@302ai/media-studio-cli 0.1.0-beta.1 → 0.1.0-beta.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +57 -0
- package/dist/index.js +9274 -35830
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -10,6 +10,13 @@ npm install -g @302ai/media-studio-cli
|
|
|
10
10
|
# requires Node.js >= 22
|
|
11
11
|
```
|
|
12
12
|
|
|
13
|
+
Prerelease builds (newer, less tested — currently the only channel that
|
|
14
|
+
exposes the **Staging** server in `msc login`):
|
|
15
|
+
|
|
16
|
+
```bash
|
|
17
|
+
npm install -g @302ai/media-studio-cli@beta
|
|
18
|
+
```
|
|
19
|
+
|
|
13
20
|
> If you installed via **bun** and get `command not found`: bun's global bin
|
|
14
21
|
> dir is not on PATH by default. Run once:
|
|
15
22
|
>
|
|
@@ -68,6 +75,56 @@ Point at a different server via `MEDIA_STUDIO_API_URL` env var, or
|
|
|
68
75
|
`msc login --region local|cn|default` (the server you log into is saved and
|
|
69
76
|
reused).
|
|
70
77
|
|
|
78
|
+
### Staging server (expired TLS certificate)
|
|
79
|
+
|
|
80
|
+
The staging server's certificate is expired (ops declines renewal), so the
|
|
81
|
+
CLI skips TLS certificate verification **only while pointed at the staging
|
|
82
|
+
host**; the server choice itself is the opt-in, and the default / CN hosts
|
|
83
|
+
always verify. The interactive `msc login` region list shows each server's
|
|
84
|
+
URL and marks Staging with the auto-off behavior; `msc login --region
|
|
85
|
+
staging` and `MEDIA_STUDIO_API_URL=https://media.tool302.com` behave the
|
|
86
|
+
same.
|
|
87
|
+
|
|
88
|
+
Stable (production) builds hide Staging from the `msc login` region menu, but
|
|
89
|
+
a persisted staging `auth.json` still auto-bypasses TLS verification — this is
|
|
90
|
+
intentional (the login persists across upgrades), not an oversight.
|
|
91
|
+
|
|
92
|
+
The whitelist is the only way the bypass turns on — no environment variable can
|
|
93
|
+
extend it to another server, so production can never skip verification. To
|
|
94
|
+
force verification back **on** while pointed at staging (once ops renews the
|
|
95
|
+
certificate, or to debug its chain):
|
|
96
|
+
|
|
97
|
+
```bash
|
|
98
|
+
MEDIA_STUDIO_INSECURE_TLS=0 msc chat "hi" # also accepts "false"
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
Plain-`http://` servers skip the bypass entirely (nothing to verify). The
|
|
102
|
+
bypass prints nothing: the staging choice is already stated in the `msc login`
|
|
103
|
+
menu and here, so no warning repeats on every command (`--help` and `--version`
|
|
104
|
+
included, whose output scripts and agents parse).
|
|
105
|
+
|
|
106
|
+
### TLS-intercepting proxies
|
|
107
|
+
|
|
108
|
+
If browser SSO login works but every API call fails with `fetch failed`, a
|
|
109
|
+
TLS-intercepting proxy (Clash/FlClash TUN mode, corporate MITM) is breaking
|
|
110
|
+
certificate verification (`unable to verify the first certificate`).
|
|
111
|
+
Node/Bun do not use the OS keychain, so a proxy CA trusted by your browser
|
|
112
|
+
is not trusted by the CLI. Either trust the proxy CA explicitly:
|
|
113
|
+
|
|
114
|
+
```bash
|
|
115
|
+
export NODE_EXTRA_CA_CERTS=/path/to/proxy-ca.crt
|
|
116
|
+
```
|
|
117
|
+
|
|
118
|
+
or skip verification for the CLI only (no certificate checks). The staging host
|
|
119
|
+
already does this automatically, so this is only needed for other servers — and
|
|
120
|
+
it is now the only way to bypass a non-staging host, since no `msc` flag or env
|
|
121
|
+
var does so. Note it is process-global: every host the CLI talks to stops being
|
|
122
|
+
verified.
|
|
123
|
+
|
|
124
|
+
```bash
|
|
125
|
+
NODE_TLS_REJECT_UNAUTHORIZED=0 msc sessions
|
|
126
|
+
```
|
|
127
|
+
|
|
71
128
|
## Development
|
|
72
129
|
|
|
73
130
|
```bash
|