@fateforge/archery-cli 1.0.7 → 1.0.8

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [1.0.8] - 2026-06-17
+
+### Fixed
+
+- **2FA login now works against real Archery.** Session-mode login posted the OTP to `/api/v1/user/2fa/` (the 2FA *config* endpoint) instead of `/api/v1/user/2fa/verify/`, and never replayed the temp `session_key` from `/authenticate/` as the `sessionid` cookie — so the verify view could not find the password-verified user and rejected every code as wrong/expired, even when correct. The OTP is now posted to `/api/v1/user/2fa/verify/` with the temp session replayed as the `sessionid` cookie, matching Archery's real handshake. Verified live against `hhyo/archery:v1.8.5` (correct code logs in and caches the session; a wrong code returns the server's `验证码不正确！`). The prior unit test was self-fulfilling (its mock accepted exactly what the client sent); it now faithfully encodes the real contract — correct endpoint plus replayed session cookie — so a regression on either half fails the test.
+
 ## [1.0.7] - 2026-06-16
 
 ### Fixed

package/docs/LIVE-SMOKE-EVIDENCE.md

@@ -361,6 +361,24 @@ intermittently returned `用户名或密码错误`. Using `http://127.0.0.1:9123
 defect; the session login flow itself (GET csrf → POST authenticate → cookie)
 matches the verified curl flow byte-for-byte.
 
+## 2026-06-17 — 1.0.8 real 2FA login round-trip (closes the prior 2FA gap)
+
+The earlier runs could only mock 2FA because the `cli_verify` account had no 2FA
+enabled. A dedicated TOTP account was seeded on the same `tools-e2e-archery`
+container (`hhyo/archery:v1.8.5`) — user `cli2fa`, `TwoFactorAuthConfig` with a
+known base32 secret — so valid codes can be minted with `pyotp` and the real
+`/authenticate/` → `/api/v1/user/2fa/verify/` handshake is exercised end to end.
+
+| Check | Status | Evidence |
+|-------|--------|----------|
+| Correct OTP completes login | live | PASS — `auth login --otp <fresh>` → `ok:true`, "session cookie cached successfully". The OTP is posted to `/api/v1/user/2fa/verify/` with the temp `session_key` replayed as the `sessionid` cookie. |
+| Cached 2FA session is usable | live | PASS — a following `doctor --region local` (no OTP) shows `authValid:true`, `username:cli2fa`, `mode:session`. |
+| Wrong OTP rejected cleanly | live | PASS — `--otp 000000` → `ok:false`, server message `验证码不正确！` (real `TwoFAVerify` rejection, not the client's generic fallback). |
+| Wrong endpoint regression guard | unit | The faithful mock now requires `/api/v1/user/2fa/verify/` **and** the replayed `sessionid` cookie; reverting either half fails `TestEnsureSession_2FAWithOTPSucceeds`. |
+
+This **closes the "honest gap"** recorded for 1.0.5 below: the real
+`/api/v1/user/2fa/verify/` round-trip is now live-verified.
+
 ## 2026-06-16 — 1.0.5 features (read-only, 2FA, param unification, detail rework)
 
 Verified against the same `tools-e2e-archery` container (`hhyo/archery:v1.8.5`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fateforge/archery-cli",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Archery SQL audit CLI for AI Agents - manage SQL workflows, queries, instances, diagnostics, and data dictionaries with a machine-readable contract",
   "keywords": [
     "archery",
@@ -25,13 +25,17 @@
   "bin": {
     "archery-cli": "scripts/run.js"
   },
+  "scripts": {
+    "version": "node scripts/sync-version.js",
+    "check-version": "node scripts/check-version.js"
+  },
   "optionalDependencies": {
-    "@fateforge/archery-cli-darwin-arm64": "1.0.7",
-    "@fateforge/archery-cli-darwin-x64": "1.0.7",
-    "@fateforge/archery-cli-linux-arm64": "1.0.7",
-    "@fateforge/archery-cli-linux-x64": "1.0.7",
-    "@fateforge/archery-cli-win32-arm64": "1.0.7",
-    "@fateforge/archery-cli-win32-x64": "1.0.7"
+    "@fateforge/archery-cli-darwin-arm64": "1.0.8",
+    "@fateforge/archery-cli-darwin-x64": "1.0.8",
+    "@fateforge/archery-cli-linux-arm64": "1.0.8",
+    "@fateforge/archery-cli-linux-x64": "1.0.8",
+    "@fateforge/archery-cli-win32-arm64": "1.0.8",
+    "@fateforge/archery-cli-win32-x64": "1.0.8"
   },
   "files": [
     "scripts/run.js",

package/skills/archery-cli/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: archery-cli
-version: "1.0.7"
+version: "1.0.8"
 description: "Archery SQL audit platform CLI for managing SQL workflows, queries, instances, diagnostics. Use when the user asks about SQL审核, database operations, Archery platform management, or needs to submit/review/execute SQL against database instances."
 license: MIT
 user-invocable: true
-metadata: {"requires":{"bins":["archery-cli"],"min_version":"1.0.7"}}
+metadata: {"requires":{"bins":["archery-cli"],"min_version":"1.0.8"}}
 ---
 
 # archery-cli