feat(db-*,epf-*): передача дополнительных аргументов в 1cv8 и ibcmd

Набор аргументов платформы был закрыт: общий ключ запуска (например /UseHwLicenses+ на машине с аппаратной лицензией) передать было нельзя, и сборка на автоматически созданной временной базе падала с «Не найдена лицензия». Добавлен escape hatch — по параметру на движок, плюс зеркальные ключи в .v8-project.json (v8args / ibcmdargs) для машинно-специфичных флагов: - -AdditionalV8Arguments → 1cv8.exe, ключи вида /Key - -AdditionalIbcmdArguments → ibcmd, ключи вида --key=value Аргументы уходят во все запуски платформы, которые делает навык: epf-build без базы прогоняет CREATEINFOBASE, /LoadConfigFromFiles, /UpdateDBCfg и саму сборку — ключ получает каждый. До запуска отклоняются: аргумент, которым управляет сам скрипт (режим, подключение, /Out, пакетная операция), позиционный токен для ibcmd и параметр «не своего» движка. Значения секрето-опасных ключей (/P, /UC, --password, --token) в логе маскируются. Порядок источников: .v8-project.json, затем параметр. Поведение без новых параметров не меняется. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-28 05:59:41 +03:00 · 2026-07-29 20:44:15 +03:00
parent d0e81a1715
commit efee7f8f2b
49 changed files with 4235 additions and 114 deletions
@@ -1,4 +1,4 @@
-# epf-build v1.9 — Build external data processor or report (EPF/ERF) from XML sources
+# epf-build v1.10 — Build external data processor or report (EPF/ERF) from XML sources
 # Source: https://github.com/Nikolay-Shirokov/cc-1c-skills
 # NB: *nix-раскладку платформы (/opt/1cv8/<ver>/1cv8, без .exe) знает только .py-порт — PS на *nix не исполняется.
 <#
@@ -33,6 +33,12 @@
 .PARAMETER OutputFile
    Путь к выходному EPF/ERF-файлу

+.PARAMETER AdditionalV8Arguments
+    Дополнительные аргументы запуска 1cv8.exe (например /UseHwLicenses+)
+
+.PARAMETER AdditionalIbcmdArguments
+    Дополнительные аргументы запуска ibcmd (форма --ключ=значение)
+
 .EXAMPLE
    .\epf-build.ps1 -InfoBasePath "C:\Bases\MyDB" -SourceFile "src\МояОбработка.xml" -OutputFile "build\МояОбработка.epf"

@@ -64,7 +70,13 @@ param(
    [string]$SourceFile,

    [Parameter(Mandatory=$true)]
-    [string]$OutputFile
+    [string]$OutputFile,
+
+    [Parameter(Mandatory=$false)]
+    [string[]]$AdditionalV8Arguments = @(),
+
+    [Parameter(Mandatory=$false)]
+    [string[]]$AdditionalIbcmdArguments = @()
 )

 $OutputEncoding = [System.Text.Encoding]::UTF8
@@ -77,6 +89,122 @@ function Protect-Secrets {
    return $Text
 }

+# --- Additional platform arguments ---
+$script:V8OwnedKeys = @(
+    'DESIGNER', 'ENTERPRISE', 'CREATEINFOBASE', 'CONFIG',
+    '/F', '/S', '/N', '/P', '/Out', '/DisableStartupDialogs',
+    '/UseTemplate', '/AddToList', '/Execute', '/C', '/URL', '/UC',
+    '/DumpIB', '/RestoreIB', '/DumpCfg', '/LoadCfg',
+    '/DumpConfigToFiles', '/LoadConfigFromFiles', '/UpdateDBCfg',
+    '/DumpExternalDataProcessorOrReportToFiles', '/LoadExternalDataProcessorOrReportFromFiles'
+)
+$script:IbcmdOwnedKeys = @(
+    '--db-path', '--data', '--out', '--file', '--load', '--restore',
+    '--import', '--export', '--apply', '--force', '--create-database',
+    '--user', '--password'
+)
+$script:V8SecretKeys = @('/P', '/UC', '/WSP', '/AWSP')
+$script:IbcmdSecretKeys = @('--password', '--token', '--db-pwd')
+
+function Test-ArgKeyMatch {
+    # A token matches a key when it equals the key, or starts with it and the next
+    # character is not a letter — catches glued /N"user" and --password=x, while
+    # keeping /ClearCache distinct from /C.
+    param([string]$Token, [string]$Key)
+    if ($Token.Length -lt $Key.Length) { return $false }
+    if (-not $Token.Substring(0, $Key.Length).Equals($Key, [System.StringComparison]::OrdinalIgnoreCase)) { return $false }
+    if ($Token.Length -eq $Key.Length) { return $true }
+    return -not [char]::IsLetter($Token[$Key.Length])
+}
+
+function Get-ProjectExtraArgs {
+    # v8args / ibcmdargs from .v8-project.json — same upward walk as v8path.
+    param([string]$Name)
+    $dir = (Get-Location).Path
+    while ($dir) {
+        $pf = Join-Path $dir ".v8-project.json"
+        if (Test-Path $pf) {
+            try {
+                $j = Get-Content $pf -Raw -Encoding UTF8 | ConvertFrom-Json
+                if ($j.$Name) { return @($j.$Name | ForEach-Object { [string]$_ }) }
+            } catch {}
+            return @()
+        }
+        $parent = Split-Path $dir -Parent
+        if (-not $parent -or $parent -eq $dir) { break }
+        $dir = $parent
+    }
+    return @()
+}
+
+function Assert-ExtraArgs {
+    # The platform accepts only one batch operation, and a duplicate connection or
+    # output key fails with an opaque 1C error — reject what the skill owns itself.
+    param([string[]]$ExtraArgs, [string]$Engine, [hashtable]$Hints)
+    $paramName = if ($Engine -eq 'ibcmd') { '-AdditionalIbcmdArguments' } else { '-AdditionalV8Arguments' }
+    $owned = if ($Engine -eq 'ibcmd') { $script:IbcmdOwnedKeys } else { $script:V8OwnedKeys }
+    foreach ($tok in $ExtraArgs) {
+        if ($Engine -eq 'ibcmd' -and $tok -notmatch '^-') {
+            Write-Host "Error: '$tok' is a positional token — pass values as --key=value ($paramName cannot extend the ibcmd command)" -ForegroundColor Red
+            exit 1
+        }
+        foreach ($k in $owned) {
+            if (Test-ArgKeyMatch $tok $k) {
+                $hint = ''
+                if ($Hints -and $Hints.ContainsKey($k)) { $hint = " (use $($Hints[$k]))" }
+                Write-Host "Error: $k is controlled by the skill and cannot be passed via $paramName$hint" -ForegroundColor Red
+                exit 1
+            }
+        }
+    }
+}
+
+function Resolve-ExtraArgs {
+    # Pick the argument list for the selected engine and validate it. An explicitly passed
+    # parameter for the other engine is an error; the same keys coming from .v8-project.json
+    # simply do not apply — a project may describe both engines.
+    param([string]$Engine, [string[]]$V8Extra, [string[]]$IbcmdExtra, [hashtable]$Hints)
+    if ($Engine -eq 'ibcmd' -and $V8Extra.Count -gt 0) {
+        Write-Host "Error: -AdditionalV8Arguments applies to 1cv8 only; the selected engine is ibcmd (use -AdditionalIbcmdArguments)" -ForegroundColor Red
+        exit 1
+    }
+    if ($Engine -ne 'ibcmd' -and $IbcmdExtra.Count -gt 0) {
+        Write-Host "Error: -AdditionalIbcmdArguments applies to ibcmd only; the selected engine is 1cv8 (use -AdditionalV8Arguments)" -ForegroundColor Red
+        exit 1
+    }
+    if ($Engine -eq 'ibcmd') {
+        $extra = @(Get-ProjectExtraArgs 'ibcmdargs') + @($IbcmdExtra)
+    } else {
+        $extra = @(Get-ProjectExtraArgs 'v8args') + @($V8Extra)
+    }
+    if ($extra.Count -gt 0) { Assert-ExtraArgs $extra $Engine $Hints }
+    # Plain return, no comma trick: the caller re-collects with @(...), and ,@() there
+    # would nest the array — the tokens would then be glued into one argument.
+    return $extra
+}
+
+function Format-ArgsForDisplay {
+    # Redact values of secret-prone keys in glued, =-joined and separate forms.
+    # Matching here is a plain prefix (no letter rule): over-masking costs nothing,
+    # a leaked password does.
+    param([string[]]$ArgList, [string]$Engine)
+    $keys = if ($Engine -eq 'ibcmd') { $script:IbcmdSecretKeys } else { $script:V8SecretKeys }
+    $res = @()
+    $maskNext = $false
+    foreach ($tok in $ArgList) {
+        if ($maskNext) { $res += '***'; $maskNext = $false; continue }
+        $hit = $null
+        foreach ($k in $keys) {
+            if ($tok.Length -ge $k.Length -and $tok.Substring(0, $k.Length).Equals($k, [System.StringComparison]::OrdinalIgnoreCase)) { $hit = $k; break }
+        }
+        if (-not $hit) { $res += $tok; continue }
+        if ($tok.Length -eq $hit.Length) { $res += $tok; $maskNext = $true }
+        elseif ($tok[$hit.Length] -eq '=') { $res += ($hit + '=***') }
+        else { $res += ($hit + '***') }
+    }
+    return ,$res
+}
+
 # --- Resolve V8Path ---
 function Find-ProjectV8Path {
    $dir = (Get-Location).Path
@@ -156,6 +284,10 @@ function Test-OutputNonEmpty {
 }

 $engine = if ((Split-Path $V8Path -Leaf) -match '^ibcmd') { "ibcmd" } else { "1cv8" }
+
+# --- Resolve additional arguments for the selected engine ---
+$argHints = @{ '/F' = '-InfoBasePath'; '/S' = '-InfoBaseServer + -InfoBaseRef'; '/N' = '-UserName'; '/P' = '-Password'; '--db-path' = '-InfoBasePath'; '--user' = '-UserName'; '--password' = '-Password' }
+$extraArgs = @(Resolve-ExtraArgs $engine $AdditionalV8Arguments $AdditionalIbcmdArguments $argHints)
 if ($engine -eq "ibcmd" -and $InfoBaseServer -and $InfoBaseRef) {
    Write-Host "Error: ibcmd supports file infobases only (use -InfoBasePath or omit for stub)" -ForegroundColor Red
    exit 1
@@ -168,8 +300,20 @@ if (-not $InfoBasePath -and (-not $InfoBaseServer -or -not $InfoBaseRef)) {
    $autoBasePath = Join-Path $env:TEMP "epf_stub_db_$(Get-Random)"
    $stubScript = Join-Path $PSScriptRoot "stub-db-create.ps1"
    Write-Host "No database specified. Creating temporary stub database..."
-    $stubArgs = "-SourceDir `"$sourceDir`" -V8Path `"$V8Path`" -TempBasePath `"$autoBasePath`""
-    $stubProc = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -File `"$stubScript`" $stubArgs" -NoNewWindow -Wait -PassThru
+    # The stub runs its own platform processes (CREATEINFOBASE, LoadConfigFromFiles,
+    # UpdateDBCfg) — they need the same extra arguments as the final build. Only the
+    # explicit ones are forwarded: the stub reads .v8-project.json itself.
+    # Invoked via -Command, not -File: -File takes the tail literally, so an array
+    # parameter would arrive as a single comma-glued token.
+    $q = { param($s) "'" + ($s -replace "'", "''") + "'" }
+    $stubCmd = "& $(& $q $stubScript) -SourceDir $(& $q $sourceDir) -V8Path $(& $q $V8Path) -TempBasePath $(& $q $autoBasePath)"
+    if ($AdditionalV8Arguments.Count -gt 0) {
+        $stubCmd += " -AdditionalV8Arguments " + (($AdditionalV8Arguments | ForEach-Object { & $q $_ }) -join ',')
+    }
+    if ($AdditionalIbcmdArguments.Count -gt 0) {
+        $stubCmd += " -AdditionalIbcmdArguments " + (($AdditionalIbcmdArguments | ForEach-Object { & $q $_ }) -join ',')
+    }
+    $stubProc = Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -Command `"$stubCmd`"" -NoNewWindow -Wait -PassThru
    if ($stubProc.ExitCode -ne 0) {
        Write-Host "Error: failed to create stub database" -ForegroundColor Red
        exit 1
@@ -202,7 +346,8 @@ try {
        if ($UserName) { $arguments += "--user=$UserName" }
        if ($Password) { $arguments += "--password=$Password" }
        $arguments += "--data=$tempDir"
-        Write-Host "Running: ibcmd $(Protect-Secrets ($arguments -join ' ') @($Password, $UserName))"
+        $arguments += $extraArgs
+        Write-Host "Running: ibcmd $(Protect-Secrets ((Format-ArgsForDisplay $arguments $engine) -join ' ') @($Password, $UserName))"
        $__ib = Invoke-IbcmdProcess $V8Path $arguments
        $output = $__ib.Output
        $exitCode = $__ib.ExitCode
@@ -238,9 +383,10 @@ try {
    $outFile = Join-Path $tempDir "build_log.txt"
    $arguments += "/Out", "`"$outFile`""
    $arguments += "/DisableStartupDialogs"
+    $arguments += $extraArgs

    # --- Execute ---
-    Write-Host "Running: 1cv8.exe $(Protect-Secrets ($arguments -join ' ') @($Password, $UserName))"
+    Write-Host "Running: 1cv8.exe $(Protect-Secrets ((Format-ArgsForDisplay $arguments $engine) -join ' ') @($Password, $UserName))"
    $process = Start-Process -FilePath $V8Path -ArgumentList $arguments -NoNewWindow -Wait -PassThru
    $exitCode = $process.ExitCode

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# epf-build v1.9 — Build external data processor or report (EPF/ERF) from XML sources
+# epf-build v1.10 — Build external data processor or report (EPF/ERF) from XML sources
 # Source: https://github.com/Nikolay-Shirokov/cc-1c-skills

 import argparse
@@ -36,6 +36,157 @@ def _find_project_v8path():
        d = parent


+# --- Additional platform arguments ---
+V8_OWNED_KEYS = [
+    "DESIGNER", "ENTERPRISE", "CREATEINFOBASE", "CONFIG",
+    "/F", "/S", "/N", "/P", "/Out", "/DisableStartupDialogs",
+    "/UseTemplate", "/AddToList", "/Execute", "/C", "/URL", "/UC",
+    "/DumpIB", "/RestoreIB", "/DumpCfg", "/LoadCfg",
+    "/DumpConfigToFiles", "/LoadConfigFromFiles", "/UpdateDBCfg",
+    "/DumpExternalDataProcessorOrReportToFiles", "/LoadExternalDataProcessorOrReportFromFiles",
+]
+IBCMD_OWNED_KEYS = [
+    "--db-path", "--data", "--out", "--file", "--load", "--restore",
+    "--import", "--export", "--apply", "--force", "--create-database",
+    "--user", "--password",
+]
+V8_SECRET_KEYS = ["/P", "/UC", "/WSP", "/AWSP"]
+IBCMD_SECRET_KEYS = ["--password", "--token", "--db-pwd"]
+
+
+def arg_key_match(token, key):
+    """Token matches a key when it equals it, or starts with it and the next character
+    is not a letter — catches glued /N"user" and --password=x, while keeping
+    /ClearCache distinct from /C."""
+    if len(token) < len(key):
+        return False
+    if token[: len(key)].lower() != key.lower():
+        return False
+    if len(token) == len(key):
+        return True
+    return not token[len(key)].isalpha()
+
+
+def project_extra_args(name):
+    """v8args / ibcmdargs from .v8-project.json — same upward walk as v8path."""
+    d = os.getcwd()
+    while True:
+        pf = os.path.join(d, ".v8-project.json")
+        if os.path.isfile(pf):
+            try:
+                with open(pf, encoding="utf-8-sig") as f:
+                    data = json.load(f)
+                v = data.get(name)
+                if v:
+                    return [str(x) for x in v]
+            except Exception:
+                pass
+            return []
+        parent = os.path.dirname(d)
+        if parent == d:
+            return []
+        d = parent
+
+
+def assert_extra_args(extra, engine, hints):
+    """The platform accepts only one batch operation, and a duplicate connection or
+    output key fails with an opaque 1C error — reject what the skill owns itself."""
+    param = "-AdditionalIbcmdArguments" if engine == "ibcmd" else "-AdditionalV8Arguments"
+    owned = IBCMD_OWNED_KEYS if engine == "ibcmd" else V8_OWNED_KEYS
+    for tok in extra:
+        if engine == "ibcmd" and not tok.startswith("-"):
+            print(
+                f"Error: '{tok}' is a positional token — pass values as --key=value "
+                f"({param} cannot extend the ibcmd command)",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+        for k in owned:
+            if arg_key_match(tok, k):
+                hint = f" (use {hints[k]})" if hints and k in hints else ""
+                print(
+                    f"Error: {k} is controlled by the skill and cannot be passed via {param}{hint}",
+                    file=sys.stderr,
+                )
+                sys.exit(1)
+
+
+def format_args_for_display(arglist, engine):
+    """Redact values of secret-prone keys in glued, =-joined and separate forms.
+    Matching here is a plain prefix (no letter rule): over-masking costs nothing,
+    a leaked password does."""
+    keys = IBCMD_SECRET_KEYS if engine == "ibcmd" else V8_SECRET_KEYS
+    res = []
+    mask_next = False
+    for tok in arglist:
+        if mask_next:
+            res.append("***")
+            mask_next = False
+            continue
+        hit = None
+        for k in keys:
+            if tok[: len(k)].lower() == k.lower():
+                hit = k
+                break
+        if hit is None:
+            res.append(tok)
+        elif len(tok) == len(hit):
+            res.append(tok)
+            mask_next = True
+        elif tok[len(hit)] == "=":
+            res.append(hit + "=***")
+        else:
+            res.append(hit + "***")
+    return res
+
+
+def extract_extra_args(argv, known_opts):
+    """argparse refuses values that start with '-' (every ibcmd key does), so pull the two
+    escape-hatch lists out of argv by hand: after the flag, take everything up to the next
+    declared skill option. Returns (remaining_argv, v8_extra, ibcmd_extra)."""
+    rest, v8, ibcmd = [], [], []
+    i = 0
+    while i < len(argv):
+        low = argv[i].lower()
+        if low in ("-additionalv8arguments", "-additionalibcmdarguments"):
+            target = v8 if low == "-additionalv8arguments" else ibcmd
+            i += 1
+            while i < len(argv) and argv[i].lower() not in known_opts:
+                target.append(argv[i])
+                i += 1
+            continue
+        rest.append(argv[i])
+        i += 1
+    return rest, v8, ibcmd
+
+
+def resolve_extra_args(engine, v8_extra, ibcmd_extra, hints):
+    """Pick the argument list for the selected engine and validate it. An explicitly
+    passed parameter for the other engine is an error; the same keys coming from
+    .v8-project.json simply do not apply — a project may describe both engines."""
+    if engine == "ibcmd" and v8_extra:
+        print(
+            "Error: -AdditionalV8Arguments applies to 1cv8 only; the selected engine is ibcmd "
+            "(use -AdditionalIbcmdArguments)",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    if engine != "ibcmd" and ibcmd_extra:
+        print(
+            "Error: -AdditionalIbcmdArguments applies to ibcmd only; the selected engine is 1cv8 "
+            "(use -AdditionalV8Arguments)",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    if engine == "ibcmd":
+        extra = project_extra_args("ibcmdargs") + list(ibcmd_extra)
+    else:
+        extra = project_extra_args("v8args") + list(v8_extra)
+    if extra:
+        assert_extra_args(extra, engine, hints)
+    return extra
+
+
 def _version_dir(p):
    """Version dir for both Windows (.../1cv8/<ver>/bin/1cv8.exe) and *nix (.../1cv8/<ver>/1cv8)."""
    parent = os.path.dirname(p)
@@ -129,11 +280,29 @@ def main():
    parser.add_argument("-Password", default="", help="1C user password")
    parser.add_argument("-SourceFile", required=True, help="Path to root XML source file")
    parser.add_argument("-OutputFile", required=True, help="Path to output EPF/ERF file")
-    args = parser.parse_args()
+    parser.add_argument("-AdditionalV8Arguments", nargs="*", default=[],
+                        help="Extra 1cv8 arguments, e.g. /UseHwLicenses+")
+    parser.add_argument("-AdditionalIbcmdArguments", nargs="*", default=[],
+                        help="Extra ibcmd arguments in --key=value form")
+    known_opts = {s.lower() for a in parser._actions for s in a.option_strings}
+    argv, v8_extra, ibcmd_extra = extract_extra_args(sys.argv[1:], known_opts)
+    args = parser.parse_args(argv)

    # --- Resolve V8Path ---
    v8path = resolve_v8path(args.V8Path)
    engine = "ibcmd" if os.path.basename(v8path).lower().startswith("ibcmd") else "1cv8"
+
+    # --- Resolve additional arguments for the selected engine ---
+    arg_hints = {
+        "/F": "-InfoBasePath",
+        "/S": "-InfoBaseServer + -InfoBaseRef",
+        "/N": "-UserName",
+        "/P": "-Password",
+        "--db-path": "-InfoBasePath",
+        "--user": "-UserName",
+        "--password": "-Password",
+    }
+    extra_args = resolve_extra_args(engine, v8_extra, ibcmd_extra, arg_hints)
    if engine == "ibcmd" and args.InfoBaseServer and args.InfoBaseRef:
        print("Error: ibcmd supports file infobases only (use -InfoBasePath or omit for stub)", file=sys.stderr)
        sys.exit(1)
@@ -145,10 +314,16 @@ def main():
        auto_base_path = os.path.join(tempfile.gettempdir(), f"epf_stub_db_{random.randint(0, 999999)}")
        stub_script = os.path.join(os.path.dirname(os.path.abspath(__file__)), "stub-db-create.py")
        print("No database specified. Creating temporary stub database...")
-        result = subprocess.run(
-            [sys.executable, stub_script, "-SourceDir", source_dir, "-V8Path", v8path, "-TempBasePath", auto_base_path],
-            capture_output=False,
-        )
+        stub_cmd = [sys.executable, stub_script, "-SourceDir", source_dir, "-V8Path", v8path,
+                    "-TempBasePath", auto_base_path]
+        # The stub runs its own platform processes (CREATEINFOBASE, LoadConfigFromFiles,
+        # UpdateDBCfg) — they need the same extra arguments as the final build. Only the
+        # explicit ones are forwarded: the stub reads .v8-project.json itself.
+        if v8_extra:
+            stub_cmd += ["-AdditionalV8Arguments"] + list(v8_extra)
+        if ibcmd_extra:
+            stub_cmd += ["-AdditionalIbcmdArguments"] + list(ibcmd_extra)
+        result = subprocess.run(stub_cmd, capture_output=False)
        if result.returncode != 0:
            print("Error: failed to create stub database", file=sys.stderr)
            sys.exit(1)
@@ -181,7 +356,8 @@ def main():
            if args.Password:
                arguments.append(f"--password={args.Password}")
            arguments.append(f"--data={ib_data}")
-            print(f"Running: ibcmd {_redact(' '.join(arguments), args.Password, args.UserName)}")
+            arguments.extend(extra_args)
+            print(f"Running: ibcmd {_redact(' '.join(format_args_for_display(arguments, engine)), args.Password, args.UserName)}")
            result = run_ibcmd([v8path] + arguments, warn_no_user=False)
            exit_code = result.returncode
            out_missing = exit_code == 0 and not output_nonempty(args.OutputFile)
@@ -218,9 +394,10 @@ def main():
        out_file = os.path.join(temp_dir, "build_log.txt")
        arguments += ["/Out", out_file]
        arguments.append("/DisableStartupDialogs")
+        arguments.extend(extra_args)

        # --- Execute ---
-        print(f"Running: 1cv8.exe {_redact(' '.join(arguments), args.Password, args.UserName)}")
+        print(f"Running: 1cv8.exe {_redact(' '.join(format_args_for_display(arguments, engine)), args.Password, args.UserName)}")
        result = subprocess.run(
            [v8path] + arguments,
            capture_output=True,
@@ -1,4 +1,4 @@
-# stub-db-create v1.3 — Create temp 1C infobase with metadata stubs for EPF/ERF build
+# stub-db-create v1.4 — Create temp 1C infobase with metadata stubs for EPF/ERF build
 # Source: https://github.com/Nikolay-Shirokov/cc-1c-skills
 param(
 	[Parameter(Mandatory)]
@@ -7,12 +7,133 @@ param(
 	[Parameter(Mandatory)]
 	[string]$V8Path,

-	[string]$TempBasePath
+	[string]$TempBasePath,
+
+	[string[]]$AdditionalV8Arguments = @(),
+
+	[string[]]$AdditionalIbcmdArguments = @()
 )

 $ErrorActionPreference = "Stop"
 [Console]::OutputEncoding = [System.Text.Encoding]::UTF8

+# --- Additional platform arguments ---
+$script:V8OwnedKeys = @(
+    'DESIGNER', 'ENTERPRISE', 'CREATEINFOBASE', 'CONFIG',
+    '/F', '/S', '/N', '/P', '/Out', '/DisableStartupDialogs',
+    '/UseTemplate', '/AddToList', '/Execute', '/C', '/URL', '/UC',
+    '/DumpIB', '/RestoreIB', '/DumpCfg', '/LoadCfg',
+    '/DumpConfigToFiles', '/LoadConfigFromFiles', '/UpdateDBCfg',
+    '/DumpExternalDataProcessorOrReportToFiles', '/LoadExternalDataProcessorOrReportFromFiles'
+)
+$script:IbcmdOwnedKeys = @(
+    '--db-path', '--data', '--out', '--file', '--load', '--restore',
+    '--import', '--export', '--apply', '--force', '--create-database',
+    '--user', '--password'
+)
+$script:V8SecretKeys = @('/P', '/UC', '/WSP', '/AWSP')
+$script:IbcmdSecretKeys = @('--password', '--token', '--db-pwd')
+
+function Test-ArgKeyMatch {
+    # A token matches a key when it equals the key, or starts with it and the next
+    # character is not a letter — catches glued /N"user" and --password=x, while
+    # keeping /ClearCache distinct from /C.
+    param([string]$Token, [string]$Key)
+    if ($Token.Length -lt $Key.Length) { return $false }
+    if (-not $Token.Substring(0, $Key.Length).Equals($Key, [System.StringComparison]::OrdinalIgnoreCase)) { return $false }
+    if ($Token.Length -eq $Key.Length) { return $true }
+    return -not [char]::IsLetter($Token[$Key.Length])
+}
+
+function Get-ProjectExtraArgs {
+    # v8args / ibcmdargs from .v8-project.json — same upward walk as v8path.
+    param([string]$Name)
+    $dir = (Get-Location).Path
+    while ($dir) {
+        $pf = Join-Path $dir ".v8-project.json"
+        if (Test-Path $pf) {
+            try {
+                $j = Get-Content $pf -Raw -Encoding UTF8 | ConvertFrom-Json
+                if ($j.$Name) { return @($j.$Name | ForEach-Object { [string]$_ }) }
+            } catch {}
+            return @()
+        }
+        $parent = Split-Path $dir -Parent
+        if (-not $parent -or $parent -eq $dir) { break }
+        $dir = $parent
+    }
+    return @()
+}
+
+function Assert-ExtraArgs {
+    # The platform accepts only one batch operation, and a duplicate connection or
+    # output key fails with an opaque 1C error — reject what the skill owns itself.
+    param([string[]]$ExtraArgs, [string]$Engine, [hashtable]$Hints)
+    $paramName = if ($Engine -eq 'ibcmd') { '-AdditionalIbcmdArguments' } else { '-AdditionalV8Arguments' }
+    $owned = if ($Engine -eq 'ibcmd') { $script:IbcmdOwnedKeys } else { $script:V8OwnedKeys }
+    foreach ($tok in $ExtraArgs) {
+        if ($Engine -eq 'ibcmd' -and $tok -notmatch '^-') {
+            Write-Host "Error: '$tok' is a positional token — pass values as --key=value ($paramName cannot extend the ibcmd command)" -ForegroundColor Red
+            exit 1
+        }
+        foreach ($k in $owned) {
+            if (Test-ArgKeyMatch $tok $k) {
+                $hint = ''
+                if ($Hints -and $Hints.ContainsKey($k)) { $hint = " (use $($Hints[$k]))" }
+                Write-Host "Error: $k is controlled by the skill and cannot be passed via $paramName$hint" -ForegroundColor Red
+                exit 1
+            }
+        }
+    }
+}
+
+function Resolve-ExtraArgs {
+    # Pick the argument list for the selected engine and validate it. An explicitly passed
+    # parameter for the other engine is an error; the same keys coming from .v8-project.json
+    # simply do not apply — a project may describe both engines.
+    param([string]$Engine, [string[]]$V8Extra, [string[]]$IbcmdExtra, [hashtable]$Hints)
+    if ($Engine -eq 'ibcmd' -and $V8Extra.Count -gt 0) {
+        Write-Host "Error: -AdditionalV8Arguments applies to 1cv8 only; the selected engine is ibcmd (use -AdditionalIbcmdArguments)" -ForegroundColor Red
+        exit 1
+    }
+    if ($Engine -ne 'ibcmd' -and $IbcmdExtra.Count -gt 0) {
+        Write-Host "Error: -AdditionalIbcmdArguments applies to ibcmd only; the selected engine is 1cv8 (use -AdditionalV8Arguments)" -ForegroundColor Red
+        exit 1
+    }
+    if ($Engine -eq 'ibcmd') {
+        $extra = @(Get-ProjectExtraArgs 'ibcmdargs') + @($IbcmdExtra)
+    } else {
+        $extra = @(Get-ProjectExtraArgs 'v8args') + @($V8Extra)
+    }
+    if ($extra.Count -gt 0) { Assert-ExtraArgs $extra $Engine $Hints }
+    # Plain return, no comma trick: the caller re-collects with @(...), and ,@() there
+    # would nest the array — the tokens would then be glued into one argument.
+    return $extra
+}
+
+function Format-ArgsForDisplay {
+    # Redact values of secret-prone keys in glued, =-joined and separate forms.
+    # Matching here is a plain prefix (no letter rule): over-masking costs nothing,
+    # a leaked password does.
+    param([string[]]$ArgList, [string]$Engine)
+    $keys = if ($Engine -eq 'ibcmd') { $script:IbcmdSecretKeys } else { $script:V8SecretKeys }
+    $res = @()
+    $maskNext = $false
+    foreach ($tok in $ArgList) {
+        if ($maskNext) { $res += '***'; $maskNext = $false; continue }
+        $hit = $null
+        foreach ($k in $keys) {
+            if ($tok.Length -ge $k.Length -and $tok.Substring(0, $k.Length).Equals($k, [System.StringComparison]::OrdinalIgnoreCase)) { $hit = $k; break }
+        }
+        if (-not $hit) { $res += $tok; continue }
+        if ($tok.Length -eq $hit.Length) { $res += $tok; $maskNext = $true }
+        elseif ($tok[$hit.Length] -eq '=') { $res += ($hit + '=***') }
+        else { $res += ($hit + '***') }
+    }
+    return ,$res
+}
+
+
 # --- 1. Scan XML files for reference types ---

 $typeMap = @{}  # MetadataType -> @(Name1, Name2, ...)
@@ -1281,6 +1402,18 @@ function Invoke-IbcmdProcess {


 $stubEngine = if ((Split-Path $V8Path -Leaf) -match '^ibcmd') { "ibcmd" } else { "1cv8" }
+
+# --- Resolve additional arguments for the selected engine ---
+$argHints = @{ '/F' = '-TempBasePath'; '--db-path' = '-TempBasePath' }
+$extraArgs = @(Resolve-ExtraArgs $stubEngine $AdditionalV8Arguments $AdditionalIbcmdArguments $argHints)
+
+function Format-ArgToken {
+	# Start-Process takes these argument lists as one string, so quote each token that needs it.
+	param([string]$Token)
+	if ($Token -match '[\s"]') { return ' "' + ($Token -replace '"', '\"') + '"' }
+	return " $Token"
+}
+$extraArgString = -join ($extraArgs | ForEach-Object { Format-ArgToken $_ })
 if ($stubEngine -eq "ibcmd") {
 	Write-Host "Creating infobase (ibcmd): $TempBasePath"
 	$ibData = Join-Path $env:TEMP "stub_data_$(Get-Random)"
@@ -1288,6 +1421,7 @@ if ($stubEngine -eq "ibcmd") {
 	$ibArgs = @("infobase", "create", "--db-path=$TempBasePath", "--create-database")
 	if ($hasRefTypes) { $ibArgs += "--import=$(Join-Path $TempBasePath 'cfg')", "--apply", "--force" }
 	$ibArgs += "--data=$ibData"
+	$ibArgs += $extraArgs
 	$__ib = Invoke-IbcmdProcess $V8Path $ibArgs
 	$ibOut = $__ib.Output
 	$ibRc = $__ib.ExitCode
@@ -1305,7 +1439,7 @@ if ($stubEngine -eq "ibcmd") {

 # --- 5. Create infobase ---
 Write-Host "Creating infobase: $TempBasePath"
-$createArgs = "CREATEINFOBASE File=`"$TempBasePath`" /DisableStartupDialogs"
+$createArgs = "CREATEINFOBASE File=`"$TempBasePath`" /DisableStartupDialogs" + $extraArgString
 $proc = Start-Process -FilePath $V8Path -ArgumentList $createArgs -NoNewWindow -Wait -PassThru
 if ($proc.ExitCode -ne 0) {
 	Write-Error "Failed to create infobase (code: $($proc.ExitCode))"
@@ -1318,7 +1452,7 @@ if ($hasRefTypes) {
 	# LoadConfigFromFiles
 	Write-Host "Loading configuration from files..."
 	$loadLog = Join-Path $env:TEMP "stub_load_log.txt"
-	$loadArgs = "DESIGNER /F`"$TempBasePath`" /LoadConfigFromFiles `"$cfgDir`" /Out `"$loadLog`" /DisableStartupDialogs"
+	$loadArgs = "DESIGNER /F`"$TempBasePath`" /LoadConfigFromFiles `"$cfgDir`" /Out `"$loadLog`" /DisableStartupDialogs" + $extraArgString
 	$proc = Start-Process -FilePath $V8Path -ArgumentList $loadArgs -NoNewWindow -Wait -PassThru
 	if ($proc.ExitCode -ne 0) {
 		if (Test-Path $loadLog) { Get-Content $loadLog -Raw -ErrorAction SilentlyContinue | Write-Host }
@@ -1329,7 +1463,7 @@ if ($hasRefTypes) {
 	# UpdateDBCfg
 	Write-Host "Updating database configuration..."
 	$updateLog = Join-Path $env:TEMP "stub_update_log.txt"
-	$updateArgs = "DESIGNER /F`"$TempBasePath`" /UpdateDBCfg /Out `"$updateLog`" /DisableStartupDialogs"
+	$updateArgs = "DESIGNER /F`"$TempBasePath`" /UpdateDBCfg /Out `"$updateLog`" /DisableStartupDialogs" + $extraArgString
 	$proc = Start-Process -FilePath $V8Path -ArgumentList $updateArgs -NoNewWindow -Wait -PassThru
 	if ($proc.ExitCode -ne 0) {
 		if (Test-Path $updateLog) { Get-Content $updateLog -Raw -ErrorAction SilentlyContinue | Write-Host }
@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-# stub-db-create v1.3 — Create temp 1C infobase with metadata stubs for EPF/ERF build
+# stub-db-create v1.4 — Create temp 1C infobase with metadata stubs for EPF/ERF build
 # Source: https://github.com/Nikolay-Shirokov/cc-1c-skills

 import argparse
@@ -33,6 +33,157 @@ def run_ibcmd(cmd, has_username=False, warn_no_user=True):
    return subprocess.run(cmd, input="", capture_output=True, encoding="utf-8", errors="replace")


+# --- Additional platform arguments ---
+V8_OWNED_KEYS = [
+    "DESIGNER", "ENTERPRISE", "CREATEINFOBASE", "CONFIG",
+    "/F", "/S", "/N", "/P", "/Out", "/DisableStartupDialogs",
+    "/UseTemplate", "/AddToList", "/Execute", "/C", "/URL", "/UC",
+    "/DumpIB", "/RestoreIB", "/DumpCfg", "/LoadCfg",
+    "/DumpConfigToFiles", "/LoadConfigFromFiles", "/UpdateDBCfg",
+    "/DumpExternalDataProcessorOrReportToFiles", "/LoadExternalDataProcessorOrReportFromFiles",
+]
+IBCMD_OWNED_KEYS = [
+    "--db-path", "--data", "--out", "--file", "--load", "--restore",
+    "--import", "--export", "--apply", "--force", "--create-database",
+    "--user", "--password",
+]
+V8_SECRET_KEYS = ["/P", "/UC", "/WSP", "/AWSP"]
+IBCMD_SECRET_KEYS = ["--password", "--token", "--db-pwd"]
+
+
+def arg_key_match(token, key):
+    """Token matches a key when it equals it, or starts with it and the next character
+    is not a letter — catches glued /N"user" and --password=x, while keeping
+    /ClearCache distinct from /C."""
+    if len(token) < len(key):
+        return False
+    if token[: len(key)].lower() != key.lower():
+        return False
+    if len(token) == len(key):
+        return True
+    return not token[len(key)].isalpha()
+
+
+def project_extra_args(name):
+    """v8args / ibcmdargs from .v8-project.json — same upward walk as v8path."""
+    d = os.getcwd()
+    while True:
+        pf = os.path.join(d, ".v8-project.json")
+        if os.path.isfile(pf):
+            try:
+                with open(pf, encoding="utf-8-sig") as f:
+                    data = json.load(f)
+                v = data.get(name)
+                if v:
+                    return [str(x) for x in v]
+            except Exception:
+                pass
+            return []
+        parent = os.path.dirname(d)
+        if parent == d:
+            return []
+        d = parent
+
+
+def assert_extra_args(extra, engine, hints):
+    """The platform accepts only one batch operation, and a duplicate connection or
+    output key fails with an opaque 1C error — reject what the skill owns itself."""
+    param = "-AdditionalIbcmdArguments" if engine == "ibcmd" else "-AdditionalV8Arguments"
+    owned = IBCMD_OWNED_KEYS if engine == "ibcmd" else V8_OWNED_KEYS
+    for tok in extra:
+        if engine == "ibcmd" and not tok.startswith("-"):
+            print(
+                f"Error: '{tok}' is a positional token — pass values as --key=value "
+                f"({param} cannot extend the ibcmd command)",
+                file=sys.stderr,
+            )
+            sys.exit(1)
+        for k in owned:
+            if arg_key_match(tok, k):
+                hint = f" (use {hints[k]})" if hints and k in hints else ""
+                print(
+                    f"Error: {k} is controlled by the skill and cannot be passed via {param}{hint}",
+                    file=sys.stderr,
+                )
+                sys.exit(1)
+
+
+def format_args_for_display(arglist, engine):
+    """Redact values of secret-prone keys in glued, =-joined and separate forms.
+    Matching here is a plain prefix (no letter rule): over-masking costs nothing,
+    a leaked password does."""
+    keys = IBCMD_SECRET_KEYS if engine == "ibcmd" else V8_SECRET_KEYS
+    res = []
+    mask_next = False
+    for tok in arglist:
+        if mask_next:
+            res.append("***")
+            mask_next = False
+            continue
+        hit = None
+        for k in keys:
+            if tok[: len(k)].lower() == k.lower():
+                hit = k
+                break
+        if hit is None:
+            res.append(tok)
+        elif len(tok) == len(hit):
+            res.append(tok)
+            mask_next = True
+        elif tok[len(hit)] == "=":
+            res.append(hit + "=***")
+        else:
+            res.append(hit + "***")
+    return res
+
+
+def extract_extra_args(argv, known_opts):
+    """argparse refuses values that start with '-' (every ibcmd key does), so pull the two
+    escape-hatch lists out of argv by hand: after the flag, take everything up to the next
+    declared skill option. Returns (remaining_argv, v8_extra, ibcmd_extra)."""
+    rest, v8, ibcmd = [], [], []
+    i = 0
+    while i < len(argv):
+        low = argv[i].lower()
+        if low in ("-additionalv8arguments", "-additionalibcmdarguments"):
+            target = v8 if low == "-additionalv8arguments" else ibcmd
+            i += 1
+            while i < len(argv) and argv[i].lower() not in known_opts:
+                target.append(argv[i])
+                i += 1
+            continue
+        rest.append(argv[i])
+        i += 1
+    return rest, v8, ibcmd
+
+
+def resolve_extra_args(engine, v8_extra, ibcmd_extra, hints):
+    """Pick the argument list for the selected engine and validate it. An explicitly
+    passed parameter for the other engine is an error; the same keys coming from
+    .v8-project.json simply do not apply — a project may describe both engines."""
+    if engine == "ibcmd" and v8_extra:
+        print(
+            "Error: -AdditionalV8Arguments applies to 1cv8 only; the selected engine is ibcmd "
+            "(use -AdditionalIbcmdArguments)",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    if engine != "ibcmd" and ibcmd_extra:
+        print(
+            "Error: -AdditionalIbcmdArguments applies to ibcmd only; the selected engine is 1cv8 "
+            "(use -AdditionalV8Arguments)",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    if engine == "ibcmd":
+        extra = project_extra_args("ibcmdargs") + list(ibcmd_extra)
+    else:
+        extra = project_extra_args("v8args") + list(v8_extra)
+    if extra:
+        assert_extra_args(extra, engine, hints)
+    return extra
+
+
 def new_uuid():
    return str(uuid.uuid4())

@@ -802,7 +953,13 @@ def main():
    parser.add_argument('-SourceDir', required=True)
    parser.add_argument('-V8Path', required=True)
    parser.add_argument('-TempBasePath', default='')
-    args = parser.parse_args()
+    parser.add_argument('-AdditionalV8Arguments', nargs='*', default=[],
+                        help='Extra 1cv8 arguments, e.g. /UseHwLicenses+')
+    parser.add_argument('-AdditionalIbcmdArguments', nargs='*', default=[],
+                        help='Extra ibcmd arguments in --key=value form')
+    known_opts = {s.lower() for a in parser._actions for s in a.option_strings}
+    argv, v8_extra, ibcmd_extra = extract_extra_args(sys.argv[1:], known_opts)
+    args = parser.parse_args(argv)

    type_map = scan_ref_types(args.SourceDir)
    register_columns = scan_register_columns(args.SourceDir)
@@ -1057,6 +1214,10 @@ def main():

    # Stub via ibcmd (one call: create [--import --apply])
    stub_engine = "ibcmd" if os.path.basename(args.V8Path).lower().startswith("ibcmd") else "1cv8"
+
+    # --- Resolve additional arguments for the selected engine ---
+    arg_hints = {"/F": "-TempBasePath", "--db-path": "-TempBasePath"}
+    extra_args = resolve_extra_args(stub_engine, v8_extra, ibcmd_extra, arg_hints)
    if stub_engine == "ibcmd":
        import shutil
        print(f'Creating infobase (ibcmd): {temp_base}')
@@ -1065,6 +1226,7 @@ def main():
        if has_ref_types:
            ib_args += [f'--import={os.path.join(temp_base, "cfg")}', '--apply', '--force']
        ib_args.append(f'--data={ib_data}')
+        ib_args.extend(extra_args)
        result = run_ibcmd(ib_args, warn_no_user=False)
        shutil.rmtree(ib_data, ignore_errors=True)
        if result.returncode != 0:
@@ -1084,7 +1246,7 @@ def main():
    # Create infobase
    print(f'Creating infobase: {temp_base}')
    result = subprocess.run(
-        [args.V8Path, 'CREATEINFOBASE', f'File={temp_base}', '/DisableStartupDialogs'],
+        [args.V8Path, 'CREATEINFOBASE', f'File={temp_base}', '/DisableStartupDialogs'] + extra_args,
        capture_output=True, text=True,
    )
    if result.returncode != 0:
@@ -1096,7 +1258,7 @@ def main():
        # LoadConfigFromFiles
        print('Loading configuration from files...')
        result = subprocess.run(
-            [args.V8Path, 'DESIGNER', f'/F{temp_base}', '/LoadConfigFromFiles', cfg_dir, '/DisableStartupDialogs'],
+            [args.V8Path, 'DESIGNER', f'/F{temp_base}', '/LoadConfigFromFiles', cfg_dir, '/DisableStartupDialogs'] + extra_args,
            capture_output=True, text=True,
        )
        if result.returncode != 0:
@@ -1107,7 +1269,7 @@ def main():
        print('Updating database configuration...')
        update_log = os.path.join(tempfile.gettempdir(), 'stub_update_log.txt')
        result = subprocess.run(
-            [args.V8Path, 'DESIGNER', f'/F{temp_base}', '/UpdateDBCfg', '/Out', update_log, '/DisableStartupDialogs'],
+            [args.V8Path, 'DESIGNER', f'/F{temp_base}', '/UpdateDBCfg', '/Out', update_log, '/DisableStartupDialogs'] + extra_args,
            capture_output=True, text=True,
        )
        if result.returncode != 0: