@glrs-dev/assume 0.12.2 → 0.14.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +34 -0
- package/package.json +5 -5
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,39 @@
|
|
|
1
1
|
# @glrs-dev/assume
|
|
2
2
|
|
|
3
|
+
## 0.14.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- [#297](https://github.com/iceglober/glrs/pull/297) [`19da75b`](https://github.com/iceglober/glrs/commit/19da75b071f3a7aa7af228e3812e63e3e0da4a5f) Thanks [@iceglober](https://github.com/iceglober)! - `gsa` MCP tool `run_with_credentials` now accepts an optional `env` parameter for additional environment variables.
|
|
8
|
+
|
|
9
|
+
Agents can pass repo-specific env vars (cert paths, confirmation flags, service addresses, …) alongside the injected AWS credentials — a pure pass-through, no repo knowledge on gsa's side. The command still runs in the gsa MCP server's working directory (the workspace root it was launched in), so relative paths work like the bash tool.
|
|
10
|
+
|
|
11
|
+
```
|
|
12
|
+
run_with_credentials(
|
|
13
|
+
command: "node_modules/.bin/tsx scripts/tsx/backfill.ts",
|
|
14
|
+
context: "production / developer",
|
|
15
|
+
env: { "CONFIRM_PRODUCTION": "yes", "TEMPORAL_NAMESPACE": "kn-prod" }
|
|
16
|
+
)
|
|
17
|
+
```
|
|
18
|
+
|
|
19
|
+
Values must be strings; invalid names or non-string values return a clear invalid-params error. The gsa-injected `AWS_*` credential and region vars take precedence and cannot be overridden by `env`. Env var names (not values) are recorded in the audit log.
|
|
20
|
+
|
|
21
|
+
## 0.13.0
|
|
22
|
+
|
|
23
|
+
### Minor Changes
|
|
24
|
+
|
|
25
|
+
- [#292](https://github.com/iceglober/glrs/pull/292) [`f954712`](https://github.com/iceglober/glrs/commit/f9547129dd13c00ee316eb012bc087326a6307b7) Thanks [@iceglober](https://github.com/iceglober)! - GCP now wraps the gcloud CLI instead of reimplementing Google OAuth.
|
|
26
|
+
|
|
27
|
+
Previously glrs ran its own Google OAuth (gcloud's client ID, auth-code flow, raw refresh-token grants) and emulated the GCE metadata server. Under an org that enforces reauth, raw refresh grants are rejected (`invalid_rapt`) and glrs had no reauth flow, so GCP wedged — and the emulated `GCE_METADATA_HOST` shadowed gcloud's own credentials.
|
|
28
|
+
|
|
29
|
+
glrs now delegates GCP auth to gcloud, the idiomatic local-dev path:
|
|
30
|
+
|
|
31
|
+
- `gsa login gcp` runs `gcloud auth login` + `gcloud auth application-default login` (interactive — satisfies org reauth and writes a proper ADC).
|
|
32
|
+
- Credentials are delivered by gcloud's **Application Default Credentials**, not the daemon. glrs no longer sets `GCE_METADATA_HOST`; apps read gcloud's ADC natively. The daemon binds no GCP endpoint.
|
|
33
|
+
- Contexts are projects via `gcloud projects list`; `gsa use gcp <project>` sets `GOOGLE_CLOUD_PROJECT` (and `--default` also `gcloud config set project`); `gsa exec`/agent mint a token via `gcloud ... print-access-token`.
|
|
34
|
+
- When gcloud needs interactive reauth, the next command surfaces "run: gsa login gcp" (via the needs-login marker) instead of leaking a raw token-endpoint error.
|
|
35
|
+
- **Requires the Google Cloud SDK (`gcloud`) on PATH** for GCP; the in-house OAuth/ADC writer/metadata emulation are removed. AWS is unaffected.
|
|
36
|
+
|
|
3
37
|
## 0.12.2
|
|
4
38
|
|
|
5
39
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@glrs-dev/assume",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.14.0",
|
|
4
4
|
"publishConfig": {
|
|
5
5
|
"access": "public"
|
|
6
6
|
},
|
|
@@ -51,9 +51,9 @@
|
|
|
51
51
|
"typescript": "^5"
|
|
52
52
|
},
|
|
53
53
|
"optionalDependencies": {
|
|
54
|
-
"@glrs-dev/assume-darwin-arm64": "0.
|
|
55
|
-
"@glrs-dev/assume-darwin-x64": "0.
|
|
56
|
-
"@glrs-dev/assume-linux-x64": "0.
|
|
57
|
-
"@glrs-dev/assume-linux-arm64": "0.
|
|
54
|
+
"@glrs-dev/assume-darwin-arm64": "0.14.0",
|
|
55
|
+
"@glrs-dev/assume-darwin-x64": "0.14.0",
|
|
56
|
+
"@glrs-dev/assume-linux-x64": "0.14.0",
|
|
57
|
+
"@glrs-dev/assume-linux-arm64": "0.14.0"
|
|
58
58
|
}
|
|
59
59
|
}
|