weaver-work-cli 0.1.2 → 0.1.5

package/dist/shortcuts/ehr/errors.js

@@ -0,0 +1,53 @@
+import { CliError, ExitCode } from '../../core/errors.js';
+export class EhrCliError extends CliError {
+    type;
+    subtype;
+    code;
+    retryable;
+    stage;
+    details;
+    partialData;
+    constructor(type, subtype, message, options = {}) {
+        super(message, options.exitCode ?? ExitCode.InternalError);
+        this.name = 'EhrCliError';
+        this.type = type;
+        this.subtype = subtype;
+        this.code = options.code;
+        this.retryable = options.retryable ?? false;
+        this.stage = options.stage;
+        this.details = options.details;
+        this.partialData = options.partialData;
+    }
+}
+export function ehrValidationError(subtype, message, details) {
+    return new EhrCliError('validation', subtype, message, {
+        details,
+        exitCode: ExitCode.UsageError,
+    });
+}
+export function ehrAuthError(subtype, message, details) {
+    return new EhrCliError('authentication', subtype, message, {
+        details,
+        exitCode: ExitCode.AuthError,
+    });
+}
+export function ehrNetworkError(subtype, message, options = {}) {
+    return new EhrCliError('network', subtype, message, {
+        ...options,
+        retryable: options.retryable ?? true,
+        exitCode: ExitCode.NetworkError,
+    });
+}
+export function ehrConfirmationError(action, details) {
+    return new EhrCliError('confirmation', 'required', '该操作需要明确确认', {
+        details: { action, ...details },
+        exitCode: ExitCode.ConfirmationRequired,
+    });
+}
+export function ehrPartialError(message, partialData, details) {
+    return new EhrCliError('partial', 'write_uncertain', message, {
+        details,
+        partialData,
+        exitCode: ExitCode.Partial,
+    });
+}

package/dist/shortcuts/ehr/host.js

@@ -0,0 +1,213 @@
+import { createHash } from 'node:crypto';
+import { requireE10Session } from '../../internal/e10/context.js';
+import { getActiveProfile } from '../../internal/e10/auth/session.js';
+import { E10ApiError, createE10RequestRuntime } from '../../internal/e10/request-runtime.js';
+import { ehrAuthError, ehrNetworkError, EhrCliError, ehrValidationError } from './errors.js';
+function inferProfile(ctx) {
+    const options = ctx.getGlobalOptions();
+    return options.profile || getActiveProfile();
+}
+/**
+ * 判断响应是否业务成功。聚才林各子系统响应契约不统一：
+ * - 出勤接口：WeaResult{ success, data, msg }
+ * - 人事档案/社保台账：{ code, msg, status, fail, data }
+ * - 薪酬个人报表：{ status, msg, data }
+ */
+export function isBusinessSuccess(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    if (typeof value.success === 'boolean')
+        return value.success;
+    if (typeof value.status === 'boolean')
+        return value.status;
+    if (value.code !== undefined && value.code !== null)
+        return Number(value.code) === 200;
+    return false;
+}
+export function businessMessage(value) {
+    if (!value || typeof value !== 'object')
+        return '泛微接口返回业务失败';
+    const candidates = [value.msg, value.message, value.data?.message];
+    for (const item of candidates) {
+        if (typeof item === 'string' && item.trim())
+            return item;
+    }
+    return '泛微接口返回业务失败';
+}
+/**
+ * 二次身份验证失败码。
+ *
+ * 关键陷阱（2026-09-04 实测）：薪酬接口二次验证失败时，HTTP 仍是 200 且
+ * `status` 仍为 `true`，只是 `msg` 变成失败码、`data` 缺失。因此
+ * `isBusinessSuccess` 会误判为成功，导致认证失败被静默吞掉，输出 `data: null`，
+ * 调用方会误以为"查询成功但没有数据"。
+ *
+ * 必须在业务成功判定之外单独识别这些码并抛出明确错误。
+ */
+const SECOND_AUTH_FAILURE_CODES = {
+    checkSecondFailNoToken: {
+        subtype: 'second_auth_token_missing',
+        message: '二次身份验证 token 缺失：接口未收到 token。CLI 未传时会自动补 DONT_NEED，出现此错误说明该环境不接受缺省值，需由用户提供真实 token。',
+    },
+    checkSecondFail: {
+        subtype: 'second_auth_failed',
+        message: '二次身份验证失败：传入的 token 不被当前环境接受。请确认 token 有效；任何 Skill 都无法自动获取真实 token。',
+    },
+    checkSecondError: {
+        subtype: 'second_auth_error',
+        message: '二次身份验证服务异常。必须停止并说明异常，不得绕过验证读取数据。',
+    },
+};
+/**
+ * 检测二次身份验证失败。返回失败信息，未失败时返回 null。
+ * 判断依据是 msg 精确等于失败码，避免误伤正常业务消息。
+ */
+export function detectSecondAuthFailure(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const msg = typeof value.msg === 'string' ? value.msg.trim() : '';
+    return msg ? SECOND_AUTH_FAILURE_CODES[msg] ?? null : null;
+}
+function businessCode(value) {
+    if (!value || typeof value !== 'object')
+        return undefined;
+    const code = value.code ?? value.status;
+    if (typeof code === 'string' || typeof code === 'number')
+        return code;
+    return undefined;
+}
+export function assertPath(requestPath) {
+    if (typeof requestPath !== 'string' || !requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        throw ehrValidationError('path_invalid', '请求路径必须是相对绝对路径');
+    }
+    if (/^https?:/i.test(requestPath) || /[\r\n]/.test(requestPath) || requestPath.includes('/../')) {
+        throw ehrValidationError('path_invalid', '请求路径不允许跨域或路径逃逸');
+    }
+    if (!requestPath.startsWith('/api/')) {
+        throw ehrValidationError('path_not_allowed', '聚才林只能调用 /api/ 路径');
+    }
+}
+function formBody(form) {
+    if (!form)
+        return undefined;
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(form)) {
+        if (value === undefined || value === null)
+            continue;
+        params.set(key, typeof value === 'string' ? value : JSON.stringify(value));
+    }
+    return params;
+}
+function omitEmptyQueryValues(query) {
+    if (!query)
+        return undefined;
+    return Object.fromEntries(Object.entries(query).filter(([, value]) => value !== ''));
+}
+function mapRuntimeNetworkError(error) {
+    if (error instanceof E10ApiError && error.type === 'network') {
+        throw ehrNetworkError(error.subtype, error.message, {
+            retryable: error.retryable,
+            details: error.details,
+        });
+    }
+    throw error;
+}
+export function createEhrHost(ctx, dependencies = {}) {
+    let e10Session = null;
+    let sessionContext = null;
+    const requireSession = dependencies.requireSession || requireE10Session;
+    async function ensureSession() {
+        if (!e10Session) {
+            e10Session = await requireSession(ctx);
+            sessionContext = {
+                baseUrl: e10Session.getBaseUrl(),
+                profile: inferProfile(ctx),
+                userId: e10Session.userId,
+                tenantKey: e10Session.tenantKey,
+                eteamsId: e10Session.eteamsId,
+            };
+        }
+        return e10Session;
+    }
+    async function getSession() {
+        await ensureSession();
+        return sessionContext;
+    }
+    async function runtime() {
+        return createE10RequestRuntime(ctx, await ensureSession(), {
+            interceptors: dependencies.interceptors,
+            fetch: dependencies.fetch,
+        });
+    }
+    async function request(request) {
+        const { method, path, query, body, operation, form, multipart, headers: extraHeaders = {}, timeoutMs = 30_000, } = request;
+        assertPath(path);
+        const resolvedMethod = method || (body === undefined && form === undefined && multipart === undefined ? 'GET' : 'POST');
+        let response;
+        try {
+            response = await (await runtime()).requestJson({
+                module: 'ehr',
+                operation,
+                method: resolvedMethod,
+                path,
+                query: omitEmptyQueryValues(query),
+                body: multipart === undefined ? body : undefined,
+                form: multipart === undefined && form === undefined ? undefined : formBody(form ?? {}),
+                formData: multipart,
+                headers: { 'X-Requested-With': 'XMLHttpRequest', ...extraHeaders },
+                timeoutMs,
+            });
+        }
+        catch (error) {
+            mapRuntimeNetworkError(error);
+        }
+        if (response.status === 401 || response.status === 302) {
+            throw ehrAuthError('session_expired', 'E10 登录态已失效，请先向用户确认 E10 登录域名，再运行 weaver-work-cli auth login --base-url <域名> 完成登录', { httpStatus: response.status });
+        }
+        if (response.parseError) {
+            if (response.status < 200 || response.status >= 300) {
+                throw new EhrCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                    code: response.status,
+                    details: { status: response.status },
+                    exitCode: 1,
+                });
+            }
+            throw ehrNetworkError('protocol', `接口返回不是合法 JSON（HTTP ${response.status}）`, { retryable: false });
+        }
+        if (response.status < 200 || response.status >= 300) {
+            throw new EhrCliError('api', 'http_error', `泛微接口 HTTP ${response.status}`, {
+                code: response.status,
+                details: { status: response.status, message: businessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        // 二次验证失败必须优先于业务成功判定：
+        // 这类响应 HTTP 200 且 status 仍为 true，只靠 isBusinessSuccess 会被判成成功，
+        // 从而把认证失败静默吞成 data:null。
+        const secondAuthFailure = detectSecondAuthFailure(response.value);
+        if (secondAuthFailure) {
+            throw new EhrCliError('api', secondAuthFailure.subtype, secondAuthFailure.message, {
+                code: businessCode(response.value),
+                details: { code: businessCode(response.value), msg: businessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        if (!isBusinessSuccess(response.value)) {
+            throw new EhrCliError('api', 'business_error', businessMessage(response.value), {
+                code: businessCode(response.value),
+                details: { code: businessCode(response.value), message: businessMessage(response.value) },
+                exitCode: 1,
+            });
+        }
+        return response.value;
+    }
+    async function buildCardSign() {
+        const session = await getSession();
+        if (!session.userId || !session.eteamsId || !session.tenantKey) {
+            throw ehrAuthError('card_sign_unavailable', '无法构造打卡凭证：缺少 empId、ETEAMSID 或 tenantKey，请先重新登录');
+        }
+        const raw = `wea${'web'}${session.userId}${session.eteamsId}${session.tenantKey.toLowerCase()}`;
+        return `${createHash('md5').update(raw).digest('hex')}ver`;
+    }
+    return { request, getSession, buildCardSign };
+}

package/dist/shortcuts/ehr/index.js

@@ -0,0 +1,205 @@
+import { readFile } from 'node:fs/promises';
+import { ExitCode, isCliError, toErrorEnvelope } from '../../core/errors.js';
+import { createEhrContinuationSigner } from './continuation.js';
+import { createEhrHost } from './host.js';
+import { ehrManifest } from './manifest.js';
+import { executeEhrOperation } from './operations.js';
+import { ehrValidationError } from './errors.js';
+function asOptions(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+async function readStdin() {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks).toString('utf8');
+}
+/**
+ * Windows PowerShell 的管道与 Set-Content -Encoding utf8 会在内容前写入 UTF-8 BOM，
+ * 且可能重复写入多次；JSON.parse 不接受前导 BOM，必须先剥离。
+ */
+function stripBom(value) {
+    return value.replace(/^\uFEFF+/, '');
+}
+export async function inputFrom(options, extra = {}) {
+    const opts = asOptions(options);
+    let input = {};
+    if (opts.input && opts.inputJson) {
+        throw ehrValidationError('input_conflict', '不能同时传 --input 和 --input-json');
+    }
+    if (opts.inputJson) {
+        input = parseJsonInput(String(opts.inputJson), '--input-json');
+    }
+    if (opts.input) {
+        let raw;
+        try {
+            raw = stripBom(opts.input === '-' ? await readStdin() : await readFile(String(opts.input), 'utf8'));
+        }
+        catch {
+            throw ehrValidationError('input_unreadable', `无法读取 --input：${String(opts.input)}`);
+        }
+        input = parseJsonInput(raw, '--input');
+    }
+    return {
+        ...input,
+        ...Object.fromEntries(Object.entries(extra).filter(([, value]) => value !== undefined && value !== '')),
+    };
+}
+function parseJsonInput(raw, label) {
+    try {
+        const parsed = JSON.parse(stripBom(raw));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            throw new Error('input must be an object');
+        }
+        return parsed;
+    }
+    catch {
+        throw ehrValidationError('input_invalid', `${label} 不是合法 JSON 对象`);
+    }
+}
+export function successEnvelope(operation, result) {
+    return {
+        schemaVersion: 1,
+        ok: true,
+        operation,
+        // 业务数据为 undefined 时（如社保福利/调薪记录为空）仍须输出 data 键，
+        // 否则 JSON.stringify 会省略该键，导致调用方需额外判断键是否存在。
+        data: result.data === undefined ? null : result.data,
+        ...(result.meta ? { meta: result.meta } : {}),
+        warnings: [],
+    };
+}
+function failureEnvelope(error) {
+    const structured = error;
+    return {
+        schemaVersion: 1,
+        ok: false,
+        ...(structured?.partialData === undefined ? {} : { data: structured.partialData }),
+        error: toErrorEnvelope(error),
+    };
+}
+async function executeAndPrint(ctx, operation, input) {
+    try {
+        const result = await executeEhrOperation(operation, input, {
+            ctx,
+            host: createEhrHost(ctx),
+            continuation: createEhrContinuationSigner(ctx),
+        });
+        ctx.output.write(successEnvelope(operation, result), { json: true });
+    }
+    catch (error) {
+        console.error(JSON.stringify(failureEnvelope(error), null, 2));
+        process.exitCode = isCliError(error) ? error.exitCode : ExitCode.GeneralError;
+    }
+}
+export const ehrShortcut = {
+    name: 'ehr',
+    description: '泛微E10聚才林（人事/出勤/薪酬）CLI',
+    category: 'shortcut',
+    register({ program, action }) {
+        const ehr = program.command('ehr').description('泛微E10聚才林（人事档案/出勤管理/薪酬管理）');
+        ehr.command('schema')
+            .description('Print ehr operation manifest for agents')
+            .action(action((ctx) => {
+            ctx.output.write(ehrManifest, { json: true });
+        }));
+        ehr.command('run')
+            .description('Run an ehr operation with JSON input')
+            .argument('<operation>', 'operation name, e.g. ehr.attend.summary.get')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--input-json <json>', 'inline JSON input object')
+            .action(action(async (ctx, operation, options) => {
+            await executeAndPrint(ctx, String(operation), await inputFrom(options));
+        }));
+        // ---- 高频便捷命令：出勤 ----
+        const attend = ehr.command('attend').description('Attendance commands');
+        attend.command('summary')
+            .description('出勤情况统计')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--begin <date>', 'start date YYYY-MM-DD')
+            .option('--end <date>', 'end date YYYY-MM-DD')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.attend.summary.get', await inputFrom(options, {
+                beginDate: opts.begin,
+                endDate: opts.end,
+            }));
+        }));
+        attend.command('abnormal')
+            .description('异常考勤明细')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--begin <date>', 'start date YYYY-MM-DD')
+            .option('--end <date>', 'end date YYYY-MM-DD')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.attend.abnormal.list', await inputFrom(options, {
+                beginDate: opts.begin,
+                endDate: opts.end,
+            }));
+        }));
+        const card = attend.command('card').description('Attendance card punch commands');
+        card.command('status')
+            .description('查询当前打卡按钮状态')
+            .action(action(async (ctx, options) => {
+            await executeAndPrint(ctx, 'ehr.attend.card.status', await inputFrom(options));
+        }));
+        card.command('check-prepare')
+            .description('准备 PC 端打卡（需 type）')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--type <type>', 'CHECKIN / CHECKOUT / LEAVE / RETURN / CHECKIN_AND_RETURN / CHECKOUT_AND_LEAVE')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.attend.card.check.prepare', await inputFrom(options, { type: opts.type }));
+        }));
+        card.command('check-apply')
+            .description('执行 PC 端打卡（需 --yes 与 --continuation）')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--type <type>', 'CHECKIN / CHECKOUT / LEAVE / RETURN / CHECKIN_AND_RETURN / CHECKOUT_AND_LEAVE')
+            .option('--continuation <token>', 'continuation token from check-prepare')
+            .option('--yes', 'confirm the write operation')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.attend.card.check.apply', await inputFrom(options, {
+                type: opts.type,
+                continuation: opts.continuation,
+                confirm: opts.yes === true ? true : undefined,
+            }));
+        }));
+        // ---- 高频便捷命令：薪酬 ----
+        const salary = ehr.command('salary').description('Salary commands');
+        salary.command('bills')
+            .description('我的工资单列表')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--month <month>', 'salary month YYYY-MM')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.salary.bill.list', await inputFrom(options, {
+                salaryYearMonth: opts.month ? [opts.month] : undefined,
+            }));
+        }));
+        // ---- 高频便捷命令：人事档案 ----
+        const hr = ehr.command('hr').description('HR profile commands');
+        hr.command('contact-search')
+            .description('通讯录高级查询（在职）')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--username <name>', 'name keyword')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.hr.contact.search', await inputFrom(options, { username: opts.username }));
+        }));
+        hr.command('contact-fields')
+            .description('通讯录字段列表')
+            .action(action(async (ctx, options) => {
+            await executeAndPrint(ctx, 'ehr.hr.contact.fields', await inputFrom(options));
+        }));
+        hr.command('ds-fields')
+            .description('数据源字段结构（需 --form-id）')
+            .option('--input <path>', 'JSON input file, or - for stdin')
+            .option('--form-id <id>', 'data source formId')
+            .action(action(async (ctx, options) => {
+            const opts = asOptions(options);
+            await executeAndPrint(ctx, 'ehr.hr.ds.fields', await inputFrom(options, { formId: opts.formId }));
+        }));
+    },
+};

package/dist/shortcuts/ehr/manifest.js

@@ -0,0 +1,47 @@
+import { ehrOperationDefinitions } from './operations/registry.js';
+import { HR_DATA_SOURCE_IDS } from './operations/hr-ds.js';
+/**
+ * 招聘管理模块的禁用边界（第二期写操作，随实现逐个解除）。
+ * 读操作与上下文解析第一期已实现；写操作已实现 candidate.create / interview.arrange /
+ * offer.send / entry.process / interview.feedback.edit / interview.feedback.urge
+ * （prepare->apply 全协议），仅 entry.cancel.change（撤销类，破坏性最强）暂缓。
+ */
+const RECRUIT_WITHHELD = [
+    'recruit.entry.cancel.change',
+];
+/** 移动端考勤打卡：Agent 无法获取真实定位/WiFi/设备凭证，服务端必拒，严禁伪造参数。 */
+const MOBILE_CARD_WITHHELD = ['attend.card.sign.mobile'];
+function buildOperations() {
+    return ehrOperationDefinitions().map((definition) => ({
+        name: definition.name,
+        resource: definition.resource,
+        summary: definition.summary,
+        ...(definition.capability ? { capability: definition.capability } : {}),
+        risk: definition.risk,
+        ...(definition.requiresConfirmation ? { requiresConfirmation: true } : {}),
+        inputSchema: definition.inputSchema,
+    }));
+}
+export const ehrManifest = {
+    schemaVersion: 1,
+    name: 'ehr',
+    title: '泛微E10聚才林（人事/出勤/薪酬/招聘查询）',
+    version: '0.1.0',
+    host: 'e10-ehr',
+    status: 'builtin',
+    sourceSkill: 'weaver-e10-jucailin',
+    capabilities: ['salary', 'attend', 'hr', 'recruit'],
+    dataSourceIds: HR_DATA_SOURCE_IDS,
+    dataSourceGroupId: 'weaver-hr-service',
+    operations: buildOperations(),
+    withheldOperations: [
+        ...RECRUIT_WITHHELD.map((name) => ({
+            name,
+            reason: '招聘撤销类写操作（取消改期入职）破坏性最强且依赖入口链路，暂缓实现；其余招聘读操作与写操作（新建人才/安排面试/发送Offer/办理入职/面试反馈编辑/催评）均已可用。不得编造或绕过。',
+        })),
+        ...MOBILE_CARD_WITHHELD.map((name) => ({
+            name,
+            reason: '移动端考勤打卡依赖真实经纬度、WiFi/蓝牙、设备信息与客户端加密凭证，Agent 均无法真实获取，服务端校验必拒；严禁伪造定位、WiFi 或凭证参数。PC 端打卡请使用 ehr.attend.card.check.*。',
+        })),
+    ],
+};