weaver-e9-assistant-cli 1.1.12 → 1.1.13

package/dist/cli.js

@@ -12,7 +12,7 @@ import { parseIdList, batchSubmit, batchForward, batchAttention, getAttentionTyp
 import { pageUrl, availablePages } from './pageopen.js';
 import { buildBlogMyUrl, buildCubeCardUrl, buildCubeSearchUrl, normalizeE9Url } from './links.js';
 import { createContext, loadContext, updateContext } from './createcontext.js';
-import { loadSubmission, updateSubmission } from './submissionstate.js';
+import { loadSubmission, updateSubmission, pickVerifiedRequest } from './submissionstate.js';
 import { saveSubmissionPlan, loadSubmissionPlan } from './submissionplan.js';
 import { saveCandidateQuery, loadCandidateQuery, persistSearchResult } from './querystate.js';
 import { getFlowSummary } from './wfsummary.js';
@@ -272,6 +272,7 @@ function usage() {
         '              --values/--values-file 给值（key=字段id，值=文本/option id；中文用 --values-file）；',
         '              --detail-file 给明细表行数据（JSON 数组 [{index, rows:[{fieldId:value}]}]，index=明细表序号0起，每行多字段）；',
         '              --file <字段id>=<本地路径> 上传图片/附件；明细行用 <字段id>_<行号>=<路径>（逗号分隔多个）；默认 dry-run，--yes 真发',
+        '              --yes --plan <plan_id> [--verify] 复现确认计划并真发；--verify 提交后同进程核验 requestid/当前节点',
         '  email list 收件箱邮件列表（单步 GET /api/email/list/allList）',
         '    --page      页码，默认 1',
         '    --subject   主题关键字过滤',
@@ -571,7 +572,7 @@ async function runContextCreate(args) {
     const context = loadContext(id);
     if (!args.flags.confirm || !args.flags.submit) {
         const cfg = loadConfig(flagStr(args, 'config'));
-        const prepared = await prepareCreateSubmission(cfg, context.workflowId, context.values, context.requestName, context.details);
+        const prepared = await prepareCreateSubmission(cfg, context.workflowId, context.values, context.requestName, context.details, undefined, context.files ?? []);
         printFormulaResults(prepared);
         const plan = saveSubmissionPlan({ ...prepared, files: context.files });
         updateContext(id, { planId: plan.id });
@@ -722,6 +723,38 @@ async function runCreate(args) {
         }
     }
 }
+/**
+ * 真实发起后同进程核验：查「我的请求」确认 requestid 与当前节点。
+ * 用一次列表查询（~1s）替代额外的一次工具往返 + 3.5s 的 todo summary。
+ */
+async function verifyCreatedInline(cfg, { requestName, requestId, workflowId, createDate, submissionId }) {
+    try {
+        const result = await getWfList(cfg, {
+            category: 'mine', page: 1, keyword: requestName,
+            createTime: createDate, workflow: workflowId,
+        });
+        const candidates = pickVerifiedRequest(result.items, { requestName, requestId });
+        if (candidates.length === 1) {
+            const item = candidates[0];
+            if (submissionId)
+                updateSubmission(submissionId, { status: 'created', requestId: item.requestId, verifiedAt: new Date().toISOString() });
+            console.log(`  ✅ 核验通过 requestid=${item.requestId}  当前节点=${item.nodeName ?? item.node ?? '—'}`);
+            return true;
+        }
+        if (candidates.length === 0) {
+            console.log(`  ⚠ 核验：我的请求列表暂未查到${submissionId ? `（可稍后 e9 create verify ${submissionId}）` : ''}`);
+            return false;
+        }
+        console.log(`  ⚠ 核验：查到 ${candidates.length} 条同名候选，请人工确认：`);
+        for (const item of candidates)
+            console.log(`    · requestid=${item.requestId}  ${item.nodeName ?? item.node ?? ''}  ${item.createdate ?? ''}`);
+        return false;
+    }
+    catch (e) {
+        console.log(`  ⚠ 核验失败：${e.message}`);
+        return false;
+    }
+}
 async function runCreateStart(args) {
     const cfg = loadConfig(flagStr(args, 'config'));
     const id = flagStr(args, 'id');
@@ -899,7 +932,7 @@ async function runCreateStart(args) {
                 console.log(`    ▸ field${fl.fieldId} ← ${fl.filePath}`);
             console.log('  附件上传会产生新文件 ID，不能冻结到本次确认计划；请在无附件字段变更时单独确认。');
         }
-        const prepared = await prepareCreateSubmission(cfg, wfId, values, requestname, details, r);
+        const prepared = await prepareCreateSubmission(cfg, wfId, values, requestname, details, r, files);
         printFormulaResults(prepared);
         const plan = saveSubmissionPlan({ ...prepared, files });
         if (details.length > 0) {
@@ -952,6 +985,15 @@ async function runCreateStart(args) {
             console.log(`  ⚠ 取流转候选失败：${e.message}`);
         }
     }
+    if (args.flags.verify) {
+        await verifyCreatedInline(cfg, {
+            requestName: plan.requestName,
+            requestId: rid ? String(rid) : '',
+            workflowId: wfId,
+            createDate: todayStr(),
+            submissionId: submitResult.submission.id,
+        });
+    }
     console.log(BOX_TOP);
     if (j)
         console.log('响应:', JSON.stringify(j).slice(0, 600));
@@ -5401,10 +5443,14 @@ async function main() {
         console.log(usage());
         return;
     }
-    const cmd = args._[0] ?? 'todo';
+    if (!args._[0]) {
+        console.log(usage());
+        return;
+    }
+    const cmd = args._[0];
     if (cmd === 'version') {
         const buildHash = createHash('sha256').update(fs.readFileSync(new URL(import.meta.url))).digest('hex').slice(0, 12);
-        console.log(JSON.stringify({ name: 'weaver-e9-assistant-cli', version: '1.1.12', buildHash }, null, 2));
+        console.log(JSON.stringify({ name: 'weaver-e9-assistant-cli', version: '1.1.13', buildHash }, null, 2));
         return;
     }
     if (cmd === 'whoami') {

package/dist/submissionstate.js

@@ -79,3 +79,16 @@ export function extractCreatedRequestId(response) {
     const accepted = !!requestId && (type === 'SUCCESS' || type === 'ASYNC_SUBMIT');
     return { accepted, requestId: requestId ? String(requestId) : '', type: String(type) };
 }
+
+/**
+ * 从「我的请求」列表中挑选可用于核验的条目。
+ * - 有 requestId：只认 id 完全相等的（最可靠，不受同名影响）；
+ * - 无 requestId（超时/状态不明）：按标题完全匹配，交给调用方判断是否唯一。
+ */
+export function pickVerifiedRequest(items, { requestName = '', requestId = '' } = {}) {
+    const list = Array.isArray(items) ? items : [];
+    if (requestId) {
+        return list.filter((item) => String(item?.requestId ?? '') === String(requestId));
+    }
+    return list.filter((item) => item?.title === requestName || item?.rawTitle === requestName);
+}

package/dist/todosubmit.js

@@ -1,7 +1,7 @@
 import { createApiFromProfile } from './client.js';
 import { getWfList } from './workflow.js';
 import { todayStr, nowTimeStr } from './util.js';
-import { findNonEditableFields } from './wfstart.js';
+import { findNonEditableFields, resolveLinkage } from './wfstart.js';
 import { getBrowserOptions, isCustomBrowserField, browserNameSeparator, normalizeSelectValue } from './wfform.js';
 import { applyFormulas } from './formula.js';
 import { uploadFile, fieldListType, uploadFieldValue } from './wfupload.js';
@@ -208,6 +208,60 @@ async function normalizeMainValues(cfg, workflowId, tableInfo, mainValues, brows
     return overrides;
 }
 
+/**
+ * 从联动结果中挑出可回填的主表字段：
+ * - 目标必须是主表字段（明细联动暂未覆盖）；
+ * - 用户显式改过的字段不回填（用户值优先）；
+ * - 只补空值，避免覆盖已有数据。
+ */
+export function pickLinkageTargets(changes, { mainValues = {}, triggers = {}, meta } = {}) {
+    const linked = {};
+    for (const [fid, cv] of Object.entries(changes ?? {})) {
+        const field = meta?.fieldById?.get(String(fid));
+        if (!field || isDetailTableKey(field.table))
+            continue;
+        if (Object.prototype.hasOwnProperty.call(triggers, fid))
+            continue;
+        if (mainValues[fid] !== undefined && mainValues[fid] !== null && mainValues[fid] !== '')
+            continue;
+        const value = cv?.value;
+        if (value === undefined || value === null || value === '')
+            continue;
+        linked[fid] = String(value);
+    }
+    return linked;
+}
+
+/**
+ * 待办字段联动（主表）：只以本次改动的字段作为触发，结果只补空值、不覆盖用户显式值。
+ * 与发起路径共用 resolveLinkage（token/cookie 均可）；明细行触发的联动暂未覆盖。
+ */
+async function applyTodoLinkage(cfg, wfId, j1, p, sp, tableInfo, meta, mainValues, userChangedIds, browserParams) {
+    const triggers = {};
+    for (const rawId of userChangedIds) {
+        const fid = normalizeFieldId(rawId);
+        if (!/^\d+$/.test(fid))
+            continue;
+        const value = mainValues[fid];
+        if (value === undefined || value === null || value === '')
+            continue;
+        triggers[fid] = String(value);
+    }
+    if (Object.keys(triggers).length === 0)
+        return { overrides: {}, applied: [] };
+    const changes = await resolveLinkage(cfg, wfId, triggers, {
+        formData: { raw: j1, params: p, submitParams: sp },
+    });
+    const linked = pickLinkageTargets(changes, { mainValues, triggers, meta });
+    const applied = Object.keys(linked);
+    if (applied.length === 0)
+        return { overrides: {}, applied: [] };
+    // 联动结果也要做浏览框/选择框规范化（显示名→值、补 field<id>name）
+    const overrides = await normalizeMainValues(cfg, wfId, tableInfo, linked, browserParams);
+    Object.assign(mainValues, linked);
+    return { overrides, applied };
+}
+
 /** 明细改动行的选择框 / 浏览框规范化（显示名→ID，并补 name）。 */
 async function normalizeDetailPlan(cfg, workflowId, fieldById, plan, browserParams) {
     const optionCache = new Map();
@@ -597,6 +651,21 @@ export async function prepareTodoSubmission(cfg, opts) {
         }
     }
 
+    // 字段联动（主表）：本次改动的字段作触发，结果只补空值、不覆盖用户显式值
+    const userChangedIds = new Set();
+    if (plan) {
+        for (const k of plan.changedMainKeys)
+            userChangedIds.add(k);
+    }
+    else {
+        for (const k of Object.keys(opts.fieldValues ?? {})) {
+            if (!isDetailValueKey(k, meta.fieldById))
+                userChangedIds.add(k);
+        }
+    }
+    const linkage = await applyTodoLinkage(cfg, wfId, j1, p, sp, tableInfo, meta, mainValues, userChangedIds, browserParams);
+    Object.assign(bodyOverrides, linkage.overrides);
+
     // 公式字段
     const formula = { applied: [], skipped: [] };
     if (plan) {
@@ -639,6 +708,8 @@ export async function prepareTodoSubmission(cfg, opts) {
         if (item.table === 'main')
             changedMain.add(`field${String(item.dest).split('.').pop()}`);
     }
+    for (const fid of linkage.applied)
+        changedMain.add(`field${fid}`);
 
     return {
         api, requestId, remarkText, remarkHtml, j0, j1, p, sp, wfId, nodeId,

package/dist/wfstart.js

@@ -1,6 +1,5 @@
 import { createApiFromProfile } from './client.js';
 import { describeFormFields, HTMLTYPE_LABEL, VIEWATTR_LABEL, fieldNonEditableReason, getBrowserOptions, browserNameSeparator, normalizeSelectValue } from './wfform.js';
-import { AuthTokenSession } from './auth-token.js';
 import { findCreateWfByName } from './wfcreate.js';
 import { uploadFile, fieldListType, uploadFieldValue } from './wfupload.js';
 import { getCurrentUser, defaultForField } from './wfuser.js';
@@ -204,6 +203,7 @@ export async function getStartableFields(cfg, workflowId) {
         submitParams: f.submitParams,
         params: f.params,
         linkageCfg: f.raw?.linkageCfg,
+        fromCache,                 // 命中表单缓存时 submitParams 可能含过期短期 token，真提交前需刷新
         selfId,                    // 当前用户 ID（供下游缓存/联动用）
     };
 }
@@ -636,7 +636,42 @@ export function findNonEditableFields(form, values, details = []) {
     return bad;
 }
 
-export async function prepareCreateSubmission(cfg, workflowId, values, requestname, details = [], formData) {
+/**
+ * 附件目标的字段权限校验（发起路径）。
+ * 附件值在提交时才上传，values/details 的门禁覆盖不到；这里按 `field<id>[_row]`
+ * 解析出字段 id，用与手动填值相同的判据（viewattr + isonlyshow/isedit/isview）校验。
+ */
+export function findNonEditableFileTargets(form, files) {
+    const byId = new Map();
+    for (const t of form?.tables ?? [])
+        for (const fld of t.fields ?? [])
+            byId.set(String(fld.id), fld);
+    const bad = [];
+    for (const fl of files ?? []) {
+        const raw = String(fl?.fieldId ?? '').trim().replace(/^field/, '');
+        const m = raw.match(/^(\d+)(?:_\d+)?$/);
+        if (!m)
+            continue; // 格式错误交给上传阶段报
+        const id = m[1];
+        const fld = byId.get(id);
+        if (!fld)
+            continue; // 未知字段交给服务端判定
+        const reason = fieldNonEditableReason(fld.raw ?? fld);
+        if (reason)
+            bad.push({ id, label: fld.label, reason, currentValue: fld.currentValue });
+    }
+    return bad;
+}
+
+/** 附件目标含禁止编辑/不可见字段时直接拒绝（与手动填值同一硬规则）。 */
+export function assertFilesEditable(form, files) {
+    const bad = findNonEditableFileTargets(form, files);
+    if (bad.length) {
+        throw new Error(`拒绝向禁止编辑的字段上传附件：${bad.map((b) => `${b.label ?? b.id}(${b.reason})`).join('、')}。只允许向当前节点可编辑的附件字段上传。`);
+    }
+}
+
+export async function prepareCreateSubmission(cfg, workflowId, values, requestname, details = [], formData, files = []) {
     const f = formData || await describeFormFields(cfg, workflowId);
     if (f.verifyRight === false)
         throw new Error('无权限（verifyRight:false），跑 e9 auth token-login');
@@ -644,6 +679,7 @@ export async function prepareCreateSubmission(cfg, workflowId, values, requestna
     const badFields = findNonEditableFields(f, values, details);
     if (badFields.length)
         throw new Error(`拒绝填写禁止编辑的字段：${badFields.map((b) => `${b.label ?? b.id}(${b.reason}${b.currentValue ? `，已有默认值 ${b.currentValue} 自动带出` : ''})`).join('、')}。表单只允许填写「可编辑」字段，不得绕过字段权限自行填值。`);
+    assertFilesEditable(f, files);
     const name = requestname || `${f.workflowName ?? '流程'}-系统管理员-${todayStr()}`;
     const merged = { ...values };
     const main = f.tables.find((t) => t.key === 'main');
@@ -875,6 +911,38 @@ const browserNames = await resolveBrowserNames(cfg, workflowId, browserFields, m
     return { workflowId: String(workflowId), workflowName: f.workflowName, requestName: name, values: merged, details, browserNames, codeblockConflicts, codeblock: codeblockStatus, formulas, body };
 }
 
+/**
+ * 真实提交前刷新 loadForm 下发的短期签名参数。
+ *
+ * 表单缓存（30 天）里含 submitParams，其中 `*_addrequest_submit_token` 有服务端时效；
+ * 缓存命中时直接复用可能触发 E9「重复提交」。这里只在 fromCache 时补一次 loadForm，
+ * 缓存未命中时 describeFormFields 刚取过，不重复请求。
+ */
+export async function refreshSubmitParams(cfg, workflowId, formData) {
+    if (!formData?.fromCache)
+        return formData;
+    try {
+        const api = await createApiFromProfile(cfg);
+        const r = await api.post('/api/workflow/reqform/loadForm', { iscreate: '1', workflowid: String(workflowId) });
+        const j = r.json ?? {};
+        // 空响应/非 2xx（如鉴权失效）不视为刷新成功，继续用原缓存参数
+        if (!r || r.status >= 400 || (!j.params && !j.submitParams))
+            return formData;
+        return {
+            ...formData,
+            params: j.params ?? formData.params,
+            submitParams: j.submitParams ?? formData.submitParams,
+            raw: j.linkageCfg ? { ...(formData.raw ?? {}), linkageCfg: j.linkageCfg } : formData.raw,
+            fromCache: false,
+            submitParamsRefreshedAt: new Date().toISOString(),
+        };
+    }
+    catch {
+        // 刷新失败沿用缓存参数，最终由服务端判定；不阻断提交
+        return formData;
+    }
+}
+
 /**
  * 真正提交（新建流程）。若传入 prepared，则只用确认阶段冻结的业务字段、明细行与浏览框名称，
  * 仅刷新本次表单必需的短期签名参数，绝不重新补默认值或执行联动。
@@ -882,20 +950,24 @@ const browserNames = await resolveBrowserNames(cfg, workflowId, browserFields, m
 export async function submitCreateRequest(cfg, workflowId, values, requestname, files = [], details = [], prepared = undefined, opts = {}) {
     let plan = prepared;
     if (!plan) {
-        plan = await prepareCreateSubmission(cfg, workflowId, values, requestname, details, opts.formData);
+        plan = await prepareCreateSubmission(cfg, workflowId, values, requestname, details, opts.formData, files);
     }
     else {
         plan = { ...prepared, values: { ...prepared.values } };
     }
     // 文件 ID 只能在真实提交时获得；其余已确认字段绝不重新解析或联动。
     // ★ 表单缓存：优先用调用方传入的 formData（避免重复 describeFormFields ~2.3s）
-    const f = opts.formData || await describeFormFields(cfg, workflowId);
+    //   缓存命中时 submitParams 可能是旧的短期 token，真提交前刷新，避免服务端「重复提交」。
+    const f = await refreshSubmitParams(cfg, workflowId, opts.formData || await describeFormFields(cfg, workflowId));
     if (f.verifyRight === false)
         throw new Error('无权限（verifyRight:false），跑 e9 auth token-login');
     // 附件字段的上传目录在 fieldinfomap.fileattr.docCategory（如 ",,2"），必须与表单字段一致
     const allFields = f.tables.flatMap((t) => t.fields ?? []);
     const categoryFor = (fieldId) => allFields.find((x) => String(x.id) === String(fieldId))?.raw?.fileattr?.docCategory || undefined;
-    for (const fl of (plan.files ?? files)) {
+    const fileList = plan.files ?? files;
+    // 附件也是「填值」，同样受当前节点字段权限约束
+    assertFilesEditable(f, fileList);
+    for (const fl of fileList) {
         // 支持主表 fieldId 与明细行 fieldId_<row>（如 27799_0）
         const m = String(fl.fieldId).match(/^(\d+)(?:_(\d+))?$/);
         const baseId = m ? m[1] : String(fl.fieldId);
@@ -1112,8 +1184,7 @@ export async function resolveLinkage(cfg, workflowId, values, opts = {}) {
         return {};
     const p = f.params ?? {};
     const sp = f.submitParams ?? {};
-    const base = cfg.baseUrl.replace(/\/+$/, '');
-    const sess = AuthTokenSession.fromProfile(cfg);
+    const api = await createApiFromProfile(cfg);
     const selfId = opts.selfId || '';
     const changes = {};
     for (const [triggerFieldId, configs] of Object.entries(linkageCfg.dataInputCfg)) {
@@ -1160,13 +1231,9 @@ export async function resolveLinkage(cfg, workflowId, values, opts = {}) {
                     'f_weaver_belongto_userid': String(p.f_weaver_belongto_userid ?? '1'),
                     'f_weaver_belongto_usertype': String(p.f_weaver_belongto_usertype ?? '0'),
                 });
-                const r = await fetch(`${base}/api/workflow/linkage/reqDataInputResult`, {
-                    method: 'POST',
-                    headers: { aiAgentToken: sess.token, 'Content-Type': 'application/x-www-form-urlencoded', 'X-Requested-With': 'XMLHttpRequest' },
-                    body: body.toString(),
-                    signal: AbortSignal.timeout(15000),
-                });
-                const j = JSON.parse(await r.text());
+                // 走 E9Api：token 优先、cookie 回退（cookie-only 环境也能触发联动）
+                const r = await api.post('/api/workflow/linkage/reqDataInputResult', Object.fromEntries(body));
+                const j = r?.json ?? {};
                 const assignInfo = j[`assignInfo_${configId}`];
                 if (assignInfo?.changeValue) {
                     // ★ 写入缓存

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "weaver-e9-assistant-cli",
-  "version": "1.1.12",
+  "version": "1.1.13",
   "description": "泛微 e-cology E9 HTTP 能力 CLI 封装（待办、微博、新建流程、邮件、公文、日程、考勤、建模台账）",
   "type": "module",
   "bin": {