hap-cli 0.8.10__tar.gz → 0.8.12__tar.gz

{hap_cli-0.8.10 → hap_cli-0.8.12}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.10
-Summary: CLI harness for MingDAO HAP - Enterprise no-code platform
+Version: 0.8.12
+Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0
 Classifier: Development Status :: 3 - Alpha
@@ -29,7 +29,7 @@ Dynamic: summary
 
 # hap-cli
 
-CLI harness for **MingDAO HAP** (明道云) — an enterprise no-code platform.
+CLI harness for **Mingdao HAP** (明道云) — an enterprise no-code platform.
 
 ## Installation
 
@@ -54,7 +54,7 @@ each organization's status (`CLI:on/off`).
 ### 1. Login
 
 ```bash
-# MingDAO SaaS (default)
+# Mingdao SaaS (default)
 hap auth login
 
 # Specific environment
@@ -66,7 +66,7 @@ hap auth login https://hap.example.com       # self-hosted
 hap auth login https://your-server.com --token YOUR_TOKEN
 ```
 
-The browser flow opens the MingDAO login page and captures the token. If the
+The browser flow opens the Mingdao login page and captures the token. If the
 callback can't reach the CLI (no GUI, restricted network), interrupt the
 command — it falls back to a paste prompt for the token shown on the success
 page.
@@ -78,7 +78,7 @@ hap auth logout        # log out the current account
 
 #### Multiple environments / accounts
 
-You can stay logged in to several environments (MingDAO SaaS, Nocoly, self-hosted) and
+You can stay logged in to several environments (Mingdao SaaS, Nocoly, self-hosted) and
 several accounts at once. Each is saved under a name and you switch between them:
 
 ```bash

{hap_cli-0.8.10/hap_cli → hap_cli-0.8.12}/README.md

@@ -1,6 +1,6 @@
 # hap-cli
 
-CLI harness for **MingDAO HAP** (明道云) — an enterprise no-code platform.
+CLI harness for **Mingdao HAP** (明道云) — an enterprise no-code platform.
 
 ## Installation
 
@@ -25,7 +25,7 @@ each organization's status (`CLI:on/off`).
 ### 1. Login
 
 ```bash
-# MingDAO SaaS (default)
+# Mingdao SaaS (default)
 hap auth login
 
 # Specific environment
@@ -37,7 +37,7 @@ hap auth login https://hap.example.com       # self-hosted
 hap auth login https://your-server.com --token YOUR_TOKEN
 ```
 
-The browser flow opens the MingDAO login page and captures the token. If the
+The browser flow opens the Mingdao login page and captures the token. If the
 callback can't reach the CLI (no GUI, restricted network), interrupt the
 command — it falls back to a paste prompt for the token shown on the success
 page.
@@ -49,7 +49,7 @@ hap auth logout        # log out the current account
 
 #### Multiple environments / accounts
 
-You can stay logged in to several environments (MingDAO SaaS, Nocoly, self-hosted) and
+You can stay logged in to several environments (Mingdao SaaS, Nocoly, self-hosted) and
 several accounts at once. Each is saved under a name and you switch between them:
 
 ```bash

{hap_cli-0.8.10 → hap_cli-0.8.12/hap_cli}/README.md

@@ -1,6 +1,6 @@
 # hap-cli
 
-CLI harness for **MingDAO HAP** (明道云) — an enterprise no-code platform.
+CLI harness for **Mingdao HAP** (明道云) — an enterprise no-code platform.
 
 ## Installation
 
@@ -25,7 +25,7 @@ each organization's status (`CLI:on/off`).
 ### 1. Login
 
 ```bash
-# MingDAO SaaS (default)
+# Mingdao SaaS (default)
 hap auth login
 
 # Specific environment
@@ -37,7 +37,7 @@ hap auth login https://hap.example.com       # self-hosted
 hap auth login https://your-server.com --token YOUR_TOKEN
 ```
 
-The browser flow opens the MingDAO login page and captures the token. If the
+The browser flow opens the Mingdao login page and captures the token. If the
 callback can't reach the CLI (no GUI, restricted network), interrupt the
 command — it falls back to a paste prompt for the token shown on the success
 page.
@@ -49,7 +49,7 @@ hap auth logout        # log out the current account
 
 #### Multiple environments / accounts
 
-You can stay logged in to several environments (MingDAO SaaS, Nocoly, self-hosted) and
+You can stay logged in to several environments (Mingdao SaaS, Nocoly, self-hosted) and
 several accounts at once. Each is saved under a name and you switch between them:
 
 ```bash

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/README_CN.md

@@ -40,7 +40,7 @@ hap auth logout        # 登出当前账号
 
 #### 多环境 / 多账号
 
-可同时授权多个环境（MingDAO SaaS、Nocoly、私有部署）与多个账号，各存成一个具名档案，长期共存、随时切换：
+可同时授权多个环境（Mingdao SaaS、Nocoly、私有部署）与多个账号，各存成一个具名档案，长期共存、随时切换：
 
 ```bash
 hap auth login mingdao --profile work-prod        # 登录并起名保存

hap_cli-0.8.12/hap_cli/__init__.py

@@ -0,0 +1,3 @@
+"""CLI harness for Mingdao HAP (hap-cli)."""
+
+__version__ = "0.8.12"

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/commands/auth_cmd.py

@@ -378,7 +378,7 @@ def auth_whoami(ctx):
         # Read login_url from the active (or --profile) credential profile —
         # the in-memory Session may have been mutated, and we want whoami to
         # probe the server recorded for the profile in use. When the profile
-        # has no URL, fall back to the MingDAO SaaS host. Token failures
+        # has no URL, fall back to the Mingdao SaaS host. Token failures
         # (missing / expired) surface uniformly via AuthenticationError
         # → "Not logged in" hint from handle_error.
         profile_name = resolve_profile_name(ctx.profile)

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/commands/chart_cmd.py

@@ -21,7 +21,7 @@ def chart():
     pass
 
 
-# Report-type enum values used by the MingDAO statistics module. The CLI
+# Report-type enum values used by the Mingdao statistics module. The CLI
 # accepts the integer directly so users can pass uncommon types without us
 # having to enumerate every one. Note: there is NO type 4 — passing 4 is
 # coerced to 10 (number) by the server, so it is omitted here (bug #036584).

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/commands/role_cmd.py

@@ -208,6 +208,52 @@ def role_set_permissions(ctx, app_id, role_id, permissions, permission_way):
         ctx.handle_error(e)
 
 
+@role.command("set-chatbots")
+@click.argument("app_id")
+@click.argument("role_id")
+@click.option("--enable-all", is_flag=True,
+              help="Grant this role access to every AI assistant in the app.")
+@click.option("--disable-all", is_flag=True,
+              help="Remove this role's access to every AI assistant in the app.")
+@click.option("--chatbots-json", default="",
+              help='Per-assistant access as a JSON array, e.g. '
+                   '[{"id":"<assistant-id>","enable":true}].')
+@pass_context
+def role_set_chatbots(ctx, app_id, role_id, enable_all, disable_all, chatbots_json):
+    """Set which AI assistants a role can access.
+
+    A newly created fine-grained role has no AI-assistant access until it
+    is granted here. Provide exactly one of --enable-all, --disable-all,
+    or --chatbots-json.
+    """
+    try:
+        chosen = sum(bool(x) for x in (enable_all, disable_all, chatbots_json))
+        if chosen != 1:
+            raise click.UsageError(
+                "Provide exactly one of --enable-all, --disable-all, "
+                "or --chatbots-json."
+            )
+        session = ctx.get_session()
+        enables = None
+        default = None
+        if enable_all:
+            default = True
+        elif disable_all:
+            default = False
+        else:
+            entries = json.loads(chatbots_json)
+            enables = {
+                e["id"]: bool(e.get("enable", True))
+                for e in entries if e.get("id")
+            }
+        data = role_mod.set_role_chatbots(
+            session, app_id, role_id, enables=enables, default=default,
+        )
+        ctx.output(data, lambda d: click.echo("AI assistant access updated."))
+    except Exception as e:
+        ctx.handle_error(e)
+
+
 @role.command("rename")
 @click.argument("app_id")
 @click.argument("role_id")

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/app.py

@@ -1,4 +1,4 @@
-"""Application management module for MingDAO HAP."""
+"""Application management module for Mingdao HAP."""
 
 from datetime import datetime, timedelta
 from typing import Any, Optional

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/app_creator/design/design.schema.json

@@ -3485,6 +3485,28 @@
           },
           "description": "permission_scope=0 时的自定义页面权限明细（页面按逻辑名）。"
         },
+        "chatbot_permissions": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": [
+              "chatbot"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "chatbot": {
+                "type": "string",
+                "description": "AI 助手逻辑名 -> id。"
+              },
+              "enable": {
+                "type": "boolean",
+                "default": true,
+                "description": "是否可访问该 AI 助手。"
+              }
+            }
+          },
+          "description": "可访问的 AI 助手（chatbot）明细，按 chatbot 逻辑名引用。省略该键 = 该角色可访问应用内全部 AI 助手（默认开放）。一旦提供本数组，则只有列出且 enable=true 的助手可访问，其余助手一律不可访问。"
+        },
         "members": {
           "type": "object",
           "additionalProperties": false,

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/app_creator/selftest.py

@@ -67,6 +67,45 @@ def test_store() -> None:
         pass
 
 
+def test_role_chatbot_enables() -> None:
+    from hap_cli.core.app_creator.store import Store
+    from hap_cli.core.app_creator.steps import _role_chatbot_enables
+
+    d = Path(tempfile.mkdtemp()) / "appCB"
+    s = Store(d)
+    s.put_app("appCB", "Demo", "org1", [{"id": "sec1", "name": "分析"}])
+    # No chatbots in the app -> nothing to grant.
+    assert _role_chatbot_enables(s, {"name": "r"}) == {}
+
+    s.put_entity("chatbot", "cb1", "订单助手", {"name": "订单助手"})
+    s.put_entity("chatbot", "cb2", "客服助手", {"name": "客服助手"})
+    # chatbot_permissions omitted -> every assistant is granted (the fix).
+    assert _role_chatbot_enables(s, {"name": "r"}) == {"cb1": True, "cb2": True}
+    # Provided -> whitelist: only listed enable:true granted, the rest off.
+    role = {"name": "r",
+            "chatbot_permissions": [{"chatbot": "订单助手", "enable": True}]}
+    assert _role_chatbot_enables(s, role) == {"cb1": True, "cb2": False}
+    # enable defaults true when omitted; explicit false revokes a listed one.
+    role2 = {"name": "r", "chatbot_permissions": [
+        {"chatbot": "订单助手", "enable": False},
+        {"chatbot": "客服助手"},
+    ]}
+    assert _role_chatbot_enables(s, role2) == {"cb1": False, "cb2": True}
+
+
+def test_role_chatbot_permissions_schema() -> None:
+    design = {
+        "app": {"name": "x"},
+        "worksheets": [{"name": "t", "fields": [
+            {"type": "Text", "name": "标题", "is_title": True}]}],
+        "chatbots": [{"name": "助手"}],
+        "roles": [{"name": "r", "permission_scope": "0",
+                   "chatbot_permissions": [{"chatbot": "助手", "enable": True}]}],
+    }
+    errs = _vd(design)
+    assert not any("chatbot_permissions" in e for e in errs), errs
+
+
 def test_schema() -> None:
     from hap_cli.core.app_creator import schema
 
@@ -1607,6 +1646,62 @@ def test_icon_validation() -> None:
     assert any("worksheets[0].icon" in e and "1_2_order" in e for e in errs), errs
 
 
+def test_icon_uniqueness() -> None:
+    """Nav-level entities (worksheets + custom_pages) must each carry a DISTINCT
+    icon — the 零冗余 golden rule. Reusing one icon across two worksheets/pages
+    is a hard validation error, caught offline before build. Buttons and
+    page-component icons are exempt (icon reuse there is legitimate and common).
+    Pure check — no catalogue lookup needed."""
+    from hap_cli.core.app_creator import validate
+
+    # Two worksheets sharing one icon -> a single error that names both owners.
+    dup = {
+        "app": {"name": "D", "icon": "sys_1_2_order"},
+        "worksheets": [
+            {"name": "入库单", "icon": "sys_form_symbol"},
+            {"name": "出库单", "icon": "sys_form_symbol"},
+            {"name": "物料", "icon": "sys_18_5_warehouse"},
+        ],
+    }
+    errs = validate._check_icon_uniqueness(dup)
+    assert len(errs) == 1, errs
+    assert "sys_form_symbol" in errs[0], errs
+    assert "入库单" in errs[0] and "出库单" in errs[0], errs
+
+    # A worksheet and a custom_page sharing an icon also collide — they sit in
+    # the same left-nav strip.
+    cross = {
+        "worksheets": [{"name": "订单", "icon": "sys_form_symbol"}],
+        "custom_pages": [{"name": "看板", "icon": "sys_form_symbol"}],
+    }
+    errs = validate._check_icon_uniqueness(cross)
+    assert len(errs) == 1, errs
+    assert "订单" in errs[0] and "看板" in errs[0], errs
+
+    # All-distinct nav icons pass clean (app icon does not participate).
+    ok = {
+        "app": {"name": "D", "icon": "sys_1_2_order"},
+        "worksheets": [
+            {"name": "A", "icon": "sys_1_2_order"},   # may coincide with app
+            {"name": "B", "icon": "sys_18_5_warehouse"},
+        ],
+        "custom_pages": [{"name": "P", "icon": "sys_form_symbol"}],
+    }
+    assert validate._check_icon_uniqueness(ok) == []
+
+    # Button / page-component icon reuse is EXEMPT: a worksheet icon repeated on
+    # a page-component button is not a collision.
+    exempt = {
+        "worksheets": [{"name": "订单", "icon": "sys_form_symbol"}],
+        "custom_pages": [{
+            "name": "工作台", "icon": "sys_1_2_order",
+            "components": [{"name": "C",
+                            "button": {"buttons": [{"icon": "sys_form_symbol"}]}}],
+        }],
+    }
+    assert validate._check_icon_uniqueness(exempt) == []
+
+
 def test_append_strips_client_control_ids() -> None:
     """Cross-sheet controls (forward relations, lookups, rollups, …) are
     appended with AddWorksheetControls, which only mints a real 24-hex

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/app_creator/steps.py

@@ -962,6 +962,33 @@ def _build_ws_perm(store: Store, wp: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def _role_chatbot_enables(store: Store, role: dict[str, Any]) -> dict[str, bool]:
+    """Map every app chatbot id -> whether this role may access it.
+
+    The fine-grained role-create endpoint can't grant AI-assistant
+    access, so the role handler patches it in afterwards (via
+    ``app role set-chatbots`` -> EditAppRole). Default: every assistant in
+    the app is accessible to the role. A role narrows this with
+    ``chatbot_permissions`` (a list of ``{chatbot, enable}``); when that
+    key is present only the listed assistants with ``enable: true`` are
+    granted and all other assistants are revoked.
+
+    Returns an empty mapping when the app has no chatbots (nothing to do).
+    """
+    ids = [c["id"] for c in store.list("chatbot") if c.get("id")]
+    if not ids:
+        return {}
+    cp = role.get("chatbot_permissions")
+    if cp is None:
+        return {cid: True for cid in ids}
+    wanted: dict[str, bool] = {}
+    for item in cp:
+        wanted[store.resolve("chatbot", item["chatbot"])] = bool(
+            item.get("enable", True)
+        )
+    return {cid: bool(wanted.get(cid, False)) for cid in ids}
+
+
 @handler("role")
 def _h_role(ctx: ExecCtx, step: Step) -> StepOutcome:
     store = _require_store(ctx)
@@ -1021,6 +1048,20 @@ def _h_role(ctx: ExecCtx, step: Step) -> StepOutcome:
             hap.run(m_argv)
             commands.append(m_argv)
 
+    # Grant AI-assistant (chatbot) access. The fine-grained role-create
+    # endpoint has no field for it, so every role would otherwise be unable
+    # to reach the app's assistants. Chatbots are built before roles, so
+    # they already exist in the store here.
+    enables = _role_chatbot_enables(store, role)
+    if role_id and enables:
+        cb_argv = ["app", "role", "set-chatbots", ctx.store.app_id, role_id,
+                   "--chatbots-json",
+                   json.dumps([{"id": cid, "enable": en}
+                               for cid, en in enables.items()],
+                              ensure_ascii=False)]
+        hap.run(cb_argv)
+        commands.append(cb_argv)
+
     return StepOutcome(
         created_id=role_id, summary=f"role {name!r} scope={scope}",
         commands=commands, capture_files=[f"role_{role_id}.json", "roles.json"],

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/app_creator/validate.py

@@ -6,9 +6,9 @@ One file validates that file. Multiple files are MERGED (the split-generation
 workflow: foundation + independently-authored parts) and the combined document
 is validated as a whole — so cross-part logical-name references are checked.
 
-Two layers run here:
+Three layers run here:
   1. structural + reference validation — pure, offline (``schema.load_designs``).
-  2. icon validation — every ``icon`` field (app / worksheet / page / page
+  2. icon existence — every ``icon`` field (app / worksheet / page / page
      component / button) must be an EXACT, real catalogue icon. We confirm
      each via ``hap icon search <icon> --limit 1`` and require the top hit's
      ``fileName`` to equal the icon byte-for-byte. ``hap icon search`` is a
@@ -17,6 +17,11 @@ Two layers run here:
      A fabricated icon (``sys_15_3_user``) or a non-canonical short form
      (``1_2_order`` instead of ``sys_1_2_order``) is rejected — the backend
      only accepts exact catalogue fileNames.
+  3. icon uniqueness — nav-level entities (top-level worksheets + custom_pages)
+     must each carry a DISTINCT icon (the 零冗余 / "不同实体用不同图标" rule).
+     They sit side by side in the app's left navigation, so a repeated icon is
+     visually confusing. Pure/offline. Button and page-component icons are
+     EXEMPT — reuse there (many "新建"/"+" tiles) is legitimate.
 
 Exit code 0 = valid, 2 = validation errors (printed with their JSON paths).
 Run this after authoring a design and before ``build`` so structural and icon
@@ -92,6 +97,44 @@ def _check_icons(doc: Any, runner: Callable[..., Any] = hap.run) -> list[str]:
     return errors
 
 
+def _collect_entity_icons(doc: Any) -> list[tuple[str, str, str]]:
+    """Return ``(kind, name, icon)`` for each NAV-LEVEL entity that carries an
+    icon — top-level worksheets and custom_pages only. These appear together in
+    the app's left navigation, so each needs a visually distinct icon (the
+    零冗余 rule). Deliberately does NOT descend into page components or button
+    ``buttons[]``: reusing an icon on action buttons is legitimate and common,
+    so those are exempt from the uniqueness check."""
+    out: list[tuple[str, str, str]] = []
+    if not isinstance(doc, dict):
+        return out
+    for kind, key in (("工作表", "worksheets"), ("自定义页面", "custom_pages")):
+        items = doc.get(key)
+        if not isinstance(items, list):
+            continue
+        for it in items:
+            if isinstance(it, dict) and isinstance(it.get("icon"), str):
+                out.append((kind, str(it.get("name", "?")), it["icon"]))
+    return out
+
+
+def _check_icon_uniqueness(doc: Any) -> list[str]:
+    """Return errors for icons reused across nav-level entities (worksheets +
+    custom_pages). Each must be unique among them — 不同实体用不同图标 (零冗余).
+    One error per colliding icon, naming every owner. Pure/offline; no catalogue
+    lookup. Iteration order is document order, so messages are deterministic."""
+    by_icon: dict[str, list[str]] = {}
+    for kind, name, icon in _collect_entity_icons(doc):
+        by_icon.setdefault(icon, []).append(f"{kind} {name!r}")
+    errors: list[str] = []
+    for icon, owners in by_icon.items():
+        if len(owners) > 1:
+            errors.append(
+                f"icon {icon!r} is reused by {', '.join(owners)} — give each "
+                f"worksheet/page a DISTINCT icon (零冗余: 不同实体用不同图标). "
+                f"Find alternatives with `hap icon search <keywords>`.")
+    return errors
+
+
 def main(argv: list[str] | None = None) -> int:
     argv = list(sys.argv[1:] if argv is None else argv)
     if not argv:
@@ -112,6 +155,9 @@ def main(argv: list[str] | None = None) -> int:
     except HapCommandError as e:
         print(f"✗ cannot verify icons: {e}", file=sys.stderr)
         return 2
+    # Uniqueness is a pure check (no catalogue lookup) — fold it into the same
+    # error bucket so existence + dedup problems print together.
+    icon_errors += _check_icon_uniqueness(doc)
     if icon_errors:
         joined = "\n  - ".join(icon_errors)
         print(f"✗ design failed icon validation:\n  - {joined}", file=sys.stderr)

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/auth.py

@@ -1,4 +1,4 @@
-"""Browser-based authentication flow for MingDAO HAP.
+"""Browser-based authentication flow for Mingdao HAP.
 
 Implements a local callback server pattern:
 1. Start local HTTP server on a free port
@@ -139,7 +139,7 @@ def fetch_global_meta(host: str, token: str) -> dict:
         host: Login URL the user entered at ``hap auth login`` (e.g.
               'https://www.mingdao.com' or a self-hosted host). The API
               base is derived from this value. When empty, defaults to
-              the MingDAO SaaS host (``https://www.mingdao.com``).
+              the Mingdao SaaS host (``https://www.mingdao.com``).
         token: Auth token.
 
     Raises:

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/calendar_mod.py

@@ -1,4 +1,4 @@
-"""Calendar and schedule management for MingDAO HAP.
+"""Calendar and schedule management for Mingdao HAP.
 
 Named `calendar_mod.py` to avoid conflict with the Python stdlib
 `calendar` module. All API field names follow

{hap_cli-0.8.10 → hap_cli-0.8.12}/hap_cli/core/chart.py

@@ -1,6 +1,6 @@
 """Worksheet chart (统计图) backend wrappers.
 
-The MingDAO statistics module exposes chart CRUD under two URL families
+The Mingdao statistics module exposes chart CRUD under two URL families
 on the report subdomain:
 
   * ``/report/list``                            GET   — list charts of a worksheet