@aswless_854771076/ai_short_studio_cli 0.1.88 → 0.1.90

package/README.md

@@ -20,6 +20,8 @@ npm 包内置 `using-vvicat-ai-short-studio-cli`、`short-drama` 和 `humanizer`
 ```bash
 ai-short-studio auth signup --email user@example.com --password-stdin
 ai-short-studio auth login --email user@example.com --password-stdin
+# 或复用网页端 MemHub 身份（会自动打开浏览器）
+ai-short-studio auth login --provider memhub
 ```
 
 Agent 代操作时，用户已在当前会话明确提供的密码只能直接写入正在等待的隐藏密码提示，不得复述、拼入 shell 命令、落盘或跨会话保存。
@@ -28,7 +30,7 @@ Agent 代操作时，用户已在当前会话明确提供的密码只能直接
 
 注册确认链接使用当前 profile 的 `baseUrl` 和 `--locale`，指向同域的 `/{locale}/auth/callback`。API 与网页需保持同域，并在 Supabase Redirect URLs 中允许各环境的 `/**`；Site URL 只作为未显式传入回调时的生产兜底。
 
-CLI 只把 refresh token 保存到系统钥匙串。短期 access token 会写入权限为 `0600` 的本机 session 缓存；同一 profile 的并发进程通过跨进程锁共享刷新结果，只有缓存缺失或确实需要刷新时才访问钥匙串，从而避免 Agent 批量操作反复触发 macOS Keychain。退出登录会清除该缓存，CI 可用 `VVICAT_ACCESS_TOKEN` 直接注入临时令牌。未配置服务地址时默认连接 `https://ai-short-studio.vvicat.dev`，`--base-url`、`VVICAT_BASE_URL` 和当前 profile 可依次覆盖。首次登录会从服务端 bootstrap 取得 Supabase 公共配置，也可用 `VVICAT_SUPABASE_URL`、`VVICAT_SUPABASE_PUBLISHABLE_KEY` 显式覆盖。Google 登录在 Windows 上直接调用系统 URL Handler，确保带 `&` 的 PKCE 授权参数完整传给浏览器。服务地址和非敏感 profile 写入系统配置目录；切换环境时必须使用独立的 `--profile`，避免复用旧认证。
+Supabase 登录只把 refresh token 保存到系统钥匙串；MemHub 登录保存由服务端签发的 `cli:access` 专用凭据，不保存 MemHub access/refresh/ID token。MemHub 使用浏览器 OIDC、loopback 回调、PKCE 和一次性授权码交换，长期凭据不会进入浏览器 URL。短期 access token 会写入权限为 `0600` 的本机 session 缓存；同一 profile 的并发进程通过跨进程锁共享刷新结果。`auth logout` 会清除缓存，并撤销 MemHub CLI 凭据。CI 可用 `VVICAT_ACCESS_TOKEN` 直接注入临时令牌。未配置服务地址时默认连接 `https://ai-short-studio.vvicat.dev`，`--base-url`、`VVICAT_BASE_URL` 和当前 profile 可依次覆盖。Supabase 登录会从 bootstrap 取得公共配置；MemHub 登录不依赖 Supabase 公共配置。服务地址、认证提供方和其他非敏感 profile 数据写入系统配置目录；切换环境时必须使用独立的 `--profile`。
 
 创作前运行 `ai-short-studio preflight --json`。CLI 会通过公开的 `/api/v1/bootstrap` 检查服务连通性、取得 Supabase 公共配置、读取 npm `latest` 稳定版本并默认更新当前全局包，再检查登录态和文本、人物、场景、故事版、视频模型配置。npm registry 暂时不可用时服务端使用配置版本降级。更新后必须按输出重跑；明确不允许全局写入时使用 `--no-update`。
 

package/dist/auth/api-key-auth-provider.d.ts

@@ -0,0 +1,12 @@
+import type { AuthProvider, SessionTokens } from './session-manager.js';
+export declare class ApiKeyAuthProvider implements AuthProvider {
+    private readonly baseUrl;
+    private readonly fetcher;
+    constructor(baseUrl: string, fetcher?: typeof fetch);
+    login(): Promise<SessionTokens>;
+    loginWithGoogle(): Promise<SessionTokens>;
+    signup(): Promise<SessionTokens | null>;
+    refresh(apiKey: string): Promise<SessionTokens>;
+    logout(apiKey: string): Promise<void>;
+    private request;
+}

package/dist/auth/api-key-auth-provider.js

@@ -0,0 +1,36 @@
+export class ApiKeyAuthProvider {
+    baseUrl;
+    fetcher;
+    constructor(baseUrl, fetcher = fetch) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.fetcher = fetcher;
+    }
+    async login() {
+        throw new Error('API Key 会话不支持邮箱密码登录');
+    }
+    async loginWithGoogle() {
+        throw new Error('API Key 会话不支持 Google 登录');
+    }
+    async signup() {
+        throw new Error('API Key 会话不支持注册');
+    }
+    async refresh(apiKey) {
+        const response = await this.request(apiKey, 'POST');
+        const payload = await response.json();
+        if (typeof payload.expiresAt !== 'number')
+            throw new Error('CLI 会话续期响应字段不完整');
+        return { accessToken: apiKey, refreshToken: apiKey, expiresAt: payload.expiresAt };
+    }
+    async logout(apiKey) {
+        await this.request(apiKey, 'DELETE');
+    }
+    async request(apiKey, method) {
+        const response = await this.fetcher(`${this.baseUrl}/api/v1/auth/cli/session`, {
+            method,
+            headers: { authorization: `Bearer ${apiKey}`, accept: 'application/json' },
+        });
+        if (!response.ok)
+            throw new Error(`CLI 会话请求失败（HTTP ${response.status}）`);
+        return response;
+    }
+}

package/dist/auth/memhub-oauth.d.ts

@@ -0,0 +1,18 @@
+import type { SessionTokens } from './session-manager.js';
+interface CallbackResult {
+    code: string;
+}
+interface CallbackHandle {
+    redirectUri: string;
+    waitForResult(): Promise<CallbackResult>;
+    cancel?(): void;
+}
+interface MemHubLoginDependencies {
+    state?: string;
+    codeVerifier?: string;
+    callback?: (state: string) => Promise<CallbackHandle>;
+    openBrowser?: (url: string) => Promise<void>;
+    fetcher?: typeof fetch;
+}
+export declare function loginWithMemHubPkce(baseUrl: string, dependencies?: MemHubLoginDependencies): Promise<SessionTokens>;
+export {};

package/dist/auth/memhub-oauth.js

@@ -0,0 +1,113 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { createServer } from 'node:http';
+function challenge(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+function randomParameter(bytes) {
+    return randomBytes(bytes).toString('base64url');
+}
+async function openSystemBrowser(url) {
+    await new Promise((resolve, reject) => {
+        const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'rundll32.exe' : 'xdg-open';
+        const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url];
+        execFile(command, args, (error) => error ? reject(error) : resolve());
+    });
+}
+async function createLoopbackCallback(expectedState) {
+    let settle;
+    let fail;
+    const result = new Promise((resolve, reject) => {
+        settle = resolve;
+        fail = reject;
+    });
+    const server = createServer((request, response) => {
+        const url = new URL(request.url || '/', 'http://127.0.0.1');
+        if (url.pathname !== '/callback') {
+            response.writeHead(404).end('Not Found');
+            return;
+        }
+        const state = url.searchParams.get('state');
+        const code = url.searchParams.get('code');
+        const error = url.searchParams.get('error');
+        response.writeHead(error || !code || state !== expectedState ? 400 : 200, {
+            'content-type': 'text/html; charset=utf-8',
+        });
+        response.end(error || !code || state !== expectedState
+            ? '<h1>登录失败</h1><p>请返回终端重试。</p>'
+            : '<h1>登录成功</h1><p>可以关闭此窗口并返回终端。</p>');
+        server.close();
+        if (error)
+            fail?.(new Error(`MemHub 登录失败：${error}`));
+        else if (state !== expectedState)
+            fail?.(new Error('MemHub CLI 回调 state 不匹配'));
+        else if (!code)
+            fail?.(new Error('MemHub CLI 回调缺少授权码'));
+        else
+            settle?.({ code });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    const timeout = setTimeout(() => {
+        server.close();
+        fail?.(new Error('MemHub CLI 登录等待超时'));
+    }, 5 * 60 * 1000);
+    timeout.unref();
+    return {
+        redirectUri: `http://127.0.0.1:${address.port}/callback`,
+        cancel: () => {
+            clearTimeout(timeout);
+            server.close();
+        },
+        waitForResult: async () => {
+            try {
+                return await result;
+            }
+            finally {
+                clearTimeout(timeout);
+            }
+        },
+    };
+}
+export async function loginWithMemHubPkce(baseUrl, dependencies = {}) {
+    const state = dependencies.state ?? randomParameter(32);
+    const codeVerifier = dependencies.codeVerifier ?? randomParameter(48);
+    const callback = await (dependencies.callback ?? createLoopbackCallback)(state);
+    const authorizationUrl = new URL('/api/sso/memhub/start', baseUrl);
+    authorizationUrl.searchParams.set('mode', 'cli');
+    authorizationUrl.searchParams.set('redirect_uri', callback.redirectUri);
+    authorizationUrl.searchParams.set('state', state);
+    authorizationUrl.searchParams.set('code_challenge', challenge(codeVerifier));
+    try {
+        await (dependencies.openBrowser ?? openSystemBrowser)(authorizationUrl.toString());
+    }
+    catch (error) {
+        // 浏览器启动失败时立即释放本机端口，避免 CLI 进程因 HTTP server 残留而挂起。
+        callback.cancel?.();
+        throw error;
+    }
+    const { code } = await callback.waitForResult();
+    const response = await (dependencies.fetcher ?? fetch)(new URL('/api/v1/auth/cli/token', baseUrl).toString(), {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ code, codeVerifier }),
+    });
+    if (!response.ok) {
+        const body = await response.text().catch(() => '');
+        throw new Error(`MemHub CLI 凭据交换失败（HTTP ${response.status}）${body ? `：${body}` : ''}`);
+    }
+    const payload = await response.json();
+    if (typeof payload.accessToken !== 'string'
+        || typeof payload.refreshToken !== 'string'
+        || typeof payload.expiresAt !== 'number') {
+        throw new Error('MemHub CLI 凭据响应字段不完整');
+    }
+    return {
+        accessToken: payload.accessToken,
+        refreshToken: payload.refreshToken,
+        expiresAt: payload.expiresAt,
+    };
+}

package/dist/auth/session-manager.d.ts

@@ -44,6 +44,7 @@ export declare class SessionManager {
     accessToken(): Promise<string>;
     login(email: string, password: string): Promise<void>;
     loginWithGoogle(): Promise<void>;
+    acceptSession(tokens: SessionTokens): Promise<void>;
     signup(email: string, password: string, emailRedirectTo: string): Promise<boolean>;
     refreshAccessToken(): Promise<string>;
     logout(): Promise<void>;

package/dist/auth/session-manager.js

@@ -88,6 +88,11 @@ export class SessionManager {
         await this.credentials.set(this.profile, this.current.refreshToken);
         await this.cache?.set(this.profile, this.current);
     }
+    async acceptSession(tokens) {
+        this.current = tokens;
+        await this.credentials.set(this.profile, tokens.refreshToken);
+        await this.cache?.set(this.profile, tokens);
+    }
     async signup(email, password, emailRedirectTo) {
         this.current = await this.provider.signup(email, password, emailRedirectTo);
         if (!this.current)

package/dist/commands/auth/login.d.ts

@@ -4,6 +4,7 @@ export default class AuthLogin extends BaseCommand {
     static flags: {
         email: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         google: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        provider: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         'password-stdin': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         'supabase-publishable-key': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'supabase-url': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/auth/login.js

@@ -2,20 +2,33 @@ import { Flags } from '@oclif/core';
 import { BaseCommand } from '../../base-command.js';
 import { createRuntime } from '../../runtime.js';
 import { promptLine, promptPassword, readStdinText } from '../../terminal/prompt.js';
+import { loginWithMemHubPkce } from '../../auth/memhub-oauth.js';
 export default class AuthLogin extends BaseCommand {
-    static description = '登录并将 refresh token 保存到系统钥匙串';
+    static description = '通过 Supabase 或 MemHub 登录，并将长期凭据保存到系统钥匙串';
     static flags = {
         ...BaseCommand.baseFlags,
         email: Flags.string({ description: '登录邮箱' }),
         google: Flags.boolean({ description: '通过浏览器使用 Google 登录', default: false }),
+        provider: Flags.string({
+            description: '登录提供方',
+            options: ['supabase', 'memhub'],
+            default: 'supabase',
+        }),
         'password-stdin': Flags.boolean({ description: '从标准输入读取密码', default: false }),
         'supabase-publishable-key': Flags.string({ description: 'Supabase publishable key', env: 'VVICAT_SUPABASE_PUBLISHABLE_KEY' }),
         'supabase-url': Flags.string({ description: 'Supabase URL', env: 'VVICAT_SUPABASE_URL' }),
     };
     async run() {
         const { flags } = await this.parse(AuthLogin);
-        const runtime = await createRuntime(flags);
-        if (flags.google) {
+        const authProvider = flags.provider;
+        if (authProvider === 'memhub' && (flags.google || flags.email || flags['password-stdin'])) {
+            throw new Error('MemHub 登录使用浏览器授权，不能同时传入邮箱、Google 或密码参数');
+        }
+        const runtime = await createRuntime({ ...flags, 'auth-provider': authProvider });
+        if (authProvider === 'memhub') {
+            await runtime.session.acceptSession(await loginWithMemHubPkce(runtime.profile.baseUrl));
+        }
+        else if (flags.google) {
             await runtime.session.loginWithGoogle();
         }
         else {
@@ -23,6 +36,6 @@ export default class AuthLogin extends BaseCommand {
             const password = flags['password-stdin'] ? await readStdinText() : await promptPassword('密码: ');
             await runtime.session.login(email, password.trimEnd());
         }
-        this.print({ authenticated: true, profile: runtime.profile.name });
+        this.print({ authenticated: true, profile: runtime.profile.name, provider: authProvider });
     }
 }

package/dist/commands/auth/signup.js

@@ -16,7 +16,7 @@ export default class AuthSignup extends BaseCommand {
     };
     async run() {
         const { flags } = await this.parse(AuthSignup);
-        const runtime = await createRuntime(flags);
+        const runtime = await createRuntime({ ...flags, 'auth-provider': 'supabase' });
         const email = (flags.email || await promptLine('邮箱: ')).trim();
         const password = flags['password-stdin'] ? await readStdinText() : await promptPassword('密码: ');
         const normalizedPassword = password.trimEnd();

package/dist/config/profiles.d.ts

@@ -1,6 +1,7 @@
 export interface CliProfile {
     name: string;
     baseUrl: string;
+    authProvider?: 'supabase' | 'memhub';
     defaultProjectId?: string;
     supabaseUrl?: string;
     supabasePublishableKey?: string;

package/dist/runtime.d.ts

@@ -2,6 +2,7 @@ import { ApiClient } from './client/api-client.js';
 import { SessionManager } from './auth/session-manager.js';
 import { type CliProfile } from './config/profiles.js';
 interface RuntimeFlags {
+    'auth-provider'?: 'supabase' | 'memhub';
     'base-url'?: string;
     locale?: string;
     profile?: string;

package/dist/runtime.js

@@ -2,6 +2,7 @@ import { ApiClient } from './client/api-client.js';
 import { join } from 'node:path';
 import { KeyringCredentialStore } from './auth/credential-store.js';
 import { SessionManager, SupabaseAuthProvider } from './auth/session-manager.js';
+import { ApiKeyAuthProvider } from './auth/api-key-auth-provider.js';
 import { FileAccessTokenCache } from './auth/session-cache.js';
 import { defaultConfigDirectory, ProfileStore } from './config/profiles.js';
 import { fetchBootstrap } from './preflight.js';
@@ -17,8 +18,9 @@ export async function createRuntime(flags) {
         ...selected,
         name: flags.profile || selected?.name || 'default',
         baseUrl,
+        authProvider: flags['auth-provider'] || selected?.authProvider || 'supabase',
     }, flags);
-    if (!profile.supabaseUrl || !profile.supabasePublishableKey) {
+    if (profile.authProvider === 'supabase' && (!profile.supabaseUrl || !profile.supabasePublishableKey)) {
         const bootstrap = await fetchBootstrap(baseUrl);
         profile = {
             ...profile,
@@ -31,7 +33,9 @@ export async function createRuntime(flags) {
         profile: profile.name,
         credentials: new KeyringCredentialStore(),
         cache: new FileAccessTokenCache(join(defaultConfigDirectory(process.env), 'sessions')),
-        provider: new SupabaseAuthProvider(profile.supabaseUrl, profile.supabasePublishableKey),
+        provider: profile.authProvider === 'memhub'
+            ? new ApiKeyAuthProvider(baseUrl)
+            : new SupabaseAuthProvider(profile.supabaseUrl, profile.supabasePublishableKey),
     });
     return {
         profile,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aswless_854771076/ai_short_studio_cli",
-  "version": "0.1.88",
+  "version": "0.1.90",
   "description": "VVICAT 无限画布项目命令行工具",
   "license": "MIT",
   "private": false,

package/skills/using-vvicat-ai-short-studio-cli/references/commands/project.md

@@ -8,11 +8,12 @@ ai-short-studio skill status --target codex --json
 ai-short-studio auth signup --email user@example.com --password-stdin
 ai-short-studio auth login --google
 ai-short-studio auth login --email user@example.com --password-stdin
+ai-short-studio auth login --provider memhub
 ai-short-studio auth status --json
 ai-short-studio auth logout
 ```
 
-更新 CLI 后重跑 preflight。邮箱密码只从隐藏输入或安全 stdin 读取；`confirmationRequired: true` 时先完成邮件确认。
+更新 CLI 后重跑 preflight。邮箱密码只从隐藏输入或安全 stdin 读取；`confirmationRequired: true` 时先完成邮件确认。MemHub 登录会打开系统浏览器并使用 loopback + PKCE，不能同时传 `--email`、`--google` 或 `--password-stdin`。
 
 ## 项目与供应商