weaver-e9-assistant-cli 1.0.0

package/dist/querystate.js

@@ -0,0 +1,38 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const stateDir = () => path.resolve(process.cwd(), 'state');
+const queryDir = () => path.join(stateDir(), 'query_contexts');
+
+export function saveCandidateQuery({ workflow, candidates, options }) {
+    fs.mkdirSync(queryDir(), { recursive: true });
+    const id = randomUUID();
+    fs.writeFileSync(path.join(queryDir(), `${id}.json`), JSON.stringify({ id, workflow, candidates, options, createdAt: new Date().toISOString() }, null, 2), 'utf8');
+    return id;
+}
+export function loadCandidateQuery(id) {
+    if (!/^[a-zA-Z0-9-]+$/.test(String(id)))
+        throw new Error('resume-query 格式无效。');
+    const file = path.join(queryDir(), `${id}.json`);
+    if (!fs.existsSync(file))
+        throw new Error('查询上下文不存在或已被清理，请重新搜索流程名称。');
+    return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+export function persistSearchResult(result, title = '待办查询') {
+    const json = JSON.stringify(result, null, 2);
+    if (Buffer.byteLength(json, 'utf8') <= 8192)
+        return null;
+    fs.mkdirSync(stateDir(), { recursive: true });
+    const jsonPath = path.join(stateDir(), 'last_search.json');
+    const mdPath = path.join(stateDir(), 'last_search.md');
+    fs.writeFileSync(jsonPath, json, 'utf8');
+    const items = Array.isArray(result.items)
+        ? result.items
+        : (Array.isArray(result.groups) ? result.groups.flatMap((group) => group.items ?? []) : []);
+    const lines = [`# ${title}`, '', `共 ${result.total ?? items.length} 条，以下为前 10 条：`, ''];
+    for (const item of items.slice(0, 10))
+        lines.push(`- ${item.title ?? '(无标题)'}（${item.requestId ?? ''}）`);
+    fs.writeFileSync(mdPath, lines.join('\n'), 'utf8');
+    return { jsonPath, mdPath };
+}

package/dist/render.js

@@ -0,0 +1,21 @@
+/**
+ * 人类可读输出渲染：框线表格、分隔线。
+ * 集中框线宽度，避免散落的字面量重复。
+ */
+export const BOX_TOP = '═'.repeat(50); // 上下封口
+export const DIVIDER = '─'.repeat(53); // 区内分隔
+/**
+ * 打印一个标题框：顶线 + title + 可选正文行 + 底线。
+ * title/lines 已含前导空格等格式，由调用方决定对齐。
+ */
+export function box(title, lines = []) {
+    console.log(BOX_TOP);
+    if (title)
+        console.log(title);
+    for (const l of lines)
+        console.log(l);
+    console.log(BOX_TOP);
+}
+export function divider() {
+    console.log(DIVIDER);
+}

package/dist/report.js

@@ -0,0 +1,50 @@
+import { endpointFor } from './config.js';
+import { getWfList } from './workflow.js';
+import { getMyCalendar } from './workplan.js';
+import { getEmailList } from './email.js';
+import { getButtons } from './kq.js';
+import { getMyBlogList, isBlogRecalled } from './blog.js';
+
+function source(module, id, time, data) {
+    return { module, id: String(id ?? ''), time: String(time ?? ''), data };
+}
+function onDate(value, date) {
+    return String(value ?? '').slice(0, 10) === date;
+}
+
+/** 只汇总当前 E9 环境可回溯且状态可确认的数据；不把聊天内容、浏览行为或撤回微博当作事实。 */
+export async function collectQueryableBusiness(cfg, date) {
+    const results = await Promise.allSettled([
+        getWfList(cfg, { category: 'done', page: 1, operateTime: date }),
+        getWfList(cfg, { category: 'mine', page: 1, createTime: date }),
+        getMyCalendar(cfg, { selectDate: date }),
+        getEmailList(cfg, { folder: 'inbox', current: 1, startdate: date, enddate: date }),
+        getEmailList(cfg, { folder: 'sent', current: 1, startdate: date, enddate: date }),
+        getButtons(cfg),
+        getMyBlogList(cfg, date, 1),
+    ]);
+    const value = (index, fallback) => results[index].status === 'fulfilled' ? results[index].value : fallback;
+    const failed = results.map((result, index) => result.status === 'rejected' ? ({ index, message: String(result.reason?.message ?? result.reason) }) : null).filter(Boolean);
+    const done = value(0, { items: [] }).items.filter((item) => onDate(item.operatedate ?? item.operateTime, date)).map((item) => source('已办流程', item.requestId, item.operatedate ?? item.operateTime, { title: item.title }));
+    const mine = value(1, { items: [] }).items.filter((item) => onDate(item.createdate ?? item.createTime, date)).map((item) => source('我发起的流程', item.requestId, item.createdate ?? item.createTime, { title: item.title }));
+    const calendar = value(2, { items: [] }).items.filter((item) => onDate(item.beginDateTime, date)).map((item) => source('日程', item.id, item.beginDateTime, { name: item.name, status: item.status }));
+    const inbox = value(3, { items: [] }).items.filter((item) => onDate(item.date, date)).map((item) => source('收件箱', item.id, item.date, { subject: item.subject, from: item.from }));
+    const sent = value(4, { items: [] }).items.filter((item) => onDate(item.date, date)).map((item) => source('已发送邮件', item.id, item.date, { subject: item.subject, to: item.to }));
+    const attendance = value(5, { timeline: [] }).timeline.map((item) => source('考勤', `${item.date}:${item.type}`, item.signTime, { type: item.type, signTime: item.signTime, status: item.kqstatus }));
+    // 微博：列表接口返回 isReCalled（已抓包验证，0=正常发布，1/2=已撤回）。
+    // 仅纳入正常发布（isReCalled=0）的微博，已撤回微博剔除并记入 notes。
+    const blogToday = value(6, { items: [] }).items.filter((it) => onDate(it.workdate, date) || onDate(it.createdate, date));
+    const recalledBlogs = blogToday.filter((it) => isBlogRecalled(it));
+    const blogs = blogToday.filter((it) => !isBlogRecalled(it)).map((item) => source('微博', item.id, item.workdate, { content: item.content?.slice(0, 60) }));
+    const notes = [];
+    if (recalledBlogs.length > 0)
+        notes.push(`微博：${recalledBlogs.length} 条已撤回（isReCalled≠0）未纳入汇总`);
+    return {
+        scope: '当前 E9 环境可查询业务数据汇总（不含操作审计、页面浏览及其他不可查询行为）',
+        baseUrl: endpointFor(cfg).baseUrl,
+        date,
+        sources: { done, mine, calendar, inbox, sent, attendance, blogs },
+        notes,
+        failures: failed,
+    };
+}

package/dist/submissionplan.js

@@ -0,0 +1,43 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+function planDir() {
+    return path.resolve(process.cwd(), 'state', 'create_plans');
+}
+function planPath(id) {
+    if (!/^[a-zA-Z0-9-]+$/.test(String(id)))
+        throw new Error('plan_id 格式无效。');
+    return path.join(planDir(), `${id}.json`);
+}
+
+/** 保存用户已确认的业务字段；短期 token 和签名绝不落盘。 */
+export function saveSubmissionPlan(prepared) {
+    const plan = {
+        id: randomUUID(),
+        workflowId: String(prepared.workflowId),
+        workflowName: String(prepared.workflowName ?? ''),
+        requestName: String(prepared.requestName),
+        values: prepared.values,
+        details: prepared.details,
+        browserNames: prepared.browserNames,
+        files: prepared.files ?? [],
+        createdAt: new Date().toISOString(),
+    };
+    fs.mkdirSync(planDir(), { recursive: true });
+    fs.writeFileSync(planPath(plan.id), JSON.stringify(plan, null, 2), 'utf8');
+    return plan;
+}
+export function loadSubmissionPlan(id, workflowId) {
+    const file = planPath(id);
+    if (!fs.existsSync(file))
+        throw new Error('未找到确认计划。请先重新预览，确认后再提交。');
+    const plan = JSON.parse(fs.readFileSync(file, 'utf8'));
+    if (String(plan.workflowId) !== String(workflowId))
+        throw new Error('确认计划与当前流程不一致。请重新预览。');
+    if (Date.now() - Date.parse(plan.createdAt) > MAX_AGE_MS)
+        throw new Error('确认计划已超过 24 小时。请重新预览，避免提交过期内容。');
+    return plan;
+}

package/dist/submissionstate.js

@@ -0,0 +1,81 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+
+const ACTIVE_STATUSES = new Set(['submitting', 'uncertain', 'created']);
+const DUPLICATE_WINDOW_MS = 10 * 60 * 1000;
+
+function stateDir() {
+    return path.resolve(process.cwd(), 'state', 'create_submissions');
+}
+function statePath(id) {
+    if (!/^[a-zA-Z0-9-]+$/.test(String(id)))
+        throw new Error('submission_id 格式无效。');
+    return path.join(stateDir(), `${id}.json`);
+}
+function write(record) {
+    fs.mkdirSync(stateDir(), { recursive: true });
+    fs.writeFileSync(statePath(record.id), JSON.stringify(record, null, 2), 'utf8');
+    return record;
+}
+function fingerprint(workflowId, requestName, values) {
+    return crypto.createHash('sha256')
+        .update(JSON.stringify({ workflowId: String(workflowId), requestName: String(requestName ?? ''), values: values ?? {} }))
+        .digest('hex');
+}
+function readRecent() {
+    try {
+        return fs.readdirSync(stateDir())
+            .filter((name) => name.endsWith('.json'))
+            .map((name) => JSON.parse(fs.readFileSync(path.join(stateDir(), name), 'utf8')))
+            .filter((record) => record && record.id);
+    }
+    catch {
+        return [];
+    }
+}
+
+/**
+ * 为一次真实发起建立本地操作记录。相同内容在十分钟内处于进行/不确定/成功状态时不再次提交。
+ * 只存指纹而不存字段原文，避免把敏感表单值重复落盘。
+ */
+export function beginSubmission({ workflowId, workflowName = '', requestName = '', values = {} }) {
+    const now = Date.now();
+    const key = fingerprint(workflowId, requestName, values);
+    const duplicate = readRecent().find((record) => record.fingerprint === key
+        && ACTIVE_STATUSES.has(record.status)
+        && now - Date.parse(record.updatedAt ?? record.createdAt ?? 0) < DUPLICATE_WINDOW_MS);
+    if (duplicate)
+        return { record: duplicate, duplicate: true };
+    const record = {
+        id: crypto.randomUUID(),
+        workflowId: String(workflowId),
+        workflowName: String(workflowName),
+        requestName: String(requestName),
+        fingerprint: key,
+        status: 'submitting',
+        requestId: '',
+        createdAt: new Date(now).toISOString(),
+        updatedAt: new Date(now).toISOString(),
+    };
+    return { record: write(record), duplicate: false };
+}
+export function loadSubmission(id) {
+    const p = statePath(id);
+    if (!fs.existsSync(p))
+        throw new Error(`未找到发起记录“${id}”。`);
+    return JSON.parse(fs.readFileSync(p, 'utf8'));
+}
+export function updateSubmission(id, patch) {
+    const old = loadSubmission(id);
+    return write({ ...old, ...patch, updatedAt: new Date().toISOString() });
+}
+export function extractCreatedRequestId(response) {
+    const body = response?.json ?? {};
+    const type = body?.data?.type ?? body?.type ?? '';
+    const requestId = body?.requestid ?? body?.data?.requestid ?? body?.data?.resultInfo?.requestid ?? body?.data?.requestId;
+    // A success type without an addressable request id cannot be presented as a
+    // completed creation: the caller must verify it instead of retrying.
+    const accepted = !!requestId && (type === 'SUCCESS' || type === 'ASYNC_SUBMIT');
+    return { accepted, requestId: requestId ? String(requestId) : '', type: String(type) };
+}

package/dist/todoaskidea.js

@@ -0,0 +1,54 @@
+import { createApiFromProfile } from './client.js';
+import { resolveReceivers } from './wfreceiver.js';
+/**
+ * 意见征询（向某人征询意见，不改审批人）。实跑确认链路（2026-09-02 真机 .27）：
+ *   loadForm(取 workflowid/nodeid/操作人 userid) → signInput(forwardflag=2 预载) →
+ *   remarkOperate(operate=save, forwardflag=2, field5=征询对象 userId) → {"success":true,"message":"流程意见征询成功"}。
+ *
+ * 与转发(forwardflag=1)/传阅(forwardflag=4)/转办(forwardflag=3)同款链路：均走 signInput → remarkOperate
+ * （0.5.1 起转发/传阅/转办不再走 requestOperation——会被服务端当"批准"）。
+ * forward_token_<requestid>_<操作人userid> 由客户端生成(Date.now())，signInput 与 remarkOperate 须用同一值。
+ */
+async function buildCommon(cfg, opts) {
+    const { requestId } = opts;
+    const api = await createApiFromProfile(cfg);
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: String(requestId) });
+    const p = (r0.json ?? {}).params ?? {};
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    const userType = String(p.f_weaver_belongto_usertype ?? '0');
+    const workflowid = String(p.workflowid ?? '');
+    const nodeid = String(p.nodeid ?? '');
+    const field5 = await resolveReceivers(cfg, opts);
+    if (!field5)
+        throw new Error('意见征询需要征询对象：传 --receiver <userId> 或 --receiver-name <姓名>');
+    const remarkText = opts.remark ?? '';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const tokenKey = `forward_token_${requestId}_${userId}`;
+    const token = String(Date.now());
+    const common = {
+        isShowReplyNotice: '0', takOverMins: '30', remark: remarkHtml,
+        workflowRequestLogId: '', forwardflag: '2', requestid: String(requestId),
+        nodeid, workflowid, 'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': userType,
+        agentType: '0', agentorByAgentId: '-1', secLevelInfo: '[object Object]',
+        [tokenKey]: token,
+    };
+    return { api, common, field5 };
+}
+export async function askIdeaTodo(cfg, opts) {
+    const { api, common, field5 } = await buildCommon(cfg, opts);
+    // ① signInput 预载（forwardflag=2，field5 空）
+    await api.post('/api/workflow/reqform/signInput', {
+        ...common, field5: '', IsSubmitedOpinion: '1', IsBeForwardTodo: '1',
+    });
+    // ② remarkOperate 提交（operate=save，field5=征询对象）
+    return api.post('/api/workflow/reqform/remarkOperate', {
+        ...common, field5,
+        operate: 'save',
+        openByDefaultBrowser: '', IsBeForwardSubmitAlready: '', IsBeForwardAlready: '',
+        IsSubmitedOpinion: '', IsBeForwardTodo: '',
+        isSubmitSign: '0', isChuanyue: '0', isRemind: '0',
+        signworkflowids: '', signdocids: '', remarkLocation: '',
+        'field-annexupload': '', 'field-annexupload-request': String(opts.requestId),
+        handWrittenSign: '0', remindTypes: '',
+    });
+}

package/dist/todobatch.js

@@ -0,0 +1,154 @@
+import { createApiFromProfile } from './client.js';
+import { getWfList } from './workflow.js';
+import { extractRows } from './parse.js';
+
+/**
+ * 流程批量操作（待办域）。
+ *
+ * 接口契约以 2026-09-09 抓包实证为准：
+ *   - 批量提交   POST /api/workflow/reqform/requestBatchSubmit
+ *                multiSubIds=<rid,rid,>&belongtoUserids=<uid,uid,>&pagefromtype=1&needBatchSubmit=1
+ *   - 批量转发   GET  /api/workflow/forward/getBatchForwardInfo（预检）
+ *                POST /api/workflow/reqform/batchForward
+ *                forwardflag=1&field5=<接收人>&multiSubIds=<rid_uid,rid_uid>&operate=save
+ *   - 批量关注   POST /api/workflow/requestAttention/getAttentionTypeSet（查类型）
+ *                POST /api/workflow/requestAttention/saveAttention
+ *                src=batchadd&requestids=<rid,rid>&ids=<类型id,>
+ *   - 门禁       POST /api/ec/dev/table/checks（dataKey + checkId + randomDatas=每行 randomField0~14+randomFieldId）
+ *   - 二次验证   POST /api/workflow/secondauth/getSecondAuthConfig4List（requestIds=rid_uid + __weaver_request_url__=base64(baseUrl)）
+ *
+ * multiSubIds 尾逗号、ids 尾逗号、belongtoUserids 尾逗号均为抓包原样，不能去掉。
+ */
+
+/** 将用户输入的逗号列表规范化，并在真正调用前阻止常见的错配。 */
+export function parseIdList(value, label) {
+    const ids = String(value ?? '').split(',').map((item) => item.trim()).filter(Boolean);
+    if (!ids.length)
+        throw new Error(`${label}不能为空，请用英文逗号分隔多个 ID。`);
+    if (ids.some((id) => !/^\d+$/.test(id)))
+        throw new Error(`${label}只能包含数字 ID。`);
+    return ids;
+}
+
+/** 从待办列表原始行提取门禁所需的随机字段（与抓包 checks 的 randomDatas 结构一致）。 */
+function pickRandomFields(row) {
+    const out = {};
+    for (let i = 0; i <= 14; i++)
+        out[`randomField${i}`] = String(row?.[`randomField${i}`] ?? '');
+    out.randomFieldId = String(row?.randomFieldId ?? row?.requestid ?? row?.randomField2 ?? '');
+    return out;
+}
+
+/** 拉待办列表并取出与 requestIds 匹配的原始行（含 randomField）+ dataKey。跨页匹配直到全部命中或到末尾。 */
+async function loadRowsFor(cfg, requestIds) {
+    const wanted = new Set(requestIds.map(String));
+    const found = new Map();
+    let dataKey = '';
+    for (let current = 1; current <= 10; current++) {
+        const list = await getWfList(cfg, { category: 'todo', page: current, pageSize: '100' });
+        dataKey = list.dataKey || dataKey;
+        const rows = extractRows(list.raw?.datas);
+        for (const row of rows) {
+            const rid = String(row?.requestid ?? row?.randomField2 ?? row?.randomFieldId ?? '');
+            if (wanted.has(rid) && !found.has(rid))
+                found.set(rid, row);
+        }
+        if (rows.length < 100 || found.size === wanted.size)
+            break;
+        if (!rows.length)
+            break;
+    }
+    const missing = requestIds.map(String).filter((id) => !found.has(id));
+    if (missing.length)
+        throw new Error(`批量操作需要在待办列表中定位这 ${missing.length} 条，未找到：${missing.join(', ')}。请确认 request-id 属于当前待办（待处理），或该待办已不在列表中。`);
+    // 保持调用方传入顺序，便于回执与 multiSubIds 对应
+    const rows = requestIds.map((id) => found.get(String(id)));
+    return { dataKey, rows };
+}
+
+/** 批量门禁（抓包实证）：checks(dataKey+randomDatas) + getSecondAuthConfig4List(requestIds=rid_uid+__weaver_request_url__=base64)。 */
+async function runGate(api, checkId, rows, dataKey) {
+    const check = await api.post('/api/ec/dev/table/checks', {
+        dataKey,
+        checkId,
+        randomDatas: JSON.stringify(rows.map(pickRandomFields)),
+    });
+    const ridUids = rows
+        .map((r) => `${r?.randomField2 ?? r?.requestid}_${r?.randomField4 ?? r?.userid ?? ''}`)
+        .join(',');
+    const secondAuth = await api.post('/api/workflow/secondauth/getSecondAuthConfig4List', {
+        requestIds: ridUids,
+        __weaver_request_url__: Buffer.from(api.baseUrl).toString('base64'),
+    });
+    return { check, secondAuth };
+}
+
+/** 批量提交。调用方必须先展示预览，且只有 --yes 才会调用本函数。 */
+export async function batchSubmit(cfg, opts) {
+    const requestIds = parseIdList(opts.requestIds, 'requestIds');
+    const userIds = parseIdList(opts.userIds, 'userIds');
+    if (requestIds.length !== userIds.length)
+        throw new Error('requestIds 与 userIds 数量必须一致，确保每条待办对应正确处理人。');
+    const api = await createApiFromProfile(cfg);
+    const { dataKey, rows } = await loadRowsFor(cfg, requestIds);
+    const gate = await runGate(api, 'batchSubmit', rows, dataKey);
+    const result = await api.post('/api/workflow/reqform/requestBatchSubmit', {
+        multiSubIds: requestIds.join(',') + ',',
+        remark: String(opts.remark ?? 'OK'),
+        pagefromtype: '1',
+        belongtoUserids: userIds.join(',') + ',',
+        needBatchSubmit: '1',
+    });
+    return { requestIds, userIds, gate, result };
+}
+
+/** 批量转发（抓包实证：batchForward，multiSubIds=requestId_userId）。 */
+export async function batchForward(cfg, opts) {
+    const requestIds = parseIdList(opts.requestIds, 'requestIds');
+    const receiver = parseIdList(opts.receiver, 'receiver');
+    const api = await createApiFromProfile(cfg);
+    // 前置预检（抓包：getBatchForwardInfo → {"allowAllPersonGroup":true}）
+    const info = await api.get('/api/workflow/forward/getBatchForwardInfo');
+    const { dataKey, rows } = await loadRowsFor(cfg, requestIds);
+    const gate = await runGate(api, 'batchForward', rows, dataKey);
+    // multiSubIds = requestId_userId（userId 为待办当前处理人，来自列表行 randomField4）
+    const multiSubIds = rows
+        .map((r) => `${r?.randomField2 ?? r?.requestid}_${r?.randomField4 ?? r?.userid ?? ''}`)
+        .join(',');
+    const result = await api.post('/api/workflow/reqform/batchForward', {
+        forwardflag: '1',
+        field5: receiver.join(','),
+        remark: String(opts.remark ?? ''),
+        multiSubIds,
+        operate: 'save',
+    });
+    return { requestIds, receiver, info, gate, result };
+}
+
+/** 查询关注类型（只读，供 dry-run 预览展示与 batchAttention 选择类型）。 */
+export async function getAttentionTypes(cfg, requestIds) {
+    const api = await createApiFromProfile(cfg);
+    const resp = await api.post('/api/workflow/requestAttention/getAttentionTypeSet', {
+        src: 'getData2',
+        requestid: requestIds.join(','),
+    });
+    return resp?.json?.datas ?? [];
+}
+
+/** 批量关注（抓包实证：getAttentionTypeSet → saveAttention(src=batchadd, ids=类型id,)）。 */
+export async function batchAttention(cfg, opts) {
+    const requestIds = parseIdList(opts.requestIds, 'requestIds');
+    const api = await createApiFromProfile(cfg);
+    const types = await getAttentionTypes(cfg, requestIds);
+    const attentionId = String(opts.attentionId ?? types[0]?.id ?? '');
+    if (!attentionId)
+        throw new Error('未能获取关注类型（getAttentionTypeSet 返回空），请确认该环境的“关注类型”已配置，或手动传 --attention-id。');
+    const { dataKey, rows } = await loadRowsFor(cfg, requestIds);
+    const gate = await runGate(api, 'batchAttention', rows, dataKey);
+    const result = await api.post('/api/workflow/requestAttention/saveAttention', {
+        src: 'batchadd',
+        requestids: requestIds.join(','),
+        ids: attentionId + ',',
+    });
+    return { requestIds, attentionTypes: types, attentionId, gate, result };
+}

package/dist/todocc.js

@@ -0,0 +1,128 @@
+import { createApiFromProfile } from './client.js';
+import { todayStr, nowTimeStr } from './util.js';
+/**
+ * 抄送/批注操作。POST remarkOperation（isremark=9, actiontype=remarkOperation）。
+ * 先 loadForm 拿签名，再 remarkOperation 抄送。
+ *
+ * 修复（P0-4）：submit_token key 旧硬编码 `1_<rid>_...`（前缀=1=sysadmin），非 sysadmin 取不到 token；
+ *   改用 `p.f_weaver_belongto_userid` 动态拼 key，兜底旧 `1_` 前缀。
+ */
+export async function ccTodo(cfg, opts) {
+    const { requestId } = opts;
+    const remarkText = opts.remark ?? '抄送';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const api = await createApiFromProfile(cfg);
+    // 第一步 loadForm → 拿签名
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId });
+    const j0 = r0.json ?? {};
+    const p0 = j0.params ?? {};
+    const sp0 = j0.submitParams ?? {};
+    const wfId = String(p0.workflowid ?? '');
+    const nodeId = String(p0.nodeid ?? '');
+    let p = p0;
+    let sp = sp0;
+    if (wfId && nodeId) {
+        const r1 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: requestId, workflowid: wfId, nodeid: nodeId });
+        const j1 = r1.json ?? {};
+        p = j1.params ?? p0;
+        sp = j1.submitParams ?? sp0;
+    }
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    const submitTokenKey = `${userId}_${requestId}_request_submit_token`;
+    const submitToken = String(sp[submitTokenKey] ?? sp[`1_${requestId}_request_submit_token`] ?? '');
+    const sigDecoded = Buffer.from(String(p.signatureAttributesStr ?? ''), 'base64').toString('utf8');
+    const lastOpDate = (sigDecoded.match(/lastOperateDate=([^|]*)/)?.[1] ?? '').trim();
+    const lastOpTime = (sigDecoded.match(/lastOperateTime=([^|]*)/)?.[1] ?? '').trim();
+    const todayStrVal = todayStr();
+    const timeStr = nowTimeStr();
+    const body = {
+        formid: String(sp.formid ?? p.formid ?? ''),
+        isSubmitDirectNode: '',
+        openByDefaultBrowser: '',
+        iscreate: '0',
+        creatertype: '0',
+        isdialog: '1',
+        lastOperateDate: lastOpDate,
+        createdoc: '',
+        [submitTokenKey]: submitToken,
+        nodeid: nodeId,
+        workflowid: wfId,
+        isbill: String(sp.isbill ?? p.isbill ?? '1'),
+        authStr: String(p.authStr ?? ''),
+        'f_weaver_belongto_userid': userId,
+        currenttime: timeStr,
+        'f_weaver_belongto_usertype': '0',
+        agentorByAgentId: '-1',
+        isMultiDoc: '',
+        inputcheck: '',
+        comemessage: '',
+        lastOperateTime: lastOpTime,
+        temphasUseTempletSucceed: '',
+        workflowRequestLogId: '',
+        edesign_layout: '',
+        requestid: requestId,
+        isremark: '9',
+        creater: String(p.creater ?? userId),
+        htmlfieldids: '',
+        SubmitToNodeid: '',
+        isCptwf: 'false',
+        isovertime: '',
+        agentType: '0',
+        authSignatureStr: String(p.authSignatureStr ?? ''),
+        nodetype: String(p.nodetype ?? sp.nodetype ?? '1'),
+        needoutprint: '',
+        lastOperator: '1',
+        topage: '',
+        isFormSignature: '0',
+        remindTypes: '',
+        fromFlowDoc: '',
+        RejectNodes: '',
+        linkageUUID: String(sp.linkageUUID ?? ''),
+        billid: String(sp.billid ?? ''),
+        lastnodeid: '',
+        uploadType: '',
+        isSignMustInput: '',
+        RejectToNodeid: '',
+        isWorkflowDoc: 'false',
+        src: 'save',
+        annexmaxUploadImageSize: '',
+        takisremark: '0',
+        workflowtype: String(sp.workflowtype ?? p.workflowtype ?? ''),
+        remarkLocation: '',
+        needcheck: '',
+        needcheckLock: 'false',
+        selectfieldvalue: '',
+        RejectToType: '',
+        currentdate: todayStrVal,
+        needwfback: '1',
+        remark: remarkHtml,
+        'field-annexupload': '',
+        signdocids: '',
+        signworkflowids: '',
+        annexdocids: '',
+        annexdocinfos: '',
+        handWrittenSign: '',
+        isOdocRequest: '0',
+        enableIntervenor: '',
+        verifyRequiredRange: 'field-9999,',
+        linkageUnFinishedKey: '',
+        remarkquote: remarkHtml,
+        actiontype: 'remarkOperation',
+        isFirstSubmit: '0',
+        existChangeRange: '',
+        requestname: String(p.requestname ?? ''),
+        requestlevel: '0',
+        chatsType: '-1',
+        messageType: '-1',
+        'field-9': '0',
+        'field-10': '4',
+        mainFieldUnEmptyCount: '0',
+        detailFieldUnEmptyCount: '0',
+        signatureAttributesStr: String(p.signatureAttributesStr ?? ''),
+        signatureSecretKey: String(p.signatureSecretKey ?? ''),
+        selectNextFlow: '0',
+        openDataVerify: '0',
+        wfTestStr: '',
+    };
+    return api.post('/api/workflow/reqform/remarkOperation', body);
+}

package/dist/todoforward.js

@@ -0,0 +1,66 @@
+import { createApiFromProfile } from './client.js';
+import { resolveReceivers } from './wfreceiver.js';
+/**
+ * 转发/传阅。链路（与意见征询同构，流程抓包8.har/7.har 实证 forwardflag=1/4 走同一 ForwardDialog）：
+ *   loadForm(取 workflowid/nodeid/操作人 userid) → signInput(forwardflag 预载) →
+ *   remarkOperate(operate=save, forwardflag, field5=接收人) → {"success":true,...}。
+ *
+ * 修复（0.5.1）：旧实现走 requestOperation(src=submit, forwardOperators=接收人) 且不带 forwardflag，
+ *   被服务端当成"批准"——用户实测转发被记录成"批准"（签字意见写"转发"然后点通过）。
+ *   前端 bundle 实证 doReviewE9(转发 forwardflag="1") / doChuanyue(传阅 forwardflag="4")
+ *   打开同一 ForwardDialog，提交统一走 signInput → remarkOperate：
+ *     · forward_token_<requestid>_<userid> 由客户端 Date.now() 生成，signInput 与 remarkOperate 须用同一值
+ *     · signInput：IsSubmitedOpinion=1 & IsBeForwardTodo=1 & field5= 空
+ *     · remarkOperate：operate=save & field5=接收人 & isSubmitSign/isChuanyue/isRemind
+ *     · 转发(flag=1) 的 signInput 带 forwardOperators= 空串；传阅(flag=4) 不带 —— 与抓包一致
+ *     · 传阅(flag=4) 的 isSubmitSign/isChuanyue/isRemind 为空串；转发(flag=1) 为 0 —— 与抓包一致
+ */
+async function forwardOrCirculate(cfg, opts, forwardflag) {
+    const { requestId } = opts;
+    const remarkText = opts.remark ?? '';
+    const remarkHtml = remarkText.split(/\r?\n/).map((l) => `<p>${l}</p>`).join('');
+    const api = await createApiFromProfile(cfg);
+    const r0 = await api.post('/api/workflow/reqform/loadForm', { iscreate: '0', requestid: String(requestId) });
+    const p = (r0.json ?? {}).params ?? {};
+    const userId = String(p.f_weaver_belongto_userid ?? '1');
+    const userType = String(p.f_weaver_belongto_usertype ?? '0');
+    const workflowid = String(p.workflowid ?? '');
+    const nodeid = String(p.nodeid ?? '');
+    const field5 = await resolveReceivers(cfg, opts);
+    if (!field5)
+        throw new Error(`${forwardflag === '1' ? '转发' : '传阅'}需要目标人：传 --receiver <userId> 或 --receiver-name <姓名>`);
+    const tokenKey = `forward_token_${requestId}_${userId}`;
+    const token = String(Date.now());
+    const common = {
+        isShowReplyNotice: '0', takOverMins: '30', remark: remarkHtml,
+        workflowRequestLogId: '', forwardflag, requestid: String(requestId),
+        nodeid, workflowid, 'f_weaver_belongto_userid': userId, 'f_weaver_belongto_usertype': userType,
+        agentType: '0', agentorByAgentId: '-1', secLevelInfo: '[object Object]',
+        [tokenKey]: token,
+    };
+    // ① signInput 预载（forwardflag，field5 空）
+    const signBody = forwardflag === '1'
+        ? { ...common, field5: '', IsSubmitedOpinion: '1', IsBeForwardTodo: '1', forwardOperators: '' }
+        : { ...common, field5: '', IsSubmitedOpinion: '1', IsBeForwardTodo: '1' };
+    await api.post('/api/workflow/reqform/signInput', signBody);
+    // ② remarkOperate 提交（operate=save，field5=接收人）
+    const remFlags = forwardflag === '4' ? '' : '0';
+    return api.post('/api/workflow/reqform/remarkOperate', {
+        ...common, field5,
+        operate: 'save',
+        openByDefaultBrowser: '', IsBeForwardSubmitAlready: '', IsBeForwardAlready: '',
+        IsSubmitedOpinion: '', IsBeForwardTodo: '',
+        isSubmitSign: remFlags, isChuanyue: remFlags, isRemind: remFlags,
+        signworkflowids: '', signdocids: '', remarkLocation: '',
+        'field-annexupload': '', 'field-annexupload-request': String(requestId),
+        handWrittenSign: '0', remindTypes: '',
+    });
+}
+/** 转发（分享给某人看，不改变审批人） */
+export async function forwardTodo(cfg, opts) {
+    return forwardOrCirculate(cfg, opts, '1');
+}
+/** 传阅 */
+export async function circulateTodo(cfg, opts) {
+    return forwardOrCirculate(cfg, opts, '4');
+}