weaver-work-cli 0.1.42 → 0.1.44

package/dist/shortcuts/reception/operations/shared.js

@@ -0,0 +1,196 @@
+import { createHash } from 'node:crypto';
+import { chmodSync, mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { receptionValidationError } from '../errors.js';
+/** 稳定序列化：键排序，保证同数据同哈希。 */
+export function canonical(value) {
+    if (value === null || typeof value !== 'object')
+        return JSON.stringify(value ?? null);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(',')}]`;
+    const record = value;
+    const keys = Object.keys(record).sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonical(record[key])}`).join(',')}}`;
+}
+export function sha256(text) {
+    return createHash('sha256').update(String(text)).digest('hex');
+}
+export function ensureDir(path) {
+    try {
+        mkdirSync(path, { recursive: true });
+    }
+    catch {
+        // 已存在或不可写；可写性交给后续真实写入报错
+    }
+}
+export function readJson(path, fallback = null) {
+    try {
+        return JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch {
+        return fallback;
+    }
+}
+export function writeJson(path, value) {
+    ensureDir(dirname(path));
+    writeFileSync(path, JSON.stringify(value, null, 2));
+}
+/** 最近修改时间，取不到算 0（用于 Python 缓存新鲜度判断）。 */
+export function mtimeMs(path) {
+    try {
+        return statSync(path).mtimeMs;
+    }
+    catch {
+        return 0;
+    }
+}
+export function fileSize(path) {
+    try {
+        return statSync(path).size;
+    }
+    catch {
+        return 0;
+    }
+}
+/** 只有存在且未超过 ttl 才算新鲜。 */
+export function fresh(path, ttlMs) {
+    const mtime = mtimeMs(path);
+    return Boolean(mtime) && Date.now() - mtime < ttlMs;
+}
+/** 严紧权限落盘；Windows 上 chmod 无效，忽略即可。 */
+export function writeJsonSecure(path, value, mode = 0o600) {
+    writeJson(path, value);
+    try {
+        chmodSync(path, mode);
+    }
+    catch {
+        // Windows 无 POSIX 权限位
+    }
+}
+// ---------------------------------------------------------------------------
+// JSON 入参
+//
+// 三条铁律（2026-11-02 事故的产物，不要简化）：
+//   1. 文件优先（--xxx-file），彻底绕开 shell 转义；
+//   2. 解析前清 BOM / 零宽字符，失败再试中文引号 + 尾随逗号；
+//   3. 报错必须自证：区分 missing / file_unreadable / invalid，invalid 带 preview + hasBom。
+// ---------------------------------------------------------------------------
+const BOM = /^\uFEFF/;
+const ZERO_WIDTH = /[\u200B-\u200D\uFEFF]/g;
+/** 纯文本 → 对象。不做 IO，便于单测。 */
+export function parseJsonText(raw) {
+    const src = String(raw ?? '');
+    const hasBom = src.charCodeAt(0) === 0xfeff;
+    const cleaned = src.replace(BOM, '').replace(ZERO_WIDTH, '').trim();
+    try {
+        return { ok: true, value: JSON.parse(cleaned), hasBom };
+    }
+    catch (firstError) {
+        const fixed = cleaned
+            .replace(/[\u201C\u201D]/g, '"')
+            .replace(/[\u2018\u2019]/g, "'")
+            .replace(/,\s*([}\]])/g, '$1');
+        try {
+            return { ok: true, value: JSON.parse(fixed), hasBom, autoFixed: true };
+        }
+        catch {
+            return {
+                ok: false,
+                reason: 'invalid',
+                error: firstError.message,
+                preview: cleaned.slice(0, 120),
+                hasBom,
+            };
+        }
+    }
+}
+/** 从选项对象读 JSON：`--<name>-file` 优先，其次 `--<name>` 内联。 */
+export function readJsonArg(options, name) {
+    const filePath = textOf(options, `${name}File`) || textOf(options, `${name}-file`);
+    if (filePath) {
+        let raw;
+        try {
+            raw = readFileSync(filePath, 'utf8');
+        }
+        catch (error) {
+            return {
+                ok: false,
+                reason: 'file_unreadable',
+                path: filePath,
+                error: error.message,
+            };
+        }
+        return { ...parseJsonText(raw), source: 'file', path: filePath };
+    }
+    const inline = options[name];
+    if (inline === undefined || inline === null || inline === true) {
+        return { ok: false, reason: 'missing' };
+    }
+    return { ...parseJsonText(String(inline)), source: 'inline' };
+}
+/**
+ * 取一个 JSON 参数，按语义抛错。
+ *
+ * @param options  commander 收集到的选项对象
+ * @param name     逻辑名，如 `known`（对应 --known / --known-file）
+ * @param config.code 错误码前缀，如 `KNOWN` → KNOWN_REQUIRED / KNOWN_INVALID / KNOWN_FILE_UNREADABLE
+ */
+export function jsonArg(options, name, config = {}) {
+    const prefix = config.code || name.toUpperCase().replace(/-/g, '_');
+    const result = readJsonArg(options, name);
+    if (result.ok)
+        return result.value;
+    if (result.reason === 'missing') {
+        if (!config.required)
+            return null;
+        throw receptionValidationError(`${prefix}_REQUIRED`, `缺少 --${name} <JSON> 或 --${name}-file <path>`, {
+            hint: config.hint || `推荐用文件传参：先写 ${name}.json，再 --${name}-file ${name}.json`,
+        });
+    }
+    if (result.reason === 'file_unreadable') {
+        throw receptionValidationError(`${prefix}_FILE_UNREADABLE`, `读不到 --${name}-file：${result.path}`, {
+            path: result.path,
+            detail: result.error,
+            hint: '检查文件是否存在、路径是否正确、是否有读权限；不要因此改回内联传参',
+        });
+    }
+    throw receptionValidationError(`${prefix}_INVALID`, `--${name} 不是合法 JSON：${result.error}`, {
+        hint: '常见原因：UTF-8 BOM（hasBom:true）、中文引号、尾随逗号、shell 吃掉双引号。'
+            + '请看 preview 定位，修 JSON 本身，不要换传参方式重试',
+        preview: result.preview,
+        hasBom: result.hasBom,
+    });
+}
+/** 从选项对象取字符串；commander 对未传的选项给 undefined，对布尔开关给 true。 */
+export function textOf(options, key) {
+    const value = options[key];
+    if (value === undefined || value === null || value === true || value === false)
+        return '';
+    return String(value).trim();
+}
+/** 姓名归一：数组 / 逗号分隔串 / {name} 对象都吃。 */
+export function nameList(value) {
+    const list = Array.isArray(value) ? value : String(value ?? '').split(/[,，、;；\s]+/);
+    return list
+        .map((item) => (typeof item === 'string' ? item : (item && (item.name || item.id)) || ''))
+        .map((item) => String(item).trim())
+        .filter(Boolean);
+}
+const hasValue = (value) => !(value === undefined || value === null || value === ''
+    || (Array.isArray(value) && value.length === 0));
+/** 7 项缺口：只判「有没有」，语义判断仍由模型完成。 */
+export function computeGaps(data = {}) {
+    const filled = [];
+    const gap = [];
+    const push = (key, value) => (hasValue(value) ? filled.push(key) : gap.push(key));
+    push('customer', data.customer || data.customerId);
+    push('headcount', data.headcount);
+    push('visitDate', data.visitDate);
+    push('visitType', data.visitType);
+    push('companions', data.companions);
+    push('demand', data.demand);
+    const logistics = ['headcount', 'meetingRoom', 'pickup', 'meal', 'hotel', 'gift'];
+    const logisticsMissing = logistics.filter((key) => !hasValue(data[key]));
+    push('logistics', logisticsMissing.length ? null : logistics);
+    return { filled, gap, logisticsMissing };
+}

package/dist/shortcuts/reception/operations/snapshot.js

@@ -0,0 +1,68 @@
+import { join } from 'node:path';
+import { SNAPSHOT_KIND } from '../constants.js';
+import { readJson } from './shared.js';
+export function resolveSnapshot(explicitPath = '') {
+    const candidates = [
+        explicitPath,
+        process.env.RECEPTION_SNAPSHOT || '',
+        process.env.RECEPTION_SKILL_DIR ? join(process.env.RECEPTION_SKILL_DIR, 'data', 'fields-snapshot.json') : '',
+        join(process.cwd(), 'data', 'fields-snapshot.json'),
+        join(process.cwd(), '..', 'data', 'fields-snapshot.json'),
+    ].filter(Boolean);
+    for (const path of candidates) {
+        const parsed = readJson(path);
+        if (parsed && parsed.kind === SNAPSHOT_KIND)
+            return { path, snapshot: parsed };
+    }
+    return { path: '', snapshot: null };
+}
+/**
+ * 从快照路径反推技能包根目录。
+ *
+ * 技能包里 `data/fields-snapshot.json` 与 `scripts/render.py` 是固定相对位置，
+ * 因此只要拿到快照路径，就能定位渲染脚本，不需要再让调用方传第二个参数。
+ */
+export function skillRootFromSnapshot(snapshotPath) {
+    // <skill>/data/fields-snapshot.json → <skill>
+    return join(snapshotPath, '..', '..');
+}
+/** 转成与 formctx fields[] 同形的数组，便于 buildMain 直接复用。 */
+export function snapshotFields(snapshot) {
+    if (!snapshot)
+        return [];
+    return (snapshot.fields || []).map((field) => ({
+        id: field.id,
+        name: field.name,
+        componentKey: field.componentKey,
+        isBrowser: Boolean(field.isBrowser),
+        isMultiple: Boolean(field.isMultiple),
+        required: Boolean(field.required),
+        options: field.options || [],
+    }));
+}
+/** 与实时 fields 对拍：数量、名称、同名字段的 ID 是否一致。 */
+export function diffSnapshot(snapshot, liveFields) {
+    if (!snapshot) {
+        return { match: null, drift: [], expectedCount: 0, actualCount: (liveFields || []).length };
+    }
+    const want = new Map((snapshot.fields || []).map((field) => [field.name, field]));
+    const live = new Map((liveFields || []).map((field) => [String(field.name), field]));
+    const drift = [];
+    for (const [name, field] of want) {
+        const matched = live.get(name);
+        if (!matched)
+            drift.push({ type: 'missing-in-form', name, expectedId: field.id });
+        else if (matched.id && String(matched.id) !== String(field.id)) {
+            drift.push({ type: 'id-changed', name, expectedId: field.id, actualId: String(matched.id) });
+        }
+    }
+    for (const [name, field] of live) {
+        if (!want.has(name)) {
+            drift.push({ type: 'new-field', name, actualId: field.id ? String(field.id) : '' });
+        }
+    }
+    const expectedCount = snapshot.mainFieldCount || 0;
+    const actualCount = (liveFields || []).length;
+    const countOk = expectedCount === actualCount;
+    return { match: countOk && drift.length === 0, countOk, expectedCount, actualCount, drift };
+}

package/dist/shortcuts/reception/operations/types.js

@@ -0,0 +1 @@
+export {};

package/dist/shortcuts/reception/operations.js

@@ -0,0 +1,33 @@
+import { receptionValidationError } from './errors.js';
+import { getReceptionOperation } from './operations/registry.js';
+/**
+ * operation 调度入口。
+ *
+ * 这里只做两件事：按名取 handler、拒绝凭据类入参。
+ * 业务逻辑一律在 `operations/<action>.ts` 里，不要往这层塞分支。
+ */
+const FORBIDDEN_INPUT_KEYS = new Set([
+    'access_token',
+    'app_key',
+    'app_secret',
+    'cookie',
+    'eteamsid',
+    'token',
+    'sid',
+    'eteamsId',
+]);
+export function normalizeInput(raw) {
+    return raw && typeof raw === 'object' && !Array.isArray(raw) ? raw : {};
+}
+export async function executeReceptionOperation(operation, rawInput, context) {
+    const handler = getReceptionOperation(operation);
+    const input = normalizeInput(rawInput);
+    for (const key of Object.keys(input)) {
+        if (FORBIDDEN_INPUT_KEYS.has(key)) {
+            throw receptionValidationError('FORBIDDEN_INPUT', `禁止传入凭据字段：${key}`, {
+                hint: '凭据由 CLI 运行时统一注入，业务入参不接受',
+            });
+        }
+    }
+    return handler.execute(input, context);
+}

package/dist/shortcuts/reception/upload.js

@@ -0,0 +1,218 @@
+/**
+ * 文件上传协议：teamsCheck → preUploadCheck → module/upload。
+ *
+ * **为什么不走 `/api/file/upload`**：这个接口在 E10 侧已废弃，实测会返回 200 但响应里没有
+ * fileid（或直接是登录页 HTML），表现为「上传失败但没有原因」。现行链路是三步：
+ *
+ *   1. `POST /api/baseserver/layout/teamsCheck`            —— 校验当前用户身份
+ *   2. `POST /api/file/preUploadCheck?sf_request_type=ajax` —— 预检，返回上传策略
+ *   3. `POST /api/file/module/upload?sf_request_type=ajax`  —— 按策略上传，返回 fileid
+ *
+ * 策略有三：`second`（秒传，服务端已有同 MD5 文件）、`common`（一次传完）、`chunk`（分片）。
+ *
+ * 逻辑与 `@weaver/reception-cli@0.7.1` 的 `lib/upload.js` 一致；与 `caizhilian` 的
+ * `file-upload/protocol.ts` 同源（那边为了大文件走流式 multipart，这里文件小，用 FormData）。
+ */
+import { createHash } from 'node:crypto';
+import { readFile, stat } from 'node:fs/promises';
+import { basename } from 'node:path';
+/** 上传协议层错误：`subtype` 直接进 CLI 的 error.subtype，便于按码排障。 */
+export class UploadProtocolError extends Error {
+    subtype;
+    httpStatus;
+    detail;
+    contentType;
+    constructor(subtype, message, httpStatus, detail, contentType) {
+        super(message);
+        this.subtype = subtype;
+        this.httpStatus = httpStatus;
+        this.detail = detail;
+        this.contentType = contentType;
+        this.name = 'UploadProtocolError';
+    }
+}
+const object = (value) => (value && typeof value === 'object' && !Array.isArray(value) ? value : {});
+const hasKeys = (value) => Object.keys(value).length > 0;
+/** 判定响应是否表示成功，返回可用的 data 节点。 */
+function checkedData(response) {
+    const contentType = response.headers?.get?.('content-type') || '';
+    const text = String(response.text || '');
+    const isHtml = /text\/html/i.test(contentType) || /^\s*<!DOCTYPE\s+html|^\s*<html[\s>]/i.test(text);
+    if (response.status !== 200) {
+        throw new UploadProtocolError(response.status === 401 ? 'upload_auth_expired' : 'upload_http_error', response.status === 401 ? '登录已失效，请在原登录工具中恢复后再试' : `文件服务 HTTP ${response.status}`, response.status, text.slice(0, 300) || undefined, contentType || undefined);
+    }
+    if (isHtml) {
+        throw new UploadProtocolError('upload_response_html', '文件服务返回了 HTML 页面（通常是登录页或错误页）', response.status, text.slice(0, 300), contentType);
+    }
+    const envelope = object(response.value);
+    const data = envelope.data === undefined ? envelope : object(envelope.data);
+    if (!hasKeys(data)) {
+        throw new UploadProtocolError('upload_response_invalid', '文件服务响应缺少数据对象', response.status, text.slice(0, 300) || undefined, contentType || undefined);
+    }
+    for (const record of [
+        envelope,
+        data,
+        object(data.fileObj),
+        object(data.uploadModuleDto),
+        object(data.imUploadInfoDto),
+        object(object(data.uploadModuleDto).fileObj),
+        object(object(data.imUploadInfoDto).fileObj),
+    ]) {
+        if (!hasKeys(record))
+            continue;
+        const flag = (value, literal) => value === literal || String(value).toLowerCase() === String(literal);
+        const code = record.code == null ? '' : String(record.code).toLowerCase();
+        if (flag(record.status, false)
+            || flag(record.success, false)
+            || flag(record.fail, true)
+            || (code && !['0', '200', 'success'].includes(code))) {
+            throw new UploadProtocolError('upload_business_failed', String(record.msg || record.message || '文件服务未确认操作成功'), response.status, text.slice(0, 300), contentType);
+        }
+    }
+    return data;
+}
+/**
+ * 在响应里找文件记录。
+ * 不同模块的上传接口把 fileid 放在不同层级：顶层、`fileObj`、`uploadModuleDto`、`imUploadInfoDto`。
+ * `sizes` 收齐各层的 size，用于交叉校验服务端是否真的收全了。
+ */
+function fileRecord(data) {
+    const candidates = [
+        [data, undefined],
+        [object(data.fileObj), data],
+        [object(data.uploadModuleDto), data],
+        [object(object(data.uploadModuleDto).fileObj), object(data.uploadModuleDto)],
+        [object(data.imUploadInfoDto), data],
+        [object(object(data.imUploadInfoDto).fileObj), object(data.imUploadInfoDto)],
+    ];
+    let result;
+    for (const [record, parent] of candidates) {
+        if (!hasKeys(record))
+            continue;
+        if (record.fileId && record.fileid && String(record.fileId) !== String(record.fileid)) {
+            throw new UploadProtocolError('upload_file_id_conflict', '文件服务返回冲突的文件 ID');
+        }
+        const id = record.fileId ?? record.fileid;
+        if (id === undefined || id === null || id === '')
+            continue;
+        if ((typeof id !== 'string' && typeof id !== 'number')
+            || (typeof id === 'number' && (!Number.isSafeInteger(id) || id <= 0))) {
+            throw new UploadProtocolError('upload_file_id_invalid', '文件服务返回无效文件 ID');
+        }
+        const text = String(id).trim();
+        if (!text || text === '0')
+            continue;
+        if (result && result.id !== text) {
+            throw new UploadProtocolError('upload_file_id_conflict', '文件服务返回冲突的文件 ID');
+        }
+        result ??= { id: text, sizes: [] };
+        result.sizes.push(record.size, parent?.size, data.size);
+    }
+    return result;
+}
+/** 取「已完成」的文件 ID，并校验服务端报告的文件大小。 */
+function terminal(data, expectedSize) {
+    const record = fileRecord(data);
+    if (!record || data.endChunk === false || data.endChunk === 'false') {
+        throw new UploadProtocolError('upload_not_terminal', '上传未返回已完成的文件 ID');
+    }
+    for (const value of record.sizes) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        const size = Number(value);
+        if (!Number.isSafeInteger(size) || size < 0 || (size !== 0 && size !== expectedSize)) {
+            throw new UploadProtocolError('upload_size_mismatch', `服务端文件大小与本地不一致（服务端 ${value}，本地 ${expectedSize}）`);
+        }
+    }
+    return record.id;
+}
+/** 发一次 multipart 并判定成功，返回 data 节点。 */
+async function send(transport, path, fields, file) {
+    const form = new FormData();
+    for (const [key, value] of Object.entries(fields))
+        form.append(key, value);
+    if (file) {
+        form.append('file', new Blob([new Uint8Array(file.buffer.subarray(file.start, file.start + file.size))]), `e10upload.${file.ext}`);
+    }
+    return checkedData(await transport.post(path, form));
+}
+/**
+ * 走完三阶段上传，返回 fileid。
+ * 失败一律抛 `UploadProtocolError`，由调用方转成 CLI 的 error/warning。
+ */
+export async function uploadToFileService(input) {
+    const buffer = await readFile(input.filePath);
+    const info = await stat(input.filePath);
+    const name = input.name || basename(input.filePath);
+    const ext = (name.match(/\.([^.]+)$/) || [, 'bin'])[1].toLowerCase();
+    const lastModified = String(Math.floor(info.mtimeMs));
+    const fields = {
+        compressImg: 'false',
+        name,
+        size: String(buffer.length),
+        module: input.module,
+        MD5: createHash('md5').update(buffer).digest('hex'),
+        lastModified,
+        lastModifiedDate: lastModified,
+    };
+    if (input.userId)
+        fields.userid = String(input.userId);
+    // 1) 身份校验：确认服务端认到的用户与会话一致，否则后续上传会以匿名身份落盘
+    const identity = await send(input.transport, '/api/baseserver/layout/teamsCheck', {});
+    const employeeId = object(identity.currentUser).employeeId;
+    const employeeText = employeeId === undefined || employeeId === null ? '' : String(employeeId).trim();
+    if (!employeeText) {
+        throw new UploadProtocolError('upload_identity_missing', '身份校验未返回 employeeId，无法确认上传身份');
+    }
+    if (input.userId && employeeText !== String(input.userId).trim()) {
+        throw new UploadProtocolError('upload_identity_mismatch', `会话用户（${input.userId}）与文件服务认到的用户（${employeeText}）不一致，请重新登录`);
+    }
+    // 2) 预检：拿上传策略
+    const pre = await send(input.transport, '/api/file/preUploadCheck?sf_request_type=ajax', fields);
+    const type = String(pre.uploadType || '');
+    if (!['second', 'common', 'chunk'].includes(type)) {
+        throw new UploadProtocolError('upload_type_invalid', `文件服务返回未知上传策略：${type || '(空)'}`);
+    }
+    // 3) 秒传：服务端已有同 MD5 文件，预检响应里直接带 fileid
+    if (type === 'second') {
+        return { fileid: terminal(pre, buffer.length), name, size: buffer.length, kind: ext };
+    }
+    const preUploadId = String(pre.preUploadId ?? '').trim();
+    if (!preUploadId || preUploadId === '0') {
+        throw new UploadProtocolError('upload_precheck_invalid', '预检未返回有效 preUploadId');
+    }
+    const uploadFields = { ...fields, preUploadId, uploadType: type };
+    // 4) 直传：一次把整个文件发完
+    if (type === 'common') {
+        const data = await send(input.transport, '/api/file/module/upload?sf_request_type=ajax', uploadFields, {
+            name, ext, buffer, start: 0, size: buffer.length,
+        });
+        return { fileid: terminal(data, buffer.length), name, size: buffer.length, kind: ext };
+    }
+    // 5) 分片：按服务端给的 MiB 大小切片，逐片上报
+    const chunkMiB = Number(pre.chunkDto?.chunkSize);
+    if (!Number.isSafeInteger(chunkMiB) || chunkMiB <= 0 || buffer.length <= 0) {
+        throw new UploadProtocolError('upload_chunk_size_invalid', '分片上传要求非空文件与正整数 MiB 分片大小');
+    }
+    const chunkSize = chunkMiB * 1024 * 1024;
+    const count = Math.max(1, Math.ceil(buffer.length / chunkSize));
+    if (pre.chunkDto?.chunkCount !== undefined && Number(pre.chunkDto.chunkCount) !== count) {
+        throw new UploadProtocolError('upload_chunk_count_mismatch', `服务端分片数（${pre.chunkDto.chunkCount}）与本地计算（${count}）不一致`);
+    }
+    let fileid = '';
+    for (let index = 0; index < count; index += 1) {
+        const start = index * chunkSize;
+        const size = Math.min(chunkSize, buffer.length - start);
+        const data = await send(input.transport, '/api/file/module/upload?sf_request_type=ajax', { ...uploadFields, chunk: String(index), chunks: String(count), uploadShardSize: String(size) }, { name, ext, buffer, start, size });
+        if (index === count - 1) {
+            fileid = terminal(data, buffer.length);
+        }
+        else if (data.endChunk !== false || fileRecord(data)) {
+            // 中间分片必须有明确的「未完成」标记，且不能提前返回 fileid，否则说明服务端行为异常
+            throw new UploadProtocolError('upload_chunk_terminal_early', '中间分片缺少未完成标记或提前返回了文件 ID');
+        }
+    }
+    if (!fileid)
+        throw new UploadProtocolError('upload_not_terminal', '分片上传未确认完成');
+    return { fileid, name, size: buffer.length, kind: ext };
+}