null;
-    const messages = out.messages;
-    if (!Array.isArray(messages))
-        return null;
-    for (const value of [...messages].reverse()) {
-        if (!value || typeof value !== 'object')
-            continue;
-        const message = value;
-        const metadata = message.metadata;
-        if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata))
-            continue;
-        const envelope = metadata[HARNESS_COLLABORATION_KIND];
-        if (!envelope || typeof envelope !== 'object' || Array.isArray(envelope))
-            continue;
-        const record = envelope;
-        const turn = Number(record.turn);
-        if (record.request_id !== requestId
-            || (record.type !== 'request' && record.type !== 'response')
-            || !Number.isInteger(turn)
-            || turn <= 0)
-            continue;
-        return {
-            body: typeof message.body === 'string' ? message.body : '',
-            messageId: typeof message.id === 'string' ? message.id : '',
-            turn,
-            type: record.type,
-        };
-    }
-    return null;
-}
-export function buildAgentCommand() {
-    const cmd = new Command('agent').description('Agent host credentials (app_id + app_key) after human sign-in.');
-    cmd
-        .command('bind')
-        .description('用当前 Vertu 会话为指定 app_id 签发/轮换 app_key')
-        .option('--base-url <url>', 'Vertu 服务地址')
-        .option('--app-id <id>', `可信应用 ID（默认 ${DEFAULT_AGENT_APP_ID}，可用环境变量 ${VERTU_APP_ID_ENV}）`)
-        .action(async (opts, command) => {
-        const merged = command.optsWithGlobals();
-        const cfg = await readVpsServiceConfig();
-        const serviceUrl = resolveVpsServiceUrl(opts.baseUrl ?? merged.baseUrl);
-        const sessionToken = cfg.sessionToken?.trim();
-        if (!sessionToken || isVpsSessionExpired(cfg.expiresAt)) {
-            throw new VertuError('签发 app_key 需要人工登录会话；Agent 不得自行执行账号密码登录。');
-        }
-        const appId = opts.appId?.trim() ??
-            merged.appId?.trim() ??
-            process.env[VERTU_APP_ID_ENV]?.trim() ??
-            cfg.agentAppId ??
-            (await promptText('Agent app_id', DEFAULT_AGENT_APP_ID));
-        const bound = await bindVpsServiceAgentCredential(serviceUrl, sessionToken, appId);
-        await persistVpsServiceAgentCredential(serviceUrl, bound);
-        console.log(`已绑定 Agent：app_id=${bound.appId}，login=${bound.login}`);
-        console.log(`过期：${bound.expiresAt ?? '长效（永不过期）'}`);
-        console.log('宿主环境：执行 `vps-work agent env` 查看 export 语句');
-    });
-    cmd
-        .command('env')
-        .description('输出 Agent 宿主应注入的环境变量（export / $env:）')
-        .option('--base-url <url>', 'Vertu 服务地址')
-        .option('--app-id <id>', '应用 ID（默认读配置或 cursor）')
-        .option('--shell <name>', 'bash | powershell', 'bash')
-        .action(async (opts, command) => {
-        const merged = command.optsWithGlobals();
-        const cfg = await readVpsServiceConfig();
-        const serviceUrl = resolveVpsServiceUrl(opts.baseUrl ?? merged.baseUrl);
-        const appId = opts.appId?.trim() ??
-            merged.appId?.trim() ??
-            cfg.agentAppId ??
-            DEFAULT_AGENT_APP_ID;
-        const login = cfg.login?.trim();
-        if (!login) {
-            throw new VertuError('未找到宿主注入的 Agent 账号；Agent 不得自行执行账号密码登录。');
-        }
-        const appKey = process.env[VERTU_APP_KEY_ENV]?.trim() ??
-            (await loadStoredAgentKey(serviceUrl, appId));
-        if (!appKey) {
-            throw new VertuError('无 app_key。请由宿主或人工管理员完成绑定；Agent 不得自行执行账号密码登录。');
-        }
-        const shell = opts.shell ?? merged.shell ?? 'bash';
-        if (shell === 'powershell') {
-            const esc = (s) => s.replace(/'/g, "''");
-            console.log(`$env:VERTU_VPS_SERVICE_URL='${esc(serviceUrl)}'`);
-            console.log(`$env:VERTU_APP_ID='${esc(appId)}'`);
-            console.log(`$env:VERTU_APP_KEY='${esc(appKey)}'`);
-            console.log(`$env:VERTU_USER_LOGIN='${esc(login)}'`);
-            return;
-        }
-        process.stdout.write(formatAgentEnvExports(serviceUrl, appId, appKey, login));
-    });
-    cmd
-        .command('ask')
-        .description('向另一位员工的 VPS Harness Agent 发起请求并等待答复')
-        .requiredOption('--user-id <id>', '对方 user_id')
-        .requiredOption('--message <text|@file>', '请求内容；长内容可使用 @file / @-')
-        .option('--base-url <url>', 'Vertu 服务地址')
-        .option('--stop-at <datetime>', '循环协作截止时间（ISO 8601 或本地 YYYY-MM-DDTHH:mm）')
-        .option('--duration-minutes <n>', '从现在起循环协作多少分钟（与 --stop-at 二选一）')
-        .option('--timeout <seconds>', '等待对方首轮答复的秒数', '180')
-        .option('--no-wait', '只发送请求，不等待答复')
-        .action(async (opts, command) => {
-        const merged = command.optsWithGlobals();
-        const serviceUrl = resolveVpsServiceUrl(opts.baseUrl ?? merged.baseUrl);
-        const userId = requiredUserId(opts.userId);
-        const message = (await expandAtFileToken(opts.message ?? '', '--message')).trim();
-        if (!message)
-            throw new VertuError('--message 不能为空。');
-        if (message.length > 20_000)
-            throw new VertuError('--message 不能超过 20000 个字符。');
-        if (opts.stopAt && opts.durationMinutes) {
-            throw new VertuError('--stop-at 与 --duration-minutes 只能使用一个。');
-        }
-        let stopAt;
-        if (opts.stopAt) {
-            const parsed = Date.parse(opts.stopAt);
-            if (!Number.isFinite(parsed) || parsed <= Date.now()) {
-                throw new VertuError('--stop-at 必须是未来的有效日期时间。');
-            }
-            stopAt = new Date(parsed).toISOString();
-        }
-        else if (opts.durationMinutes) {
-            const minutes = Number(opts.durationMinutes);
-            if (!Number.isFinite(minutes) || minutes <= 0 || minutes > 1440) {
-                throw new VertuError('--duration-minutes 必须大于 0 且不超过 1440 分钟。');
-            }
-            stopAt = new Date(Date.now() + minutes * 60_000).toISOString();
-        }
-        const timeoutSeconds = Number(opts.timeout);
-        if (!Number.isFinite(timeoutSeconds) || timeoutSeconds < 1 || timeoutSeconds > 1800) {
-            throw new VertuError('--timeout 必须在 1 到 1800 秒之间。');
-        }
-        const requestId = randomUUID();
-        const sent = await imRequest('POST', '/v1/im/user-robots/harness/send', {
-            baseUrl: serviceUrl,
-            body: {
-                body: message,
-                idempotency_key: `vps-harness-request-${requestId}`,
-                message_type: 'text',
-                target_user_id: userId,
-                metadata: {
-                    [HARNESS_COLLABORATION_KIND]: {
-                        objective: message,
-                        protocol: 1,
-                        request_id: requestId,
-                        ...(stopAt ? { stop_at: stopAt } : {}),
-                        turn: 0,
-                        type: 'request',
-                    },
-                },
-            },
-        });
-        const channelId = extractAgentAskChannelId(sent);
-        if (opts.wait === false) {
-            console.log(JSON.stringify({ channel_id: channelId, request_id: requestId, status: 'sent' }, null, 2));
-            return;
-        }
-        const deadline = Date.now() + timeoutSeconds * 1000;
-        while (Date.now() < deadline) {
-            await sleep(1_000);
-            const history = await imRequest('GET', `/v1/im/channels/${encodeURIComponent(channelId)}/messages`, { baseUrl: serviceUrl, query: { limit: 50 } });
-            const response = collaborationTurnFromHistory(history, requestId);
-            if (response) {
-                console.log(JSON.stringify({
-                    answer: response.body,
-                    channel_id: channelId,
-                    message_id: response.messageId,
-                    request_id: requestId,
-                    status: response.type === 'request' ? 'continuing' : 'completed',
-                    turn: response.turn,
-                }, null, 2));
-                return;
-            }
-        }
-        throw new VertuError(`等待员工 VPS Harness Agent 答复超时（${timeoutSeconds} 秒）。请确认对方在线且已开启 Agent 联系开关。`);
-    });
-    cmd
-        .command('message-user')
-        .description('以我的 VPS Harness Agent 身份给员工发起私聊')
-        .requiredOption('--user-id <id>', '对方 user_id')
-        .requiredOption('--message <text|@file>', '消息内容；长内容可使用 @file / @-')
-        .option('--base-url <url>', 'Vertu 服务地址')
-        .action(async (opts, command) => {
-        const merged = command.optsWithGlobals();
-        const serviceUrl = resolveVpsServiceUrl(opts.baseUrl ?? merged.baseUrl);
-        const userId = requiredUserId(opts.userId);
-        const message = (await expandAtFileToken(opts.message ?? '', '--message')).trim();
-        if (!message)
-            throw new VertuError('--message 不能为空。');
-        if (message.length > 20_000)
-            throw new VertuError('--message 不能超过 20000 个字符。');
-        const requestId = randomUUID();
-        const sent = await imRequest('POST', '/v1/im/user-robots/harness/message-user', {
-            baseUrl: serviceUrl,
-            body: {
-                body: message,
-                idempotency_key: `vps-harness-human-${requestId}`,
-                message_type: 'text',
-                target_user_id: userId,
-            },
-        });
-        console.log(JSON.stringify({
-            channel_id: extractAgentAskChannelId(sent),
-            message_id: extractHarnessMessageId(sent),
-            request_id: requestId,
-            status: 'sent',
-        }, null, 2));
-    });
-    return cmd;
-}
-function extractHarnessMessageId(out) {
-    if (!out || typeof out !== 'object' || !('message' in out))
-        return null;
-    const message = out.message;
-    if (!message || typeof message !== 'object' || !('id' in message))
-        return null;
-    const id = message.id;
-    return typeof id === 'string' && id ? id : null;
-}
-function extractAgentAskChannelId(out) {
-    if (out && typeof out === 'object' && 'channel_id' in out) {
-        const id = out.channel_id;
-        if (typeof id === 'string' && id)
-            return id;
-    }
-    if (!out || typeof out !== 'object' || !('channel' in out)) {
-        throw new VertuError('Vertu IM 未返回 channel_id。');
-    }
-    const channel = out.channel;
-    if (!channel || typeof channel !== 'object' || !('id' in channel)) {
-        throw new VertuError('Vertu IM 未返回 channel.id。');
-    }
-    const id = channel.id;
-    if (typeof id !== 'string' || !id)
-        throw new VertuError('Vertu IM 返回了无效的 channel.id。');
-    return id;
-}

package/dist/packages/vps-work/src/commands/approval/index.js

@@ -1,7 +0,0 @@
-import { Command } from 'commander';
-import { attachApprovalShortcuts } from './shortcuts.js';
-export function buildApprovalCommand() {
-    const approval = new Command('approval').description('Approval shortcuts: pending queue, approval history, pass/reject guidance.');
-    attachApprovalShortcuts(approval);
-    return approval;
-}