weaver-e9-assistant-cli 1.0.0 → 1.1.2

package/dist/cli.js

@@ -18,18 +18,19 @@ import { transferTodo } from './todotransfer.js';
 import { forwardTodo, circulateTodo } from './todoforward.js';
 import { ccTodo } from './todocc.js';
 import { askIdeaTodo } from './todoaskidea.js';
-import { getMyBlogList, getMyBlogAll, isBlogRecalled, createBlog, getBlogWorkIndex, getBlogMenuCountdata, getVisitorList, getBlogNote, getCurrentUserInfo, getMsgRemindList, getDefaultTemplate, getBlogAppList, getAtAllList, getBlogPageSearchCondition, getBlogHomepageList, searchMyBlog, getBlogPersonalInfo, sendRemindUnsubmit, addBlogReply, addOrDeleteZan, saveBlogNote, recallBlog, deleteBlogReply } from './blog.js';
+import { getMyBlogList, getMyBlogAll, isBlogRecalled, createBlog, getBlogWorkIndex, getBlogMenuCountdata, getVisitorList, getBlogNote, getCurrentUserInfo, getMsgRemindList, getDefaultTemplate, getBlogAppList, getAtAllList, getBlogPageSearchCondition, getBlogHomepageList, searchMyBlog, getBlogPersonalInfo, sendRemindUnsubmit, addBlogReply, addOrDeleteZan, saveBlogNote, recallBlog, deleteBlogReply, attentionOpt, dealMsgRemind, getShareToMeUserList } from './blog.js';
 import { getCreateWfList, buildCreateWfUrl, buildRequestFormUrl, findCreateWfByName } from './wfcreate.js';
 import { describeFormFields } from './wfform.js';
 import { getStartableFields, prepareCreateSubmission, submitCreateRequest, resolveWorkflowId, getOdocNextNodes, odocFlowNext } from './wfstart.js';
 import { cmdTokenLogin, cmdCookieLogin, cmdAuthStatus } from './auth.js';
 import { getEmailList, getEmailView, setMailReadStatus, resolveDateRange, sendEmail, setEmailStar, deleteEmails, moveEmails, getEmailLabels, addEmailLabel, applyEmailLabel, setEmailWaitdeal, recallEmail, uploadEmailAttachment, getEmailAttachmentList, getEmailSize, getEmailReciveAccounts } from './email.js';
-import { searchWorkplan, createWorkplan, getMyCalendar, getAttentionData, getBaseData, getCalendarData, getSelectType, getWorkplanSearchCondition, viewWorkplan, deleteWorkplan, finishWorkplan, downloadWorkplanImportTemplate, importWorkplanExcel } from './workplan.js';
+import { searchWorkplan, createWorkplan, getMyCalendar, getAttentionData, getBaseData, getCalendarData, getSelectType, getWorkplanSearchCondition, viewWorkplan, deleteWorkplan, finishWorkplan, downloadWorkplanImportTemplate, importWorkplanExcel, exportWorkplanExcel } from './workplan.js';
 import { listOdocTodo, getOdocTodoCount, listOdocCreate } from './odoc.js';
 import { punch, getButtons, resolvePunchItem, signSecret, buildEncryptObj } from './kq.js';
 import { collectQueryableBusiness } from './report.js';
 import { listCube, getCubeCondition, getCubeInit, exportCubeExcel, getSearchColumnInfo, listCubeExcel, getCubeCountData, getCubeGroupData, getExpCardConfig, getModeBrowserOptions, getCardFields, submitCubeCard, deleteCubeData, printCubePdf, listCubeMenus, findCubeByName, fetchMenuMounts, previewCubeCard, fetchCubeRowsByIds, resolveCubeCondition, downloadCubeImportTemplate, importCubeExcel } from './cube.js';
-import { getCurrentUser } from './wfuser.js';
+import { getCurrentUser, getCurrentUserIsAdmin } from './wfuser.js';
+import { getSubordinates, assertUserIdsInScope, assertNamesInScope, isScopeEnforced } from './subordinate.js';
 import { parseArgs, flagStr, flagBool } from './args.js';
 import { todayStr } from './util.js';
 import { BOX_TOP, DIVIDER } from './render.js';
@@ -39,6 +40,7 @@ function usage() {
         '',
         '用法:',
         '  e9 version',
+        '  e9 whoami                  查看当前登录人（userid/用户名/是否系统管理员 isAdmin）',
         '  e9 todo list [--tab <key>] [--page <n>] [--keyword <text>] [--exclude-current-user]',
         '              [--workflow <id>] [--creator <id>] [--creator-dept <id>] [--creator-subcom <id>]',
         '              [--create-time <range>] [--receive-time <range>] [--operate-time <range>]',
@@ -58,12 +60,15 @@ function usage() {
         '  e9 todo batch-attention --request-ids "1,2" [--attention-id <类型id>] [--yes]   批量关注（先预览，默认加入首个关注类型）',
         '  e9 todo done  [--page <n>] [--keyword <text>] [--workflow <id>] [--creator <id>] [--sort <spec>] [--sub-category <tab>] [--json] [--raw]   已办列表',
         '  e9 todo mine  [--page <n>] [--keyword <text>] [--workflow <id>] [--creator <id>] [--sort <spec>] [--sub-category <tab>] [--json] [--raw]   我发起的流程',
-        '  e9 blog list [--date YYYY-MM-DD] [--scope <全部|关注|共享|下级>] [--page <n>] [--json] [--raw]',
+        '  e9 blog list [--date YYYY-MM-DD] [--scope <全部|关注|下级|未读|共享|分享给我|特别关注>] [--page <n>] [--json] [--raw]',
         '  e9 blog search --content <关键词> [--start-date <YYYY-MM-DD>] [--end-date <YYYY-MM-DD>] [--page <n>]   搜索我的微博',
         '  e9 blog view --user-id <id>                               查看某人微博主页',
         '  e9 blog remind --user-id <id> [--workdate YYYY-MM-DD] [--yes]   催办（提醒某人写日报，默认今天）',
-        '  e9 blog reply --id <微博id> --content "<内容>" [--yes]    回复微博',
-        '  e9 blog like --id <微博id> [--yes]                       点赞/取消点赞（默认 dry-run）',
+        '  e9 blog reply --id <微博id> --content "<内容>" [--owner <作者userid>] [--yes]    回复微博（跨账号加 --owner 直达作者）',
+        '  e9 blog like --id <微博id> [--owner <作者userid>] [--yes]   点赞/取消点赞（默认 dry-run；跨账号加 --owner）',
+        '  e9 blog follow --id <目标userid> [--yes]                 发起微博关注申请（对方同意后互关可访问主页）',
+        '  e9 blog agree-follow --id <申请人userid> [--yes]        同意对方的关注申请',
+        '  e9 blog share-users                                    分享给我的人（用户列表）',
         '  e9 blog check [--date YYYY-MM-DD]   查某天是否已写日报（按 isReCalled 区分正常发布/已撤回）；默认今天，无正常发布记录退出码 1',
         '  e9 report collect [--date YYYY-MM-DD] [--json]   汇总当前环境可查询业务数据（非操作审计）',
         '  e9 blog create --content "<文本>" [--content-file <路径>] [--share-type N] [--date YYYY-MM-DD] [--discuss-id <id>] [--yes]',
@@ -113,6 +118,7 @@ function usage() {
         '  e9 workplan create --name <名称> --begin "YYYY-MM-DD HH:mm" --end "YYYY-MM-DD HH:mm" [--description-file <路径>]   新建日程（默认 dry-run）',
         '  e9 workplan import-template [--out-dir <目录>]   下载原生日程导入模板',
         '  e9 workplan import --file <模板.xls[x]> [--yes]  批量导入日程（默认仅预览）',
+        '  e9 workplan export [--type <list|html>] [--group <部门|分部|下级|...>] [--date <YYYY-MM-DD>] [--workplan-type <id>] [--out-dir <目录>] [--yes]  导出日程（list=日程清单 / html=日程一览表，默认 dry-run）',
         '  e9 odoc todo [--page <n>] [--subject <标题>] [--dispatch-num <发文字号>] [--type <公文种类id>] [--topic <主题分类id>]   公文待办列表（getCustomPageList table，每页 10 条）',
         '  e9 odoc count [--view]              公文待办/待阅计数（发文/收文/签报）',
         '  e9 odoc create-list [--type 1|2]     发文/收文流程列表（1=发文拟稿 2=收文登记，复用 create start 发起）',
@@ -138,6 +144,7 @@ function usage() {
         '  e9 cube menus [--refresh]   列全部建模台账（目录接口为主、菜单兜底，缓存7天，一次拿全 customid+mode+app）',
         '  e9 cube find <名称>          按名模糊匹配台账（列候选消歧，返回 customid+mode+app，供 list/create 等用）',
         '  e9 cube find <名称> --tree-detail   展开 tree 测试类台账的全部树节点路径（默认只显首条菜单路径）',
+        '  e9 subordinate list [--name <姓名>] [--all-level] [--page <n>] [--json] [--raw] [--refresh]   查询我的下属（默认直接下属；--all-level 全部层级）',
         '  e9 search <名称>            统一搜台账+菜单+流程（只说名字、不知归属时用，避免猜错域）',
         '  e9 config                    查看当前配置来源与状态',
         '  e9 config set <field> <value>   设置配置（field: baseUrl/cookie/username/menuIds/...；首次用 set baseUrl）',
@@ -1308,6 +1315,8 @@ async function runBlog(args) {
             console.error('blog view 需要 --user-id <用户id>');
             process.exit(1);
         }
+        // ★越权防护：只能看本人 + 全部层级下属的微博主页，越界拒绝
+        await assertUserIdsInScope(cfg, [userId], { domain: 'blog' });
         const r = await getBlogPersonalInfo(cfg, userId);
         if (args.flags.json) {
             console.log(JSON.stringify(r, null, 2));
@@ -1351,16 +1360,25 @@ async function runBlog(args) {
             process.exit(1);
         }
         const send = !!args.flags.yes;
-        // 被评论人 userid(bediscussantId) + workdate：手动优先，否则从微博列表按 id 查
+        // 被评论人 userid(bediscussantId) + workdate：手动优先，否则从微博列表按 id 查。
+        // 修复 #4：--owner <作者userid> 跨账号直达（a 回复 b 的微博时作者即被评论人，无需再翻列表）；
+        //   未给 --owner 时保持原逻辑——从当前登录者自己的微博列表按 id 查找。
         let discussantId = flagStr(args, 'bediscussant-id');
         let workdate = flagStr(args, 'workdate');
+        const owner = flagStr(args, 'owner');
+        if (!discussantId && owner) {
+            discussantId = owner;
+        }
+        if (!workdate && owner) {
+            workdate = flagStr(args, 'date') ?? todayStr();
+        }
         if (!discussantId || !workdate) {
             const date = flagStr(args, 'date') ?? todayStr();
             // 逐页拉取当天全部微博（重复检测终止），避免目标微博落在单页之外
             const list = await getMyBlogAll(cfg, date);
             const hit = (list.items || []).find(b => String(b.id) === String(blogId));
             if (!hit) {
-                console.error(`未在微博列表(${date})找到 id=${blogId}。用 --bediscussant-id <作者userid> --workdate <YYYY-MM-DD> 手动指定，或 --date 指定微博日期。`);
+                console.error(`未在微博列表(${date})找到 id=${blogId}。用 --bediscussant-id <作者userid> --workdate <YYYY-MM-DD> 手动指定，或 --owner <作者userid> 跨账号直达，或 --date 指定微博日期。`);
                 process.exit(1);
             }
             discussantId = discussantId || (hit.raw?.userid ? String(hit.raw.userid) : '') || (hit.raw?.creater ? String(hit.raw.creater) : '') || (hit.userid ? String(hit.userid) : '');
@@ -1371,12 +1389,22 @@ async function runBlog(args) {
             console.log(`[dry-run] 未发送。将回复微博 id=${r.blogId}（被评论人 userid=${discussantId}, workdate=${workdate}）。确认后加 --yes。`);
             return;
         }
-        console.log(`[已回复] blogId=${r.blogId}  status=${r.response?.status}`);
         const j = r.response?.json;
         const ok = j?.status === '1' || j?.status === 1 || j?.api_status === '1';
+        // 修复 #5：--json 输出完整响应（含 blogReplyList 每条的 replyId），不再截断 300 字符；
+        //   同时避免前置普通输出行污染 json（--json 时先输出 JSON 再 return）。
+        if (args.flags.json) {
+            console.log(JSON.stringify({ blogId: r.blogId, workdate, discussantId, status: r.response?.status, ok, response: j }, null, 2));
+            return;
+        }
+        console.log(`[已回复] blogId=${r.blogId}  status=${r.response?.status}`);
         console.log(`  ${ok ? '✅ 回复成功' : '⚠ 回复失败'}`);
-        if (j)
-            console.log('响应:', JSON.stringify(j).slice(0, 300));
+        if (j) {
+            const list = j.blogReplyList ?? j.blogReplyPoList ?? [];
+            if (Array.isArray(list) && list.length)
+                console.log(`  最新回复: ${list.map((it) => `replyId=${it.replyId ?? it.id}`).join(', ')}`);
+            console.log('响应:', JSON.stringify(j).slice(0, 300), '（--json 查看完整回复列表）');
+        }
         return;
     }
     if (sub === 'like') {
@@ -1388,16 +1416,33 @@ async function runBlog(args) {
         const send = !!args.flags.yes;
         // 手动参数优先；否则自动从微博列表解析 workdate / 当前用户 id / 当前点赞状态。
         // SPA bundle 实证 addOrDeleteZan 请求体：workdate + userId + optType(1=赞/0=取消) + discussId(微博id)。
+        // 修复 #4：--owner <作者userid> 跨账号点赞——workdate 取 date/今天，userId 仍为当前登录者（点赞人）。
         let workdate = flagStr(args, 'workdate');
         let userId = flagStr(args, 'user-id');
         let optType = flagStr(args, 'opt-type');
+        const owner = flagStr(args, 'owner');
+        const date = flagStr(args, 'date') ?? todayStr();
+        if (owner) {
+            workdate = workdate || date;
+            if (!userId) {
+                const me = await getCurrentUserInfo(cfg);
+                userId = me.id ? String(me.id) : '';
+            }
+            if (!optType) {
+                // 跨账号已赞判定：从 owner 的微博首页列表找该条，看 blogZanBean.blogZanPoList 是否含当前用户
+                const list = await getBlogHomepageList(cfg, { blogUserId: owner, endDate: date, startDate: date });
+                const hit = (list.items || []).find((b) => String(b.id) === String(blogId));
+                const zanList = Array.isArray(hit?.raw?.blogZanBean?.blogZanPoList) ? hit.raw.blogZanBean.blogZanPoList : [];
+                const alreadyLiked = zanList.some((z) => String(z.zanHrmid ?? '') === String(userId));
+                optType = alreadyLiked ? '0' : '1';
+            }
+        }
         if (!workdate || !userId || !optType) {
-            const date = flagStr(args, 'date') ?? todayStr();
             // 逐页拉取当天全部微博（重复检测终止），避免目标微博落在单页之外
             const list = await getMyBlogAll(cfg, date);
             const hit = (list.items || []).find((b) => String(b.id) === String(blogId));
             if (!hit) {
-                console.error(`未在微博列表(${date})找到 id=${blogId}。用 --workdate <YYYY-MM-DD> --user-id <当前用户id> --opt-type <1|0> 手动指定，或 --date 指定微博日期。`);
+                console.error(`未在微博列表(${date})找到 id=${blogId}。用 --workdate <YYYY-MM-DD> --user-id <当前用户id> --opt-type <1|0> 手动指定，或 --owner <作者userid> 跨账号直达，或 --date 指定微博日期。`);
                 process.exit(1);
             }
             workdate = workdate || String(hit.workdate ?? '') || String(hit.createdate ?? '').slice(0, 10);
@@ -1478,8 +1523,9 @@ async function runBlog(args) {
             return;
         }
         console.log(`${BOX_TOP}`);
-        console.log(`E9 微博 工作指数 & 心情指数`);
+        console.log(`E9 微博 考勤指数 & 工作指数 & 心情指数`);
         console.log(DIVIDER);
+        console.log(`  考勤指数: ${wi.schedule.index ?? '?'}  ${wi.schedule.title ?? ''}`);
         console.log(`  工作指数: ${wi.work.index ?? '?'}  ${wi.work.title ?? ''}`);
         console.log(`  心情指数: ${wi.mood.index ?? '?'}  ${wi.mood.title ?? ''}`);
         console.log(DIVIDER);
@@ -1554,6 +1600,60 @@ async function runBlog(args) {
             console.log('响应:', JSON.stringify(r.response.json).slice(0, 400));
         return;
     }
+    if (sub === 'follow') {
+        // 发起关注。E9 微博关注需对方同意：attentionOpt(attentionStatus=3) 发申请 → 对方 dealMsgRemind(opt=1) 同意。
+        const userId = flagStr(args, 'id');
+        if (!userId) {
+            console.error('blog follow 需要 --id <目标用户id>（被关注者 userid）');
+            process.exit(1);
+        }
+        const send = !!args.flags.yes;
+        const r = await attentionOpt(cfg, { userId, send });
+        if (!r.sent) {
+            console.log(`[dry-run] 未发送。将向 userId=${r.userId} 发起关注申请（attentionStatus=${r.attentionStatus}）。确认后加 --yes。`);
+            return;
+        }
+        console.log(`[已发送关注申请] 目标 userId=${r.userId}  attentionStatus=${r.attnStatus ?? '?'}`);
+        console.log(`  ${r.ok ? '✅ 关注申请已发出（等待对方同意，互关后可访问对方微博）' : '⚠ 关注申请失败'}`);
+        if (r.raw) {
+            const hint = r.raw?.errorCode === '002' || r.raw?.msg?.includes('登录信息超时')
+                ? '  ⚠ cookie 已过期，请先 `e9 auth token-login` 刷新后重试。'
+                : '  （cookie 通道接口，token 通道不生效）';
+            if (!r.ok)
+                console.log(`  响应: ${JSON.stringify(r.raw).slice(0, 200)}${hint}`);
+        }
+        return;
+    }
+    if (sub === 'agree-follow') {
+        // 同意关注申请：getMsgRemindList 找"向你申请关注"(remindType=1) 的记录 → dealMsgRemind(id, relatedId, opt=1)。
+        // 实测字段方向不定（remindid/relatedid 中任一可能是申请人），用宽匹配；
+        // relatedId 抓包实证 = 当前登录者自己的 userid（sysadmin=1），与记录字段无关。
+        const userId = flagStr(args, 'id');
+        if (!userId) {
+            console.error('blog agree-follow 需要 --id <申请人用户id>');
+            process.exit(1);
+        }
+        const send = !!args.flags.yes;
+        const reminds = await getMsgRemindList(cfg);
+        const req = (reminds.items || []).find((it) => it.remindType === '1' && (it.remindid === String(userId) || it.relatedid === String(userId)));
+        if (!req) {
+            console.error(`未在消息提醒中找到 ${userId} 的关注申请（remindType=1）。可用 \`blog reminders --json\` 查看全部提醒；若对方已取消申请则无需处理。`);
+            process.exit(1);
+        }
+        // 修复 #9：dealMsgRemind 的 relatedId = 申请人（发起关注者）userid，抓包实证；
+        //   早期误用当前登录者 id 导致「同意成功但互关未建立」。userId 入参即申请人。
+        const relatedId = String(userId);
+        if (!send) {
+            console.log(`[dry-run] 将同意 ${userId} 的关注申请（提醒记录 id=${req.id}, relatedId=${relatedId}）。确认后加 --yes。`);
+            return;
+        }
+        const r = await dealMsgRemind(cfg, { id: req.id, relatedId, opt: 1, send });
+        console.log(`[已处理关注申请] 申请人 userId=${userId}  提醒 id=${r.id}`);
+        console.log(`  ${r.ok ? '✅ 已同意关注，互关完成' : '⚠ 处理失败'}`);
+        if (r.raw && !r.ok)
+            console.log(`  响应: ${JSON.stringify(r.raw).slice(0, 200)}`);
+        return;
+    }
     if (sub === 'delete-reply') {
         // 删除微博评论（正文不可删，只能撤回；评论可删）。POST /api/blog/base/deleteBlogReplay。
         const replyId = flagStr(args, 'id');
@@ -1598,9 +1698,12 @@ async function runBlog(args) {
             console.log('（无提醒）');
             return;
         }
+        const TYPE_LABEL = { '1': '关注申请', '8': '系统提醒' };
         for (let i = 0; i < r.items.length; i++) {
             const it = r.items[i];
-            console.log(`${i + 1}. [${it.type ?? ''}] ${it.content ?? ''}  ${it.creator ?? ''}  ${it.createDate ?? ''}`);
+            const label = TYPE_LABEL[it.remindType] ?? (it.type ? `类型${it.type}` : '提醒');
+            const time = [it.createDate, it.createTime].filter(Boolean).join(' ');
+            console.log(`${i + 1}. [${label}] ${it.content ?? ''}${time ? `  (${time})` : ''}`);
         }
         return;
     }
@@ -1665,6 +1768,24 @@ async function runBlog(args) {
         }
         return;
     }
+    if (sub === 'share-users') {
+        const r = await getShareToMeUserList(cfg);
+        if (args.flags.json) {
+            console.log(JSON.stringify(r, null, 2));
+            return;
+        }
+        console.log(`E9 微博 分享给我的人  共 ${r.count ?? r.items.length} 人`);
+        if (r.items.length === 0) {
+            console.log('（无人分享给我）');
+            return;
+        }
+        for (let i = 0; i < r.items.length; i++) {
+            const it = r.items[i];
+            const meta = [it.deptName, it.jobtitle, it.isattention ? '已关注' : null].filter(Boolean).join(' | ');
+            console.log(`${i + 1}. ${it.username ?? '(未知)'}${meta ? `  (${meta})` : ''}`);
+        }
+        return;
+    }
     if (sub === 'search-fields') {
         const r = await getBlogPageSearchCondition(cfg);
         if (args.flags.json) {
@@ -1696,7 +1817,7 @@ async function runBlog(args) {
         console.log(JSON.stringify(r.template, null, 2));
         return;
     }
-    console.error(`blog 暂只支持 list / search / view / remind / reply / like / create / check / stats / note / recall / delete-reply / user-info / reminders / apps / at-list / visitors / search-fields / template，收到: ${sub}`);
+    console.error(`blog 暂只支持 list / search / view / remind / reply / like / create / check / stats / note / recall / delete-reply / follow / agree-follow / user-info / reminders / apps / at-list / visitors / share-users / search-fields / template，收到: ${sub}`);
     process.exit(1);
 }
 async function runWorkplan(args) {
@@ -1724,36 +1845,73 @@ async function runWorkplan(args) {
         return;
     }
     if (sub === 'list') {
-        // 使用 getCalendarData 替代 AllCalendar，支持组织视图
         const group = flagStr(args, 'group');
-        // 先获取 baseData 拿组织信息
+        const date = flagStr(args, 'date');
+        const type = flagStr(args, 'type');
+        // 默认（无 --group）=「我的日程」：查当前用户自己的日程，走 MyCalendar（selectUser 空=当前用户）。
+        // 只有显式传 --group 才走组织视图 getCalendarData（部门/分部/下级等）。
+        if (!group) {
+            const selectUser = flagStr(args, 'select-user');
+            // ★越权防护：--select-user 指定他人日程时目标必须 ∈ {本人 + 全部层级下属}
+            if (selectUser)
+                await assertUserIdsInScope(cfg, [selectUser], { domain: 'workplan' });
+            const r = await getMyCalendar(cfg, { selectDate: date, viewType: '3', selectUser: selectUser ?? '', workPlanType: type });
+            if (args.flags.raw) {
+                console.error('===== RAW MyCalendar =====');
+                console.error(JSON.stringify(r.raw, null, 2));
+                console.error('===== 解析结果 =====');
+            }
+            if (args.flags.json) {
+                console.log(JSON.stringify({
+                    selectDate: r.selectDate, count: r.items.length,
+                    items: r.items.map((it) => withLink('workplan', {
+                        id: it.id, name: it.name,
+                        beginDateTime: it.beginDateTime, endDateTime: it.endDateTime,
+                        color: it.color, typeName: it.typeName, allDay: it.allDay,
+                    }, wpBase)),
+                }, null, 2));
+                return;
+            }
+            console.log(`E9 日程 [${r.selectDate}]  共 ${r.items.length} 条`);
+            if (r.items.length === 0) {
+                console.log('（该区间无日程）');
+                return;
+            }
+            for (let i = 0; i < r.items.length; i++) {
+                const it = r.items[i];
+                const time = [it.beginDateTime, it.endDateTime].filter(Boolean).join(' ~ ');
+                const allDay = it.allDay === '1' ? ' [全天]' : '';
+                console.log(`${i + 1}. ${hyperlinkFor('workplan', it, wpBase, it.name ?? '(无名)')}${allDay}${time ? `  [${time}]` : ''}  ${it.typeName ?? ''}`);
+            }
+            return;
+        }
+        // 组织视图（--group 部门/分部/下级等）
         const bd = await getBaseData(cfg);
         let objType = '1', objIds = bd.dept[0]?.id ?? '';
-        if (group) {
-            const groupMap = { '部门': '1', '分部': '2', '人力': '3', '上级': '4', '下级': '5', '常用组': '6', '关注': '7' };
-            const gkey = groupMap[group] || group;
-            const sg = bd.selectGroup.find((g) => g.key === gkey);
-            if (sg) {
-                if (gkey === '1') {
-                    objType = '1';
-                    objIds = bd.dept[0]?.id ?? '';
-                }
-                else if (gkey === '2') {
-                    objType = '2';
-                    objIds = bd.subComp[0]?.id ?? '';
-                }
-                else if (gkey === '5') {
-                    objType = '1';
-                    objIds = bd.dept[0]?.id ?? '';
-                }
+        const groupMap = { '部门': '1', '分部': '2', '人力资源': '3', '人力': '3', '所有上级': '4', '上级': '4', '直接下级': '5', '下级': '5', '常用组': '6', '我的关注': '7', '关注': '7' };
+        const gkey = groupMap[group] || group;
+        const sg = bd.selectGroup.find((g) => g.key === gkey);
+        if (sg) {
+            if (gkey === '1') {
+                objType = '1';
+                objIds = bd.dept[0]?.id ?? '';
+            }
+            else if (gkey === '2') {
+                objType = '2';
+                objIds = bd.subComp[0]?.id ?? '';
+            }
+            else if (gkey === '3') {
+                // 人力资源：按人员查询，默认当前登录人（即「我的日程」）。当前用户 id 从 cookie 的 loginuuids 取（导出/日历走 cookie，token 可能过期）。
+                objType = '3';
+                const _uid = String(cfg.cookie || '').match(/loginuuids=([^;]*)/i);
+                objIds = _uid ? decodeURIComponent(_uid[1].trim()) : '';
+            }
+            else if (gkey === '5') {
+                objType = '1';
+                objIds = bd.dept[0]?.id ?? '';
             }
         }
-        const r = await getCalendarData(cfg, {
-            selectDate: flagStr(args, 'date'),
-            objType,
-            objIds,
-            workPlanType: flagStr(args, 'type'),
-        });
+        const r = await getCalendarData(cfg, { selectDate: date, objType, objIds, workPlanType: type });
         if (args.flags.raw) {
             console.error('===== RAW getCalendarData =====');
             console.error(JSON.stringify(r.raw, null, 2));
@@ -1775,7 +1933,7 @@ async function runWorkplan(args) {
             }, null, 2));
             return;
         }
-        const groupLabel = group ? ` · ${group}` : '';
+        const groupLabel = ` · ${group}`;
         console.log(`E9 日程 [${r.selectDate}${groupLabel}]  共 ${r.count} 条`);
         if (r.count === 0) {
             console.log('（该区间无日程）');
@@ -1830,8 +1988,10 @@ async function runWorkplan(args) {
         }
         console.log(`[已完成] workid=${r.workid}  status=${r.response?.status}`);
         const j = r.response?.json;
-        const ok = j?.api_status === true || j?.status === '1' || j?.status === true || j?.success === true;
-        console.log(`  ${ok ? '✅ 完成成功' : '⚠ 完成失败'}`);
+        // 修复 #2：以 status===true 为成功标志（失败时 status===false + error 字段），
+        // 避免「api_status:true 但 status:false」被误判成功。
+        const ok = (j?.status === true || j?.status === '1' || j?.status === 1 || j?.success === true) && !j?.error;
+        console.log(`  ${ok ? '✅ 完成成功' : '⚠ 完成失败'}${j?.error ? `：${j.error}` : ''}`);
         if (j)
             console.log('响应:', JSON.stringify(j).slice(0, 300));
         return;
@@ -1850,8 +2010,10 @@ async function runWorkplan(args) {
         }
         console.log(`[已删除] workid=${r.workid}  status=${r.response?.status}`);
         const j = r.response?.json;
-        const ok = j?.api_status === true || j?.status === '1' || j?.status === true || j?.success === true;
-        console.log(`  ${ok ? '✅ 删除成功' : '⚠ 删除失败'}`);
+        // 修复 #2：后端删除失败时返回 {api_status:true, status:false, error:"..."}，
+        // 旧判断只看 api_status 误判成功。以 status===true 且无 error 为成功。
+        const ok = (j?.status === true || j?.status === '1' || j?.status === 1 || j?.success === true) && !j?.error;
+        console.log(`  ${ok ? '✅ 删除成功' : '⚠ 删除失败'}${j?.error ? `：${j.error}` : ''}`);
         if (j)
             console.log('响应:', JSON.stringify(j).slice(0, 300));
         return;
@@ -1906,12 +2068,16 @@ async function runWorkplan(args) {
             }
             catch { /* 获取分组失败不阻断 */ }
         }
+        // ★越权防护：按人筛选目标必须 ∈ {本人 + 全部层级下属}
+        const createrId = flagStr(args, 'creater');
+        const receiveId = flagStr(args, 'receiver');
+        await assertUserIdsInScope(cfg, [createrId, receiveId].filter(Boolean), { domain: 'workplan' });
         const r = await searchWorkplan(cfg, {
             name: flagStr(args, 'name'),
             type: flagStr(args, 'type'),
             status: flagStr(args, 'status'),
-            createrId: flagStr(args, 'creater'),
-            receiveId: flagStr(args, 'receiver'),
+            createrId,
+            receiveId,
             timeSag: groupFilter ?? flagStr(args, 'time-sag') ?? '0',
             beginDate: flagStr(args, 'begin'),
             endDate: flagStr(args, 'end'),
@@ -2006,7 +2172,11 @@ async function runWorkplan(args) {
         return;
     }
     if (sub === 'my-calendar') {
-        const r = await getMyCalendar(cfg, { selectDate: flagStr(args, 'date'), viewType: flagStr(args, 'view-type'), selectUser: flagStr(args, 'select-user'), workPlanType: flagStr(args, 'type') });
+        const selectUser = flagStr(args, 'select-user');
+        // ★越权防护：--select-user 指定他人日程时目标必须 ∈ {本人 + 全部层级下属}
+        if (selectUser)
+            await assertUserIdsInScope(cfg, [selectUser], { domain: 'workplan' });
+        const r = await getMyCalendar(cfg, { selectDate: flagStr(args, 'date'), viewType: flagStr(args, 'view-type'), selectUser, workPlanType: flagStr(args, 'type') });
         if (args.flags.json) {
             console.log(JSON.stringify(r, null, 2));
             return;
@@ -2066,7 +2236,54 @@ async function runWorkplan(args) {
         console.log(`${BOX_TOP}`);
         return;
     }
-    console.error(`workplan 暂只支持 list / view / finish / delete / types / search-conditions / search / create / my-calendar / attention / base-data / import-template / import，收到: ${sub}`);
+    if (sub === 'export') {
+        const type = flagStr(args, 'type') ?? 'list';
+        if (type !== 'list' && type !== 'html') {
+            console.error('workplan export 的 --type 只支持 list（日程清单）或 html（日程一览表）');
+            process.exit(1);
+        }
+        const group = flagStr(args, 'group') ?? '部门';
+        const date = flagStr(args, 'date');
+        const bd = await getBaseData(cfg);
+        let objType = '1', objIds = bd.dept[0]?.id ?? '';
+        const groupMap = { '部门': '1', '分部': '2', '人力资源': '3', '人力': '3', '所有上级': '4', '上级': '4', '直接下级': '5', '下级': '5', '常用组': '6', '我的关注': '7', '关注': '7' };
+        const gkey = groupMap[group] || group;
+        const sg = bd.selectGroup.find((g) => g.key === gkey);
+        if (sg) {
+            if (gkey === '1') {
+                objType = '1';
+                objIds = bd.dept[0]?.id ?? '';
+            }
+            else if (gkey === '2') {
+                objType = '2';
+                objIds = bd.subComp[0]?.id ?? '';
+            }
+            else if (gkey === '3') {
+                // 人力资源：按人员查询，默认当前登录人（即「我的日程」）。当前用户 id 从 cookie 的 loginuuids 取（导出/日历走 cookie，token 可能过期）。
+                objType = '3';
+                const _uid = String(cfg.cookie || '').match(/loginuuids=([^;]*)/i);
+                objIds = _uid ? decodeURIComponent(_uid[1].trim()) : '';
+            }
+            else if (gkey === '5') {
+                objType = '1';
+                objIds = bd.dept[0]?.id ?? '';
+            }
+        }
+        const label = type === 'html' ? '日程一览表' : '日程清单';
+        if (!args.flags.yes) {
+            console.log(`[dry-run] 将导出${label}：${date ?? '今天'} · ${group}（objType=${objType} objIds=${objIds}）`);
+            console.log('确认无误后加 --yes 真正导出并下载。');
+            return;
+        }
+        const r = await exportWorkplanExcel(cfg, {
+            type, selectDate: date, objType, objIds,
+            workPlanType: flagStr(args, 'workplan-type'),
+            outDir: flagStr(args, 'out-dir'),
+        });
+        console.log(`✅ 已导出${label}：${r.outPath}`);
+        return;
+    }
+    console.error(`workplan 暂只支持 list / view / finish / delete / types / search-conditions / search / create / my-calendar / attention / base-data / export / import-template / import，收到: ${sub}`);
     process.exit(1);
 }
 async function runOdoc(args) {
@@ -2139,6 +2356,10 @@ async function runOdoc(args) {
         console.error(`odoc 暂只支持 todo / count / create-list，收到: ${sub}`);
         process.exit(1);
     }
+    // ★越权防护：公文列表按人过滤（签发人/拟稿操作人/在办人/未办人）目标必须 ∈ {本人 + 全部层级下属}
+    const odocPersonIds = [flagStr(args, 'issued-userid'), flagStr(args, 'owner-id'), flagStr(args, 'dealing-userid'), flagStr(args, 'undealed-userid')].filter(Boolean);
+    if (odocPersonIds.length)
+        await assertUserIdsInScope(cfg, odocPersonIds, { domain: 'odoc' });
     const r = await listOdocTodo(cfg, {
         requestName: flagStr(args, 'subject'),
         dispatchNum: flagStr(args, 'dispatch-num'),
@@ -3456,6 +3677,13 @@ async function runCube(args) {
         const condRes = await resolveCubeCondition(cfg, { customid, condition: flagStr(args, 'condition') ?? '' });
         if (condRes.unresolved.length)
             printConditionUnresolved(condRes.unresolved);
+        // ★越权防护（fail-closed）：条件中存在无法确认是否按人过滤的条件（定义读取失败/未知 domkey）→ 硬拒绝
+        // 策略未启用（默认）时不拦，仅保留代码路径。
+        if (isScopeEnforced() && condRes.unverifiablePerson)
+            throw new Error('拒绝越权查询：台账查询条件无法确认是否按人过滤（条件定义读取失败或含未识别字段）。为防越权，本次查询已拒绝，请稍后重试或改用中文字段名。');
+        // ★越权防护：人员条件（填报人/审批人/报销人/经手人等）目标必须 ∈ {本人 + 全部层级下属}
+        if (condRes.personConditions?.length)
+            await assertNamesInScope(cfg, condRes.personConditions.map((p) => p.value), { domain: 'cube', customid });
         const r = await exportCubeExcel(cfg, { customid, filename, yes: !!args.flags.yes, outDir: flagStr(args, 'out-dir'), modeCustomidPlain: !!args.flags.plain, conditionValues: condRes.conditionValues, keyword: flagStr(args, 'keyword') ?? '' });
         if (args.flags.json) {
             console.log(JSON.stringify({ customid, dataKey: r.dataKey, filename: r.filename, downloaded: r.downloaded, outPath: r.outPath, size: r.size, sourceTotal: r.sourceTotal, validation: r.validation, expBody: r.expBody }, null, 2));
@@ -3478,6 +3706,13 @@ async function runCube(args) {
     const condRes = await resolveCubeCondition(cfg, { customid, condition: flagStr(args, 'condition') ?? '' });
     if (condRes.unresolved.length)
         printConditionUnresolved(condRes.unresolved);
+    // ★越权防护（fail-closed）：条件中存在无法确认是否按人过滤的条件（定义读取失败/未知 domkey）→ 硬拒绝
+    // 策略未启用（默认）时不拦，仅保留代码路径。
+    if (isScopeEnforced() && condRes.unverifiablePerson)
+        throw new Error('拒绝越权查询：台账查询条件无法确认是否按人过滤（条件定义读取失败或含未识别字段）。为防越权，本次查询已拒绝，请稍后重试或改用中文字段名。');
+    // ★越权防护：人员条件（填报人/审批人/报销人/经手人等）目标必须 ∈ {本人 + 全部层级下属}
+    if (condRes.personConditions?.length)
+        await assertNamesInScope(cfg, condRes.personConditions.map((p) => p.value), { domain: 'cube', customid });
     const conditionValues = condRes.conditionValues;
     const r = await listCube(cfg, { customid, page: Number(flagStr(args, 'page') ?? '1') || 1, keyword: flagStr(args, 'keyword') ?? '', conditionValues });
     if (args.flags.json) {
@@ -3507,6 +3742,48 @@ async function runCube(args) {
             console.log(`   ${meta}`);
     }
 }
+async function runSubordinate(args) {
+    const sub = args._[1] ?? 'list';
+    const cfg = loadConfig(flagStr(args, 'config'));
+    if (sub !== 'list') {
+        console.error('subordinate 只支持 list。');
+        process.exit(1);
+    }
+    const name = flagStr(args, 'name');
+    const allLevel = flagBool(args, 'all-level');
+    const page = Number(flagStr(args, 'page') ?? '1') || 1;
+    // 姓名目标 → 越权校验（恰 1 个在授权范围内才放行，否则拒绝）；无 --name = 全部直属下属（本人天然在范围）
+    const lastname = name ? await assertNamesInScope(cfg, [name], { domain: 'subordinate' }) : '';
+    const r = await getSubordinates(cfg, { lastname, allLevel, page });
+    if (args.flags.raw) {
+        console.error('===== RAW getSearchResult =====');
+        console.error(JSON.stringify(r.raw.getSearchResult, null, 2));
+        console.error('===== RAW datas =====');
+        console.error(JSON.stringify(r.raw.datas, null, 2));
+        console.error('===== RAW counts =====');
+        console.error(JSON.stringify(r.raw.counts, null, 2));
+        console.error('===== 解析结果 =====');
+    }
+    if (args.flags.json) {
+        console.log(JSON.stringify({ lastname, allLevel, page, pageSize: r.pageSize, total: r.total, count: r.count, items: r.items.map((it) => ({ id: it.id, name: it.name, fields: it.fields })) }, null, 2));
+        return;
+    }
+    console.log(`我的下属${allLevel ? '（全部层级）' : '（直接下属）'}${name ? ` · 姓名过滤「${name}」` : ''} [第 ${page} 页${r.pageSize != null ? ` · 每页 ${r.pageSize} 条` : ''}${r.total != null ? ` / 共 ${r.total} 人` : ''}]  当前 ${r.count} 人`);
+    if (r.count === 0) {
+        console.log('（无下属）');
+        return;
+    }
+    const cols = (r.columns || []).filter((c) => c.dataIndex && c.dataIndex !== 'randomFieldId');
+    if (cols.length)
+        console.log(`字段(${cols.length}): ${cols.map((c) => c.title ?? c.dataIndex).join(' | ')}`);
+    for (let i = 0; i < r.items.length; i++) {
+        const it = r.items[i];
+        console.log(`${i + 1}. ${it.name || '(无姓名)'}  [id=${it.id || ''}]`);
+        const meta = it.fields.filter((f) => f.value && f.title && f.dataIndex !== it.idCol).slice(0, 6).map((f) => `${f.title}=${f.value}`).join(' | ');
+        if (meta)
+            console.log(`   ${meta}`);
+    }
+}
 function printTodoItems(items, base, { indent = '', max = 10 } = {}) {
     const visible = items.slice(0, max);
     for (let i = 0; i < visible.length; i++) {
@@ -3605,7 +3882,11 @@ async function main() {
     const cmd = args._[0] ?? 'todo';
     if (cmd === 'version') {
         const buildHash = createHash('sha256').update(fs.readFileSync(new URL(import.meta.url))).digest('hex').slice(0, 12);
-        console.log(JSON.stringify({ name: 'weaver-e9-assistant-cli', version: '1.0.0', buildHash }, null, 2));
+        console.log(JSON.stringify({ name: 'weaver-e9-assistant-cli', version: '1.1.2', buildHash }, null, 2));
+        return;
+    }
+    if (cmd === 'whoami') {
+        await runWhoami(args);
         return;
     }
     if (cmd === 'config') {
@@ -3656,6 +3937,10 @@ async function main() {
         await runCube(args);
         return;
     }
+    if (cmd === 'subordinate') {
+        await runSubordinate(args);
+        return;
+    }
     if (cmd !== 'todo') {
         console.error(`未知命令: ${cmd}\n\n${usage()}`);
         process.exit(1);
@@ -3752,15 +4037,12 @@ async function main() {
     }
     const effectiveCreatorName = flagStr(args, 'creator-name') ?? (typeof savedQueryFlags['creator-name'] === 'string' ? savedQueryFlags['creator-name'] : undefined);
     if (!creatorFilter && effectiveCreatorName) {
-        const people = await getAtAllList(cfg, { name: effectiveCreatorName });
-        const exact = people.items.filter((person) => String(person.name) === effectiveCreatorName);
-        if (exact.length !== 1) {
-            console.log(`“${effectiveCreatorName}”匹配到 ${people.items.length} 位人员，请改用 --creator <人员 ID>：`);
-            people.items.forEach((person, index) => console.log(`${index + 1}. ${person.name}  [${person.uid}]${person.name === effectiveCreatorName ? ' ★精确匹配' : ''}`));
-            return;
-        }
-        creatorFilter = String(exact[0].uid);
+        // ★越权防护：姓名目标先经 blog at-list 解析（SKILL.md 硬规则唯一入口），恰 1 个在授权范围内才放行
+        creatorFilter = await assertNamesInScope(cfg, [effectiveCreatorName], { domain: 'todo' });
     }
+    // ★越权防护：按人筛选（--creator / resume 路径）目标必须 ∈ {本人 + 全部层级下属}
+    if (creatorFilter)
+        await assertUserIdsInScope(cfg, [creatorFilter], { domain: 'todo' });
     const queryFlag = (key) => {
         const current = flagStr(args, key);
         if (current !== undefined)
@@ -3994,6 +4276,25 @@ async function runTodoRetract(args) {
         console.log(`  请在 OA 中核对流程状态：${buildRequestFormUrl(endpointFor(cfg).baseUrl, requestId)}`);
     console.log(BOX_TOP);
 }
+async function runWhoami(args) {
+    const cfg = loadConfig(flagStr(args, 'config'));
+    const u = await getCurrentUser(cfg);
+    const admin = await getCurrentUserIsAdmin(cfg);
+    if (args.flags.json) {
+        console.log(JSON.stringify({ userid: u.userid, username: u.username, deptid: u.deptid, deptname: u.deptname, subcompanyname: u.subcompanyname, jobs: u.jobs, isAdmin: admin.isAdmin }, null, 2));
+        return;
+    }
+    console.log(`${BOX_TOP}`);
+    console.log(`当前登录人  ${u.username || '?'}(${u.userid || '?'})`);
+    console.log(DIVIDER);
+    console.log(`  部门: ${u.deptname || '?'}(${u.deptid || '?'})`);
+    if (u.subcompanyname)
+        console.log(`  分部: ${u.subcompanyname}`);
+    if (u.jobs)
+        console.log(`  岗位: ${u.jobs}`);
+    console.log(`  系统管理员: ${admin.isAdmin === true ? '✅ 是' : admin.isAdmin === false ? '否' : '⚠ 无法确认（未取到 isAdmin 字段）'}`);
+    console.log(`${BOX_TOP}`);
+}
 function runConfig(args) {
     const sub = args._[1];
     if (sub === 'set') {