weaver-work-cli 0.1.8 → 0.1.20

package/dist/core/refs.js

@@ -0,0 +1,432 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { appendFileSync, chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmdirSync, statSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { CliError, ExitCode } from './errors.js';
+import { refsDir, refsIndexPath } from './state.js';
+/**
+ * 结果引用（result reference）：把超过 stdout 预算的完整结果落到 CLI state 目录，
+ * stdout 只回一个短句柄，下游用 `--input-ref <refId>` 取回。
+ *
+ * 全部使用同步 fs API：CLI 是一次一进程的模型，同步写盘既无竞态，也能保持
+ * `Output.write()` 的同步签名不变（41 处调用点无需改）。
+ *
+ * Windows 兼容要点：
+ * - refId 只含 `[a-z0-9-]`，绝不含 `:` `*` `?` `" `<` `>` `|`（时间戳用 YYYYMMDD-HHMMSS）；
+ * - 不使用 `chmod`（Windows 无 POSIX 权限语义）；
+ * - 删除失败（ENOENT / EPERM / EBUSY，文件被占用）一律忽略，留给下次 GC；
+ * - 原子写用「临时文件 + rename」，rename 失败时回退为直接写。
+ */
+export const REF_SCHEMA_VERSION = 1;
+export class RefError extends CliError {
+    type = 'policy';
+    subtype;
+    retryable = false;
+    constructor(subtype, message, exitCode = ExitCode.UsageError) {
+        super(message, exitCode);
+        this.name = 'RefError';
+        this.subtype = subtype;
+    }
+}
+function slug(value) {
+    return value
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 40);
+}
+function pad(value) {
+    return String(value).padStart(2, '0');
+}
+/** 生成 Windows 安全的文件名片段：`20260922-105401-invoice-list-a1b2c3`。 */
+export function refIdFor(operation, now = new Date()) {
+    const stamp = `${now.getFullYear()}${pad(now.getMonth() + 1)}${pad(now.getDate())}`
+        + `-${pad(now.getHours())}${pad(now.getMinutes())}${pad(now.getSeconds())}`;
+    const name = operation ? slug(operation) : 'result';
+    return `${stamp}-${name || 'result'}-${randomBytes(8).toString('hex')}`;
+}
+function dateDirOf(now) {
+    return `${now.getFullYear()}-${pad(now.getMonth() + 1)}-${pad(now.getDate())}`;
+}
+function sha256Of(value) {
+    return createHash('sha256').update(value, 'utf8').digest('hex');
+}
+function ensureDir(dir) {
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // POSIX permissions are enforced here. On Windows, the directory inherits
+    // the current user's profile ACL; chmod has different semantics there.
+    if (process.platform !== 'win32') {
+        chmodSync(dir, 0o700);
+    }
+}
+function ensurePrivateFile(file) {
+    if (process.platform !== 'win32') {
+        chmodSync(file, 0o600);
+    }
+}
+function isInsideRefs(ctx, file) {
+    const root = resolve(refsDir(ctx));
+    const absolute = resolve(file);
+    const isChild = (parent, candidate) => {
+        const relativePath = relative(parent, candidate);
+        return relativePath !== ''
+            && relativePath !== '..'
+            && !relativePath.startsWith(`..${sep}`)
+            && !isAbsolute(relativePath);
+    };
+    if (!isChild(root, absolute))
+        return false;
+    try {
+        return isChild(realpathSync(root), realpathSync(absolute));
+    }
+    catch {
+        return false;
+    }
+}
+/** 原子写：临时文件 + rename；Windows 上 rename 失败（占用/权限）回退直接写。 */
+function atomicWriteSync(file, data) {
+    const tmp = `${file}.${randomBytes(8).toString('hex')}.tmp`;
+    writeFileSync(tmp, data, { encoding: 'utf8', mode: 0o600, flag: 'wx' });
+    try {
+        renameSync(tmp, file);
+        ensurePrivateFile(file);
+    }
+    catch {
+        writeFileSync(file, data, { encoding: 'utf8', mode: 0o600 });
+        ensurePrivateFile(file);
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* Windows 下 tmp 可能已被占用，忽略 */
+        }
+    }
+}
+/** 删除失败一律忽略：ENOENT（已删）/ EPERM / EBUSY（Windows 文件占用）都留给下次 GC。 */
+function silentUnlink(file) {
+    try {
+        unlinkSync(file);
+        return true;
+    }
+    catch (error) {
+        return Boolean(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT');
+    }
+}
+function readIndex(ctx) {
+    const path = refsIndexPath(ctx);
+    if (!existsSync(path))
+        return [];
+    const rows = [];
+    for (const line of readFileSync(path, 'utf8').split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const parsed = JSON.parse(trimmed);
+            if (parsed
+                && typeof parsed.refId === 'string'
+                && typeof parsed.file === 'string'
+                && typeof parsed.bytes === 'number'
+                && Number.isFinite(parsed.bytes)
+                && parsed.bytes >= 0
+                && typeof parsed.sha256 === 'string'
+                && /^[a-f0-9]{64}$/u.test(parsed.sha256)
+                && isInsideRefs(ctx, parsed.file))
+                rows.push({ ...parsed, file: resolve(parsed.file) });
+        }
+        catch {
+            /* 索引行损坏则跳过，不因一行坏数据毁掉全部 */
+        }
+    }
+    return rows;
+}
+function writeIndex(ctx, rows) {
+    ensureDir(refsDir(ctx));
+    const data = rows.map((row) => JSON.stringify(row)).join('\n');
+    atomicWriteSync(refsIndexPath(ctx), rows.length ? `${data}\n` : '');
+}
+function appendIndex(ctx, meta) {
+    ensureDir(refsDir(ctx));
+    try {
+        appendFileSync(refsIndexPath(ctx), `${JSON.stringify(meta)}\n`, { encoding: 'utf8', mode: 0o600 });
+        ensurePrivateFile(refsIndexPath(ctx));
+    }
+    catch {
+        // 追加失败（索引被占用）不阻塞主流程，ref 文件本身已写好；索引缺失仍可通过目录扫描找回。
+    }
+}
+function scanFiles(ctx) {
+    const root = refsDir(ctx);
+    if (!existsSync(root))
+        return [];
+    const files = [];
+    for (const entry of readdirSync(root, { withFileTypes: true })) {
+        if (!entry.isDirectory())
+            continue;
+        const dir = join(root, entry.name);
+        for (const inner of readdirSync(dir, { withFileTypes: true })) {
+            if (inner.isFile() && inner.name.endsWith('.json'))
+                files.push(join(dir, inner.name));
+        }
+    }
+    return files;
+}
+function metaFromFile(file) {
+    try {
+        const parsed = JSON.parse(readFileSync(file, 'utf8'));
+        if (!parsed || typeof parsed.refId !== 'string')
+            return null;
+        return {
+            refId: parsed.refId,
+            ...(parsed.operation ? { operation: parsed.operation } : {}),
+            file,
+            bytes: statSync(file).size,
+            sha256: sha256Of(JSON.stringify(parsed.envelope ?? null, null, 2)),
+            createdAt: parsed.createdAt,
+            expiresAt: parsed.expiresAt,
+            ttlMs: typeof parsed.ttlMs === 'number' ? parsed.ttlMs : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function findMeta(ctx, refId) {
+    const fromIndex = readIndex(ctx).find((row) => row.refId === refId);
+    if (fromIndex)
+        return fromIndex;
+    // 索引丢失时回退到目录扫描，保证 ref 仍可用。
+    for (const file of scanFiles(ctx)) {
+        if (basename(file, '.json') === refId) {
+            const meta = metaFromFile(file);
+            if (meta)
+                return meta;
+        }
+    }
+    return null;
+}
+export function defaultTtlMs() {
+    return 30 * 60_000;
+}
+export function writeRef(ctx, options) {
+    const now = options.now ?? new Date();
+    const ttlMs = options.ttlMs ?? defaultTtlMs();
+    const refId = refIdFor(options.operation, now);
+    const dir = join(refsDir(ctx), dateDirOf(now));
+    ensureDir(dir);
+    const file = join(dir, `${refId}.json`);
+    const payload = {
+        schemaVersion: REF_SCHEMA_VERSION,
+        refId,
+        ...(options.operation ? { operation: options.operation } : {}),
+        createdAt: now.toISOString(),
+        expiresAt: new Date(now.getTime() + ttlMs).toISOString(),
+        ttlMs,
+        envelope: options.value ?? null,
+    };
+    const fileContents = JSON.stringify(payload, null, 2);
+    atomicWriteSync(file, fileContents);
+    const meta = {
+        refId,
+        ...(options.operation ? { operation: options.operation } : {}),
+        file,
+        bytes: Buffer.byteLength(fileContents, 'utf8'),
+        sha256: sha256Of(JSON.stringify(options.value ?? null, null, 2)),
+        createdAt: payload.createdAt,
+        expiresAt: payload.expiresAt,
+        ttlMs,
+    };
+    appendIndex(ctx, meta);
+    return meta;
+}
+export function readRef(ctx, refId) {
+    const meta = findMeta(ctx, refId);
+    if (!meta || !isInsideRefs(ctx, meta.file) || !existsSync(meta.file)) {
+        throw new RefError('ref_missing', `未找到结果引用：${refId}`);
+    }
+    try {
+        if (!lstatSync(meta.file).isFile()) {
+            throw new RefError('ref_corrupt', `结果引用不是普通文件：${refId}`, ExitCode.PolicyError);
+        }
+    }
+    catch (error) {
+        if (error instanceof RefError)
+            throw error;
+        throw new RefError('ref_missing', `未找到结果引用：${refId}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(meta.file, 'utf8'));
+    }
+    catch {
+        throw new RefError('ref_corrupt', `结果引用文件损坏：${refId}`, ExitCode.PolicyError);
+    }
+    if (parsed.schemaVersion !== REF_SCHEMA_VERSION
+        || parsed.refId !== refId
+        || typeof parsed.createdAt !== 'string'
+        || typeof parsed.expiresAt !== 'string'
+        || !Number.isFinite(Date.parse(parsed.createdAt))
+        || !Number.isFinite(Date.parse(parsed.expiresAt))
+        || parsed.createdAt !== meta.createdAt
+        || parsed.expiresAt !== meta.expiresAt
+        || parsed.ttlMs !== meta.ttlMs) {
+        throw new RefError('ref_corrupt', `结果引用元数据不匹配：${refId}`, ExitCode.PolicyError);
+    }
+    const expiresAt = Date.parse(parsed.expiresAt);
+    if (expiresAt < Date.now()) {
+        silentUnlink(meta.file);
+        writeIndex(ctx, readIndex(ctx).filter((row) => row.refId !== refId));
+        throw new RefError('ref_expired', `结果引用已过期：${refId}`, ExitCode.PolicyError);
+    }
+    const serialized = JSON.stringify(parsed.envelope ?? null, null, 2);
+    if (sha256Of(serialized) !== meta.sha256) {
+        throw new RefError('ref_corrupt', `结果引用校验失败：${refId}`, ExitCode.PolicyError);
+    }
+    return { meta, envelope: parsed.envelope };
+}
+export function listRefs(ctx) {
+    const seen = new Set();
+    const rows = [];
+    for (const row of readIndex(ctx)) {
+        if (seen.has(row.refId) || !existsSync(row.file))
+            continue;
+        seen.add(row.refId);
+        rows.push(row);
+    }
+    for (const file of scanFiles(ctx)) {
+        const id = basename(file, '.json');
+        if (seen.has(id))
+            continue;
+        const meta = metaFromFile(file);
+        if (meta) {
+            seen.add(id);
+            rows.push(meta);
+        }
+    }
+    return rows.sort((a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt));
+}
+/** 惰性 GC：过期优先，其次按数量与总字节上限淘汰最旧的。 */
+export function pruneRefs(ctx, options = {}) {
+    const maxCount = options.maxCount ?? 50;
+    const maxBytes = options.maxBytes ?? 200 * 1024 * 1024;
+    const preserved = new Set(options.preserveRefIds ?? []);
+    const rows = listRefs(ctx);
+    const now = Date.now();
+    const expired = [];
+    const alive = [];
+    const ageCutoff = options.olderThanMs === undefined ? undefined : now - options.olderThanMs;
+    for (const row of rows) {
+        const at = Date.parse(row.expiresAt);
+        const created = Date.parse(row.createdAt);
+        const tooOld = ageCutoff !== undefined && Number.isFinite(created) && created <= ageCutoff;
+        if (((Number.isFinite(at) && at < now) || tooOld) && !preserved.has(row.refId))
+            expired.push(row);
+        else
+            alive.push(row);
+    }
+    // Keep protected and newest refs first; remove old unprotected entries to
+    // satisfy count/byte limits without deleting the result just produced.
+    const byAge = [...alive].sort((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
+    const victims = new Set(expired.map((row) => row.refId));
+    const protectedRows = byAge.filter((row) => preserved.has(row.refId));
+    const candidates = byAge.filter((row) => !preserved.has(row.refId));
+    const allowedCandidates = Math.max(0, Math.floor(maxCount) - protectedRows.length);
+    if (candidates.length > allowedCandidates) {
+        for (const row of candidates.slice(0, candidates.length - allowedCandidates))
+            victims.add(row.refId);
+    }
+    let total = byAge.filter((row) => !victims.has(row.refId)).reduce((sum, row) => sum + row.bytes, 0);
+    if (total > maxBytes) {
+        for (const row of candidates) {
+            if (total <= maxBytes)
+                break;
+            if (victims.has(row.refId))
+                continue;
+            victims.add(row.refId);
+            total -= row.bytes;
+        }
+    }
+    let cleanupIncomplete = false;
+    for (const row of rows) {
+        if (!victims.has(row.refId))
+            continue;
+        if (!silentUnlink(row.file))
+            cleanupIncomplete = true;
+        // 目录空了顺手清掉日期目录，Windows 上失败也无所谓。
+        try {
+            rmdirSync(dirname(row.file));
+        }
+        catch {
+            /* 目录非空或占用，忽略 */
+        }
+    }
+    const kept = rows.filter((row) => !victims.has(row.refId));
+    if (rows.length > 0 || existsSync(refsIndexPath(ctx)))
+        writeIndex(ctx, kept);
+    const keptBytes = kept.reduce((sum, row) => sum + row.bytes, 0);
+    return {
+        removed: victims.size,
+        kept: kept.length,
+        bytes: keptBytes,
+        overLimit: cleanupIncomplete || kept.length > maxCount || keptBytes > maxBytes,
+        cleanupIncomplete,
+    };
+}
+/** 轻量 JSON 路径取值，支持 `a.b[0].c`、`$.data.items[0].fid`，并允许省略 `data.` 前缀。 */
+export function pickValue(value, path) {
+    let cursor = value;
+    for (const token of tokenizePath(path)) {
+        if (cursor === null || cursor === undefined) {
+            throw new RefError('ref_pick_failed', `--pick 路径 ${path} 在 ${token} 处无法继续`);
+        }
+        if (typeof token === 'number') {
+            if (!Array.isArray(cursor)) {
+                throw new RefError('ref_pick_failed', `--pick 路径 ${path} 的 ${token} 不是数组下标可访问的值`);
+            }
+            cursor = cursor[token];
+            continue;
+        }
+        if (typeof cursor !== 'object') {
+            throw new RefError('ref_pick_failed', `--pick 路径 ${path} 无法从非对象中取字段 ${token}`);
+        }
+        const holder = cursor;
+        if (!(token in holder)) {
+            throw new RefError('ref_pick_failed', `--pick 路径 ${path} 中不存在字段 ${token}`);
+        }
+        cursor = holder[token];
+    }
+    return cursor;
+}
+function tokenizePath(path) {
+    let cursor = path.trim().replace(/^\$/, '').replace(/^data\./, '');
+    const tokens = [];
+    const pattern = /([^.[\]]+)|\[(\d+)\]/g;
+    let match;
+    while ((match = pattern.exec(cursor)) !== null) {
+        if (match[1] !== undefined)
+            tokens.push(match[1]);
+        else
+            tokens.push(Number(match[2]));
+    }
+    if (!tokens.length) {
+        throw new RefError('ref_pick_failed', `无法解析 --pick 路径：${path}`);
+    }
+    return tokens;
+}
+/** 把 `--input-ref` 解析成可直接作为 operation 入参的对象。 */
+export function resolveRefInput(ctx, options) {
+    const { envelope } = readRef(ctx, options.refId);
+    const data = envelope && typeof envelope === 'object' && !Array.isArray(envelope) && 'data' in envelope
+        ? envelope.data
+        : envelope;
+    const target = options.pick ? pickValue(data, options.pick) : data;
+    if (target && typeof target === 'object' && !Array.isArray(target)) {
+        if (options.pickAs) {
+            throw new RefError('ref_pick_as_object', '--pick-as 只用于把单个值映射到输入字段；当前选择结果已经是对象');
+        }
+        return target;
+    }
+    if (!options.pickAs || !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(options.pickAs)) {
+        throw new RefError('ref_pick_scalar_requires_key', '选择结果是单个值；请加 --pick-as <输入字段名>，例如 --pick items[0].fid --pick-as fid');
+    }
+    return { [options.pickAs]: target ?? null };
+}

package/dist/core/state.js

@@ -0,0 +1,26 @@
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+export function stateRoot(ctx) {
+    const home = process.env.WEAVER_WORK_CLI_HOME
+        || process.env.WORK_CLI_HOME
+        || resolve(homedir(), '.weaver-work-cli');
+    // --config may point into a repository or shared directory. Keep transient
+    // business results in the CLI home instead of beside an arbitrary config.
+    if (ctx?.getGlobalOptions?.().config)
+        return resolve(home);
+    // The normal config path is rooted in the CLI home; retaining this fallback
+    // also supports isolated/test contexts that supply their own config store.
+    const configured = ctx?.config?.path?.();
+    if (configured)
+        return dirname(resolve(configured));
+    return resolve(home);
+}
+export function stateDir(ctx) {
+    return join(stateRoot(ctx), 'state');
+}
+export function refsDir(ctx) {
+    return join(stateDir(ctx), 'refs');
+}
+export function refsIndexPath(ctx) {
+    return join(refsDir(ctx), 'index.jsonl');
+}

package/dist/internal/e10/auth/commands.js

@@ -2,7 +2,7 @@ import { execFile } from 'node:child_process';
 import { createServer } from 'node:http';
 import { CliError, ExitCode } from '../../../core/errors.js';
 import { clearInvoiceTokenForSession } from '../../../shortcuts/invoice/host.js';
-import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, } from './session.js';
+import { buildE10CookieHeader, E10AuthSession, clearProfileAuthFile, extractRawSetCookie, findAuthFile, getActiveProfile, getProfileAuthPath, getProfileDir, listProfiles, profileNameFromUrl, readProfileConfig, readTeamsCheckUserInfo, saveAuthFile, saveProfileConfig, setActiveProfile, switchActiveProfile, } from './session.js';
 import { getE10AuthRoot } from './paths.js';
 import { XIAOE_AGENT_TYPE, hasXiaoEEnv, resolveXiaoEPreferredBaseUrl, tryXiaoEUnifiedLogin as tryXiaoEUnifiedSessionLogin, } from './xiaoe.js';
 export { DEFAULT_E10_BASE_URL, XIAOE_AGENT_TYPE, hasXiaoEEnv, hasXiaoETokenScript, resolveXiaoEDefaultBaseUrl, resolveXiaoEPreferredBaseUrl, resolveXiaoEUnifiedLoginCredential, } from './xiaoe.js';
@@ -718,7 +718,7 @@ export function registerE10AuthCommands(parent, action) {
         .action(action((ctx, name) => {
         if (typeof name !== 'string')
             throw new CliError('profile name must be a string', ExitCode.UsageError);
-        setActiveProfile(name);
+        switchActiveProfile(name);
         const result = {
             active: name,
             dir: getProfileDir(name),

package/dist/internal/e10/auth/session.js

@@ -2,6 +2,7 @@ import { constants, createDecipheriv, createHash, publicEncrypt } from 'node:cry
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync } from 'node:fs';
 import { dirname, resolve } from 'node:path';
 import { CliError, ExitCode } from '../../../core/errors.js';
+import { isConnectorMode } from '../../../core/connector.js';
 import { writeWithRetry } from '../../../core/write-with-retry.js';
 import { encryptAuthData, parseAuthFile } from './crypto.js';
 import { getE10ActiveProfilePath, getE10ProfilesRoot } from './paths.js';
@@ -58,7 +59,20 @@ export function getActiveProfile() {
     }
     return 'default';
 }
+/**
+ * 写活跃 profile 指针（并确保该 profile 目录存在）。
+ *
+ * 连接器模式（全局参数 `--is-connector`）下**直接跳过**：连接器授权只新增自己的
+ * `profiles/<CONNECTOR_PROFILE>/` 凭据，绝不改动用户既有的活跃 profile 选择。
+ * 需要无条件切换（`auth profile use` 这类显式操作）请用 `switchActiveProfile`。
+ */
 export function setActiveProfile(name) {
+    if (isConnectorMode())
+        return;
+    switchActiveProfile(name);
+}
+/** 无条件写活跃 profile 指针，用于 `auth profile use` 等显式切换场景。 */
+export function switchActiveProfile(name) {
     mkdirSync(getE10ProfilesRoot(), { recursive: true });
     mkdirSync(resolve(getE10ProfilesRoot(), name), { recursive: true });
     writeWithRetry(getE10ActiveProfilePath(), name, 'utf-8');