@bigbrain-work/mcp-connect 1.3.0 → 1.3.2

package/README.md

@@ -24,6 +24,12 @@ npx -y @bigbrain-work/mcp-connect status
 # 显示服务实时返回的工具
 npx -y @bigbrain-work/mcp-connect tools
 
+# 每个项目最多每24小时检查一次石榴 Skill；仅有变化时定向更新
+shiliu skill refresh
+
+# 人工忽略冷却并立即重试
+shiliu skill refresh --force
+
 # 撤销刷新令牌并清除本机凭据
 npx -y @bigbrain-work/mcp-connect logout
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bigbrain-work/mcp-connect",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "石榴 AI 官方 CLI：登录、配置 Agent、检查 MCP 状态并桥接远程工具。",
   "type": "module",
   "bin": {

package/src/arguments.js

@@ -8,6 +8,7 @@ const COMMANDS = new Set([
   "tools",
   "mcp",
   "proxy",
+  "skill",
   "update",
 ]);
 
@@ -50,6 +51,10 @@ export function parseCliArguments(args) {
         type: "boolean",
         default: false,
       },
+      force: {
+        type: "boolean",
+        default: false,
+      },
       session: {
         type: "string",
       },
@@ -75,9 +80,13 @@ export function parseCliArguments(args) {
     throw new Error(`不支持的命令：${command}`);
   }
   const subcommand = parsed.positionals[1];
+  const validSubcommand =
+    (command === "login" && subcommand === "poll") ||
+    (command === "skill" && subcommand === "refresh");
   if (
     parsed.positionals.length > 2 ||
-    (subcommand && !(command === "login" && subcommand === "poll"))
+    (subcommand && !validSubcommand) ||
+    (command === "skill" && subcommand !== "refresh")
   ) {
     throw new Error(`无法识别的参数：${parsed.positionals.slice(1).join(" ")}`);
   }
@@ -103,6 +112,7 @@ export function parseCliArguments(args) {
     legacyApiKey: parsed.values["legacy-api-key"],
     noWait: parsed.values["no-wait"],
     wait: parsed.values.wait,
+    force: parsed.values.force,
     session,
     json: parsed.values.json,
     help: parsed.values.help,

package/src/cli.js

@@ -22,6 +22,8 @@ import { detectInstalledAgents } from "./detection.js";
 import {
   DeviceAuthClient,
   DeviceAuthError,
+  createLoginQrCode,
+  removeLoginQrCode,
   renderQrCode,
   waitForDeviceAuthorization,
 } from "./device-auth-client.js";
@@ -33,6 +35,7 @@ import {
   validateMcpUrl,
 } from "./security.js";
 import { printStatus, printTools, probeMcp } from "./status.js";
+import { printSkillRefresh } from "./skill-refresh.js";
 import { PendingLoginStore, TokenStore } from "./token-store.js";
 import { printUpdateStatus } from "./updater.js";
 
@@ -46,6 +49,7 @@ function printHelp() {
   shiliu install [--agent <name>]
   shiliu status [--json]
   shiliu tools [--json]
+  shiliu skill refresh [--force] [--json]
   shiliu update
   shiliu logout
   shiliu mcp
@@ -64,6 +68,7 @@ function printHelp() {
       --legacy-api-key 使用旧 API Key 兼容登录
       --no-wait       创建登录会话后立即返回
       --wait          等待指定登录会话完成
+      --force         忽略24小时冷却并立即检查石榴 Skill
       --session <id>  指定待继续的登录会话
       --json          以 JSON 输出 status/tools
   -h, --help          显示帮助
@@ -107,7 +112,7 @@ async function legacyLogin({ home, dryRun, url }) {
   );
 }
 
-function buildPendingLogin(start, authUrl, allowLocalhost) {
+function buildPendingLogin(start, authUrl, allowLocalhost, qrCodePath) {
   return {
     sessionId: normalizeDeviceUserCode(start.user_code),
     deviceCode: start.device_code,
@@ -115,10 +120,14 @@ function buildPendingLogin(start, authUrl, allowLocalhost) {
     interval: Number(start.interval) || 5,
     authUrl,
     allowLocalhost,
+    qrCodePath,
   };
 }
 
-export function buildLoginInstructions(start, { allowLocalhost = false } = {}) {
+export function buildLoginInstructions(
+  start,
+  { allowLocalhost = false, qrCodePath } = {},
+) {
   const sessionId = normalizeDeviceUserCode(start.user_code);
   const localhostOption = allowLocalhost ? " --allow-localhost" : "";
   return {
@@ -129,10 +138,12 @@ export function buildLoginInstructions(start, { allowLocalhost = false } = {}) {
       start.verification_uri_complete ||
       start.qr_code_uri ||
       start.verification_uri,
+    qr_code_path: qrCodePath,
+    qr_code_mime_type: "image/png",
     expires_in: Number(start.expires_in),
     poll_command: `shiliu login poll --session ${sessionId} --wait --json${localhostOption}`,
     next_action_hint:
-      "请让用户打开 verification_uri 完成微信授权；用户确认后运行 poll_command。",
+      "二维码已由石榴 CLI 生成。请直接向用户展示 qr_code_path 指向的图片，让用户使用微信扫码授权；不要自行生成二维码，也不要把 verification_uri 当作普通网页打开。用户确认后运行 poll_command。",
   };
 }
 
@@ -148,22 +159,41 @@ async function startPendingDeviceLogin({
 }) {
   const client = new DeviceAuthClient({ baseUrl: authUrl });
   const start = await client.start();
-  await pendingLoginStore.save(
-    buildPendingLogin(start, authUrl, allowLocalhost),
-  );
-  const instructions = buildLoginInstructions(start, { allowLocalhost });
+  const sessionId = normalizeDeviceUserCode(start.user_code);
+  const qrCodeValue =
+    start.qr_code_uri ||
+    start.verification_uri_complete ||
+    start.verification_uri;
+  const qrCodePath = await createLoginQrCode(qrCodeValue, sessionId);
+  try {
+    await pendingLoginStore.save(
+      buildPendingLogin(start, authUrl, allowLocalhost, qrCodePath),
+    );
+  } catch (error) {
+    await removeLoginQrCode(qrCodePath);
+    throw error;
+  }
+  const instructions = buildLoginInstructions(start, {
+    allowLocalhost,
+    qrCodePath,
+  });
   if (json) {
     printJson(instructions);
     return;
   }
   console.log(`请使用微信扫描二维码完成登录（验证码 ${start.user_code}）：`);
-  console.log(await renderQrCode(start.qr_code_uri));
-  console.log(`也可以打开：${instructions.verification_uri}`);
+  console.log(await renderQrCode(qrCodeValue));
+  console.log(`二维码图片：${instructions.qr_code_path}`);
   console.log(
     `完成后运行：${instructions.poll_command.replace(" --json", "")}`,
   );
 }
 
+async function clearPendingLogin(pendingLoginStore, pending) {
+  await pendingLoginStore.clear();
+  await removeLoginQrCode(pending?.qrCodePath);
+}
+
 async function pollPendingDeviceLogin({
   session,
   wait,
@@ -178,7 +208,7 @@ async function pollPendingDeviceLogin({
     throw new Error("未找到对应的待处理登录会话，请重新运行 shiliu login");
   }
   if (pending.expiresAt <= Date.now()) {
-    await pendingLoginStore.clear();
+    await clearPendingLogin(pendingLoginStore, pending);
     throw new Error("登录会话已过期，请重新运行 shiliu login");
   }
 
@@ -219,8 +249,13 @@ async function pollPendingDeviceLogin({
       else console.log("登录尚未完成，请授权后重新运行并加上 --wait。");
       return;
     }
-    if (error instanceof DeviceAuthError && error.code === "expired_token") {
-      await pendingLoginStore.clear();
+    if (
+      error instanceof DeviceAuthError &&
+      ["expired_token", "access_denied", "authorization_declined"].includes(
+        error.code,
+      )
+    ) {
+      await clearPendingLogin(pendingLoginStore, pending);
     }
     throw error;
   }
@@ -231,7 +266,7 @@ async function pollPendingDeviceLogin({
     tokenStore,
     url,
   });
-  await pendingLoginStore.clear();
+  await clearPendingLogin(pendingLoginStore, pending);
   const result = {
     status: "success",
     message: "登录成功",
@@ -338,7 +373,8 @@ export async function logout({
   }
 
   await tokenStore.clear();
-  await pendingLoginStore.clear();
+  const pending = await pendingLoginStore.load();
+  await clearPendingLogin(pendingLoginStore, pending);
   await clearLegacyApiKey({ home, dryRun: false });
   console.log("已退出登录，并从系统凭据库清除令牌和旧版兼容凭据。");
 }
@@ -402,6 +438,14 @@ export async function runCli(argv = process.argv.slice(2)) {
   }
 
   const home = path.resolve(options.home || os.homedir());
+  if (options.command === "skill") {
+    await printSkillRefresh({
+      home,
+      force: options.force,
+      json: options.json,
+    });
+    return;
+  }
   const url = validateMcpUrl(options.url || MCP_URL, {
     allowLocalhost: options.allowLocalhost,
   });

package/src/constants.js

@@ -1,5 +1,5 @@
 export const PACKAGE_NAME = "@bigbrain-work/mcp-connect";
-export const PACKAGE_VERSION = "1.3.0";
+export const PACKAGE_VERSION = "1.3.1";
 export const SERVER_NAME = "shiliu_mcp";
 export const MCP_URL = "https://api.bigbrain.work/shiliu/mcp";
 export const AUTH_URL = "https://api.bigbrain.work/shiliu/auth/device";

package/src/device-auth-client.js

@@ -1,3 +1,7 @@
+import { chmod, mkdir, readdir, stat, unlink } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+
 import QRCode from "qrcode";
 
 import { AUTH_URL } from "./constants.js";
@@ -97,6 +101,77 @@ export async function renderQrCode(value) {
   });
 }
 
+const QR_CODE_DIRECTORY = "shiliu-ai";
+const QR_CODE_PREFIX = "shiliu-login-";
+const QR_CODE_MAX_AGE_MS = 15 * 60 * 1000;
+
+function qrCodeDirectory(temporaryDirectory = os.tmpdir()) {
+  return path.resolve(temporaryDirectory, QR_CODE_DIRECTORY);
+}
+
+function isManagedQrCodePath(filePath, temporaryDirectory = os.tmpdir()) {
+  if (typeof filePath !== "string" || filePath.length === 0) return false;
+  const resolvedPath = path.resolve(filePath);
+  return (
+    path.dirname(resolvedPath) === qrCodeDirectory(temporaryDirectory) &&
+    path.basename(resolvedPath).startsWith(QR_CODE_PREFIX) &&
+    path.extname(resolvedPath).toLowerCase() === ".png"
+  );
+}
+
+async function removeStaleQrCodes(directory, now) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  await Promise.all(
+    entries
+      .filter(
+        (entry) =>
+          entry.isFile() &&
+          entry.name.startsWith(QR_CODE_PREFIX) &&
+          entry.name.endsWith(".png"),
+      )
+      .map(async (entry) => {
+        const filePath = path.join(directory, entry.name);
+        const metadata = await stat(filePath);
+        if (now() - metadata.mtimeMs > QR_CODE_MAX_AGE_MS) {
+          await unlink(filePath).catch(() => {});
+        }
+      }),
+  );
+}
+
+export async function createLoginQrCode(
+  value,
+  sessionId,
+  { temporaryDirectory = os.tmpdir(), now = Date.now } = {},
+) {
+  if (!/^[A-Z0-9-]{4,64}$/u.test(sessionId)) {
+    throw new Error("登录会话编号格式无效");
+  }
+  const directory = qrCodeDirectory(temporaryDirectory);
+  await mkdir(directory, { recursive: true, mode: 0o700 });
+  await removeStaleQrCodes(directory, now);
+  const filePath = path.join(directory, `${QR_CODE_PREFIX}${sessionId}.png`);
+  await QRCode.toFile(filePath, value, {
+    type: "png",
+    errorCorrectionLevel: "M",
+    margin: 2,
+    width: 480,
+  });
+  await chmod(filePath, 0o600).catch(() => {});
+  return path.resolve(filePath);
+}
+
+export async function removeLoginQrCode(
+  filePath,
+  { temporaryDirectory = os.tmpdir() } = {},
+) {
+  if (!isManagedQrCodePath(filePath, temporaryDirectory)) return false;
+  await unlink(filePath).catch((error) => {
+    if (error?.code !== "ENOENT") throw error;
+  });
+  return true;
+}
+
 function defaultSleep(milliseconds) {
   return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }

package/src/proxy.js

@@ -20,12 +20,14 @@ export async function runProxy({
   authUrl = AUTH_URL,
   platform = process.platform,
   env = process.env,
+  tokenStore,
 } = {}) {
   const authorization = await resolveAuthorization({
     home,
     platform,
     env,
     authUrl,
+    tokenStore,
   });
   if (!authorization.token) {
     throw new Error(

package/src/skill-refresh.js

@@ -0,0 +1,202 @@
+import { spawnSync } from "node:child_process";
+import {
+  mkdir,
+  open,
+  readFile,
+  stat,
+  unlink,
+  writeFile,
+} from "node:fs/promises";
+import path from "node:path";
+
+export const SKILL_REFRESH_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export const SHILIU_SKILL_NAME = "shiliu-ai-mcp";
+const STALE_LOCK_MS = 15 * 60 * 1000;
+
+function stateFile(home) {
+  return path.join(home, ".shiliu-ai", "skill-refresh.json");
+}
+
+function lockFile(home) {
+  return path.join(home, ".shiliu-ai", "skill-refresh.lock");
+}
+
+async function acquireLock(home, retried = false) {
+  await mkdir(path.dirname(lockFile(home)), { recursive: true });
+  let handle;
+  try {
+    handle = await open(lockFile(home), "wx", 0o600);
+    await handle.writeFile(`${process.pid}\n`, "utf8");
+  } catch (error) {
+    await handle?.close();
+    if (error.code === "EEXIST") {
+      if (!retried) {
+        try {
+          const lockStat = await stat(lockFile(home));
+          if (Date.now() - lockStat.mtimeMs >= STALE_LOCK_MS) {
+            await unlink(lockFile(home));
+            return acquireLock(home, true);
+          }
+        } catch (lockError) {
+          if (lockError.code === "ENOENT") return acquireLock(home, true);
+          throw lockError;
+        }
+      }
+      return null;
+    }
+    throw error;
+  }
+  await handle.close();
+  return async () => {
+    try {
+      await unlink(lockFile(home));
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  };
+}
+
+async function readState(home) {
+  try {
+    const value = JSON.parse(await readFile(stateFile(home), "utf8"));
+    if (value?.version === 1 && value.scopes && typeof value.scopes === "object") {
+      return value;
+    }
+  } catch (error) {
+    if (error.code !== "ENOENT" && error.name !== "SyntaxError") throw error;
+  }
+  return { version: 1, scopes: {} };
+}
+
+async function writeState(home, state) {
+  const file = stateFile(home);
+  await mkdir(path.dirname(file), { recursive: true });
+  await writeFile(file, `${JSON.stringify(state, null, 2)}\n`, {
+    encoding: "utf8",
+    mode: 0o600,
+  });
+}
+
+function defaultRunUpdate({ cwd, platform = process.platform }) {
+  const command = platform === "win32" ? "npx.cmd" : "npx";
+  const result = spawnSync(
+    command,
+    ["-y", "skills", "update", SHILIU_SKILL_NAME, "-y"],
+    {
+      cwd,
+      encoding: "utf8",
+      windowsHide: true,
+      shell: false,
+      maxBuffer: 1024 * 1024,
+    },
+  );
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    throw new Error(
+      result.stderr?.trim() ||
+        result.stdout?.trim() ||
+        `skills update 返回退出码 ${result.status}`,
+    );
+  }
+}
+
+function validTimestamp(value) {
+  const timestamp = Date.parse(value || "");
+  return Number.isFinite(timestamp) ? timestamp : null;
+}
+
+export async function refreshShiliuSkill({
+  home,
+  cwd = process.cwd(),
+  now = Date.now(),
+  force = false,
+  intervalMs = SKILL_REFRESH_INTERVAL_MS,
+  runUpdate = defaultRunUpdate,
+} = {}) {
+  if (!home) throw new Error("缺少用户目录，无法记录 Skill 检查时间");
+  const scope = path.resolve(cwd);
+  const state = await readState(home);
+  const previous = state.scopes[scope] || {};
+  const lastAttemptAt = validTimestamp(previous.lastAttemptAt);
+  if (!force && lastAttemptAt !== null && now - lastAttemptAt < intervalMs) {
+    return {
+      status: "skipped",
+      reason: "within_interval",
+      nextCheckAt: new Date(lastAttemptAt + intervalMs).toISOString(),
+    };
+  }
+
+  const releaseLock = await acquireLock(home);
+  if (!releaseLock) {
+    return {
+      status: "skipped",
+      reason: "refresh_in_progress",
+    };
+  }
+
+  try {
+    const latestState = await readState(home);
+    const latestPrevious = latestState.scopes[scope] || {};
+    const latestAttemptAt = validTimestamp(latestPrevious.lastAttemptAt);
+    if (
+      !force &&
+      latestAttemptAt !== null &&
+      now - latestAttemptAt < intervalMs
+    ) {
+      return {
+        status: "skipped",
+        reason: "within_interval",
+        nextCheckAt: new Date(latestAttemptAt + intervalMs).toISOString(),
+      };
+    }
+
+    const attemptedAt = new Date(now).toISOString();
+    latestState.scopes[scope] = {
+      ...latestPrevious,
+      lastAttemptAt: attemptedAt,
+    };
+    await writeState(home, latestState);
+
+    try {
+      await runUpdate({ cwd: scope });
+      latestState.scopes[scope].lastSuccessAt = attemptedAt;
+      await writeState(home, latestState);
+      return {
+        status: "checked",
+        checkedAt: attemptedAt,
+        nextCheckAt: new Date(now + intervalMs).toISOString(),
+      };
+    } catch (error) {
+      return {
+        status: "failed",
+        checkedAt: attemptedAt,
+        nextCheckAt: new Date(now + intervalMs).toISOString(),
+        message: error.message,
+      };
+    }
+  } finally {
+    await releaseLock();
+  }
+}
+
+export async function printSkillRefresh(options = {}) {
+  const result = await refreshShiliuSkill(options);
+  if (options.json) {
+    console.log(JSON.stringify(result, null, 2));
+    return result;
+  }
+  if (result.status === "skipped") {
+    console.log(
+      result.reason === "refresh_in_progress"
+        ? "另一个石榴 Skill 检查正在进行，本次继续使用已安装 Skill。"
+        : `石榴 Skill 在24小时内已检查，下次检查时间：${result.nextCheckAt}`,
+    );
+  } else if (result.status === "checked") {
+    console.log(`石榴 Skill 检查完成，下次检查时间：${result.nextCheckAt}`);
+  } else {
+    console.warn(
+      `石榴 Skill 检查失败：${result.message}。已进入24小时冷却，本次继续使用已安装 Skill。`,
+    );
+  }
+  return result;
+}

package/src/token-store.js

@@ -84,6 +84,7 @@ function validatePendingLogin(value) {
     typeof value.expiresAt !== "number" ||
     typeof value.interval !== "number" ||
     typeof value.authUrl !== "string" ||
+    (value.qrCodePath !== undefined && typeof value.qrCodePath !== "string") ||
     (value.allowLocalhost !== undefined &&
       typeof value.allowLocalhost !== "boolean")
   ) {