@kitae9999/openlog-cli 0.2.0 → 1.1.0

package/README.md

@@ -8,16 +8,24 @@ npx -y @kitae9999/openlog-cli whoami
 npx -y @kitae9999/openlog-cli mcp
 ```
 
-MCP tools:
+Local MCP permissions:
 
-- `get_auth_status`
-- `get_me`
-- `list_my_notifications`
-- `list_my_posts`
-- `list_my_liked_posts`
-- `upload_post_image`
-- `publish_post`
-- `get_post_detail`
+```bash
+openlog mcp permissions
+openlog mcp permissions set read-only
+openlog mcp permissions set safe-write
+openlog mcp permissions set full
+openlog mcp permissions reset
+```
+
+`safe-write` is the default. Permission changes apply after the MCP server is restarted or reloaded.
+
+MCP tool groups:
+
+- Account and posts: authentication, notifications, authored/liked posts, image upload, post detail, and confirmed publishing
+- Workspace context: workspace discovery, activity, working brief, tasks, logs, todos, memories, outputs, and graph links
+- Safe writes: create/update, todo completion, link creation, image upload, and confirmed output/post publishing
+- Full-only writes: individual workspace-document/link deletes and working-brief clear
 
 MCP client configuration:
 
@@ -34,3 +42,5 @@ MCP client configuration:
 
 Set `OPENLOG_API_BASE_URL` to point at a non-production API. Set
 `OPENLOG_WEB_BASE_URL` to control absolute post URLs returned by `publish_post`.
+Set `OPENLOG_MCP_CONFIG_FILE` to replace the default
+`~/.openlog/mcp-config.json` permission file.

package/dist/api-client.js

@@ -12,9 +12,14 @@ export class ApiError extends Error {
 export class OpenLogApiClient {
     apiBaseUrl;
     accessToken;
+    refreshToken;
+    onTokenRefresh;
+    refreshPromise;
     constructor(options = {}) {
         this.apiBaseUrl = (options.apiBaseUrl ?? getApiBaseUrl()).replace(/\/$/, "");
         this.accessToken = options.accessToken;
+        this.refreshToken = options.refreshToken;
+        this.onTokenRefresh = options.onTokenRefresh;
     }
     async get(path) {
         return this.request(path, { method: "GET" });
@@ -26,6 +31,20 @@ export class OpenLogApiClient {
             body: body ? JSON.stringify(body) : undefined,
         });
     }
+    async put(path, body) {
+        return this.request(path, {
+            method: "PUT",
+            headers: body ? { "content-type": "application/json" } : undefined,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
+    async patch(path, body) {
+        return this.request(path, {
+            method: "PATCH",
+            headers: body ? { "content-type": "application/json" } : undefined,
+            body: body ? JSON.stringify(body) : undefined,
+        });
+    }
     async postNoContent(path, body) {
         await this.request(path, {
             method: "POST",
@@ -40,7 +59,10 @@ export class OpenLogApiClient {
             body: body ? JSON.stringify(body) : undefined,
         });
     }
-    async request(path, init) {
+    async deleteNoContent(path) {
+        await this.request(path, { method: "DELETE" });
+    }
+    async request(path, init, allowRefresh = true) {
         const url = `${this.apiBaseUrl}${path}`;
         const response = await fetch(url, {
             ...init,
@@ -51,15 +73,54 @@ export class OpenLogApiClient {
                     : {}),
             },
         });
+        if (response.status === 401 && allowRefresh && this.refreshToken) {
+            await this.refreshAccessToken();
+            return this.request(path, init, false);
+        }
         if (!response.ok) {
             throw new ApiError(response.status, url, await readErrorMessage(response));
         }
         if (response.status === 204) {
             return undefined;
         }
-        return (await response.json());
+        const responseBody = await response.text();
+        if (!responseBody) {
+            return undefined;
+        }
+        return JSON.parse(responseBody);
+    }
+    async refreshAccessToken() {
+        if (!this.refreshPromise) {
+            this.refreshPromise = this.performTokenRefresh().finally(() => {
+                this.refreshPromise = undefined;
+            });
+        }
+        await this.refreshPromise;
+    }
+    async performTokenRefresh() {
+        const response = await fetch(`${this.apiBaseUrl}/auth/device/refresh`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ refreshToken: this.refreshToken }),
+        });
+        if (!response.ok) {
+            throw new ApiError(response.status, `${this.apiBaseUrl}/auth/device/refresh`, await readErrorMessage(response));
+        }
+        const tokens = (await response.json());
+        if (!isRefreshedTokens(tokens)) {
+            throw new Error("OpenLog refresh response is incomplete.");
+        }
+        this.accessToken = tokens.accessToken;
+        this.refreshToken = tokens.refreshToken;
+        await this.onTokenRefresh?.(tokens);
     }
 }
+function isRefreshedTokens(value) {
+    return Boolean(value.accessToken &&
+        value.refreshToken &&
+        Number.isFinite(value.expiresIn) &&
+        Number.isFinite(value.refreshExpiresIn));
+}
 async function readErrorMessage(response) {
     try {
         const body = (await response.json());

package/dist/auth-store.js

@@ -10,8 +10,11 @@ export async function readAuthFile() {
         }
         return {
             accessToken: parsed.accessToken,
+            refreshToken: parsed.refreshToken,
             apiBaseUrl: parsed.apiBaseUrl,
             createdAt: parsed.createdAt,
+            accessTokenExpiresAt: parsed.accessTokenExpiresAt,
+            refreshTokenExpiresAt: parsed.refreshTokenExpiresAt,
         };
     }
     catch (error) {
@@ -24,20 +27,40 @@ export async function readAuthFile() {
         throw error;
     }
 }
-export async function writeAuthFile(accessToken) {
+export async function writeAuthFile(tokens) {
     const authFile = {
-        accessToken,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
         apiBaseUrl: getApiBaseUrl(),
         createdAt: new Date().toISOString(),
+        accessTokenExpiresAt: expiresAt(tokens.expiresIn),
+        refreshTokenExpiresAt: expiresAt(tokens.refreshExpiresIn),
     };
+    await persistAuthFile(authFile);
+    return authFile;
+}
+export async function updateAuthFileTokens(authFile, tokens) {
+    const updatedAuthFile = {
+        ...authFile,
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        accessTokenExpiresAt: expiresAt(tokens.expiresIn),
+        refreshTokenExpiresAt: expiresAt(tokens.refreshExpiresIn),
+    };
+    await persistAuthFile(updatedAuthFile);
+    return updatedAuthFile;
+}
+async function persistAuthFile(authFile) {
     const authFilePath = getAuthFilePath();
     await mkdir(path.dirname(authFilePath), { recursive: true, mode: 0o700 });
     await writeFile(authFilePath, `${JSON.stringify(authFile, null, 2)}\n`, {
         mode: 0o600,
     });
     await chmod(authFilePath, 0o600);
-    return authFile;
 }
 export async function deleteAuthFile() {
     await rm(getAuthFilePath(), { force: true });
 }
+function expiresAt(expiresIn) {
+    return new Date(Date.now() + expiresIn * 1000).toISOString();
+}

package/dist/authenticated-client.js

@@ -0,0 +1,34 @@
+import { OpenLogApiClient } from "./api-client.js";
+import { readAuthFile, updateAuthFileTokens, } from "./auth-store.js";
+let cachedClient;
+export async function createAuthenticatedApiClient() {
+    const authFile = await readAuthFile();
+    if (!authFile) {
+        throw new Error("Run `openlog login` before using OpenLog.");
+    }
+    const fingerprint = authFingerprint(authFile);
+    if (cachedClient?.fingerprint === fingerprint) {
+        return cachedClient.client;
+    }
+    const client = new OpenLogApiClient({
+        accessToken: authFile.accessToken,
+        refreshToken: authFile.refreshToken,
+        apiBaseUrl: authFile.apiBaseUrl,
+        onTokenRefresh: async (tokens) => {
+            const updatedAuthFile = await updateAuthFileTokens(authFile, tokens);
+            cachedClient = {
+                fingerprint: authFingerprint(updatedAuthFile),
+                client,
+            };
+        },
+    });
+    cachedClient = { fingerprint, client };
+    return client;
+}
+function authFingerprint(authFile) {
+    return [
+        authFile.apiBaseUrl,
+        authFile.accessToken,
+        authFile.refreshToken ?? "",
+    ].join("\u0000");
+}

package/dist/config.js

@@ -12,3 +12,7 @@ export function getAuthFilePath() {
     return (process.env.OPENLOG_AUTH_FILE ??
         path.join(os.homedir(), ".openlog", "auth.json"));
 }
+export function getMcpConfigFilePath() {
+    return (process.env.OPENLOG_MCP_CONFIG_FILE ??
+        path.join(os.homedir(), ".openlog", "mcp-config.json"));
+}

package/dist/index.js

@@ -4,6 +4,8 @@ import { login } from "./login.js";
 import { runMcpServer } from "./mcp-server.js";
 import { installMcp, printMcpInstallHelp } from "./mcp-install.js";
 import { ApiError, OpenLogApiClient } from "./api-client.js";
+import { createAuthenticatedApiClient } from "./authenticated-client.js";
+import { runMcpPermissionsCommand } from "./mcp-permissions-command.js";
 const command = process.argv[2] ?? "help";
 const subcommand = process.argv[3];
 try {
@@ -11,8 +13,7 @@ try {
         await login();
     }
     else if (command === "logout") {
-        await deleteAuthFile();
-        console.log("Logged out.");
+        await logout();
     }
     else if (command === "whoami") {
         await whoami();
@@ -21,10 +22,12 @@ try {
         if (subcommand === "install") {
             await installMcpCommand();
         }
+        else if (subcommand === "permissions") {
+            await runMcpPermissionsCommand(process.argv.slice(4));
+        }
         else if (subcommand === undefined ||
             subcommand === "serve" ||
             subcommand === "start") {
-            printMcpStartupHint();
             await runMcpServer();
         }
         else {
@@ -56,46 +59,27 @@ async function installMcpCommand() {
     });
 }
 async function whoami() {
-    const authFile = await readAuthFile();
-    if (!authFile) {
-        throw new Error("Not logged in. Run `openlog login` first.");
-    }
-    const apiClient = new OpenLogApiClient({
-        accessToken: authFile.accessToken,
-        apiBaseUrl: authFile.apiBaseUrl,
-    });
+    const apiClient = await createAuthenticatedApiClient();
     const me = await apiClient.get("/auth/me");
     console.log(JSON.stringify(me, null, 2));
 }
-function printMcpStartupHint() {
-    if (!process.stderr.isTTY) {
-        return;
-    }
-    console.error(`OpenLog MCP server is running over stdio.
-
-This terminal is now reserved for MCP protocol traffic.
-Press Ctrl+C to stop it.
-
-To use it from an MCP client, add:
-{
-  "mcpServers": {
-    "openlog": {
-      "command": "openlog",
-      "args": ["mcp"]
+async function logout() {
+    const authFile = await readAuthFile();
+    if (authFile?.refreshToken) {
+        try {
+            const apiClient = new OpenLogApiClient({
+                apiBaseUrl: authFile.apiBaseUrl,
+            });
+            await apiClient.postNoContent("/auth/device/revoke", {
+                refreshToken: authFile.refreshToken,
+            });
+        }
+        catch (error) {
+            console.error(`Warning: remote session revoke failed: ${formatCliError(error)}`);
+        }
     }
-  }
-}
-
-Available tools:
-  get_auth_status
-  get_me
-  list_my_notifications
-  list_my_posts
-  list_my_liked_posts
-  upload_post_image
-  publish_post
-  get_post_detail
-`);
+    await deleteAuthFile();
+    console.log("Logged out.");
 }
 function printHelp() {
     console.log(`OpenLog CLI
@@ -109,11 +93,19 @@ Usage:
                   Register OpenLog MCP with Codex
   openlog mcp install claude-code
                   Register OpenLog MCP with Claude Code
+  openlog mcp permissions
+                  Show the active local MCP permission profile
+  openlog mcp permissions set read-only|safe-write|full
+                  Change the local MCP permission profile
+  openlog mcp permissions reset
+                  Restore the default safe-write profile
 
 Environment:
   OPENLOG_API_BASE_URL  Override the OpenLog API base URL
   OPENLOG_WEB_BASE_URL  Override the OpenLog web base URL for published post links
   OPENLOG_AUTH_FILE     Override the local auth file path
+  OPENLOG_MCP_CONFIG_FILE
+                        Override the local MCP permission config path
 `);
 }
 function formatCliError(error) {

package/dist/login.js

@@ -14,18 +14,18 @@ export async function login() {
         ? "The approval page was opened in your browser."
         : "Open the URL above in your browser.");
     console.log("Waiting for approval...");
-    const accessToken = await pollForAccessToken(apiClient, deviceLogin);
-    await writeAuthFile(accessToken);
+    const tokens = await pollForTokens(apiClient, deviceLogin);
+    await writeAuthFile(tokens);
     console.log("Login successful.");
 }
-async function pollForAccessToken(apiClient, deviceLogin) {
+async function pollForTokens(apiClient, deviceLogin) {
     const deadline = Date.now() + deviceLogin.expiresIn * 1000;
     let interval = deviceLogin.interval;
     while (Date.now() < deadline) {
         await sleep(interval * 1000);
         const response = await apiClient.post("/auth/device/token", { deviceCode: deviceLogin.deviceCode });
         if (response.status === "APPROVED") {
-            return response.accessToken;
+            return response;
         }
         interval = response.interval ?? interval;
     }

package/dist/mcp-install.js

@@ -28,7 +28,8 @@ Aliases:
   claude      Same as claude-code
 
 Notes:
-  If OPENLOG_API_BASE_URL or OPENLOG_WEB_BASE_URL is set, it is added to the client config.
+  If OPENLOG_API_BASE_URL, OPENLOG_WEB_BASE_URL, or OPENLOG_MCP_CONFIG_FILE is set,
+  it is added to the client config.
 `);
 }
 function buildServerConfig() {
@@ -41,6 +42,9 @@ function buildServerConfig() {
     if (webBaseUrl !== DEFAULT_WEB_BASE_URL) {
         env.OPENLOG_WEB_BASE_URL = webBaseUrl;
     }
+    if (process.env.OPENLOG_MCP_CONFIG_FILE) {
+        env.OPENLOG_MCP_CONFIG_FILE = process.env.OPENLOG_MCP_CONFIG_FILE;
+    }
     return {
         command: "openlog",
         args: ["mcp"],

package/dist/mcp-permissions-command.js

@@ -0,0 +1,45 @@
+import { isMcpPermissionProfile, readMcpPermissions, resetMcpPermissions, writeMcpPermissionProfile, } from "./mcp-permissions.js";
+export async function runMcpPermissionsCommand(args, writeOutput = console.log) {
+    const action = args[0] ?? "show";
+    if ((action === "show" && args.length === 1) || args.length === 0) {
+        writeOutput(formatPermissions(await readMcpPermissions()));
+        return;
+    }
+    if (action === "set" && args.length === 2) {
+        const profile = args[1];
+        if (!isMcpPermissionProfile(profile)) {
+            throw new Error(permissionUsage());
+        }
+        const permissions = await writeMcpPermissionProfile(profile);
+        writeOutput(formatPermissions(permissions));
+        // 실행 중인 MCP server는 시작 시 권한을 확정하므로 재시작 안내가 필요하다.
+        writeOutput("Restart or reload the OpenLog MCP server to apply this profile.");
+        return;
+    }
+    if (action === "reset" && args.length === 1) {
+        const permissions = await resetMcpPermissions();
+        writeOutput(formatPermissions(permissions));
+        writeOutput("Restart or reload the OpenLog MCP server to apply this profile.");
+        return;
+    }
+    throw new Error(permissionUsage());
+}
+export function permissionUsage() {
+    return `OpenLog MCP permissions
+
+Usage:
+  openlog mcp permissions
+  openlog mcp permissions show
+  openlog mcp permissions set read-only
+  openlog mcp permissions set safe-write
+  openlog mcp permissions set full
+  openlog mcp permissions reset`;
+}
+function formatPermissions(permissions) {
+    return [
+        `Profile: ${permissions.profile}`,
+        `Capabilities: ${permissions.capabilities.join(", ")}`,
+        `Source: ${permissions.configured ? "local config" : "default"}`,
+        ...(permissions.updatedAt ? [`Updated: ${permissions.updatedAt}`] : []),
+    ].join("\n");
+}

package/dist/mcp-permissions.js

@@ -0,0 +1,103 @@
+import { chmod, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { getMcpConfigFilePath } from "./config.js";
+export const MCP_PERMISSION_PROFILES = [
+    "read-only",
+    "safe-write",
+    "full",
+];
+export const MCP_CAPABILITIES = ["read", "write", "publish", "delete"];
+export const DEFAULT_MCP_PERMISSION_PROFILE = "safe-write";
+const PROFILE_CAPABILITIES = {
+    // 프로필은 상위 프로필이 하위 capability를 모두 포함하도록 누적 구성한다.
+    "read-only": ["read"],
+    "safe-write": ["read", "write", "publish"],
+    full: ["read", "write", "publish", "delete"],
+};
+export async function readMcpPermissions() {
+    const filePath = getMcpConfigFilePath();
+    let content;
+    try {
+        content = await readFile(filePath, "utf8");
+    }
+    catch (error) {
+        if (hasErrorCode(error, "ENOENT")) {
+            // 설정 파일이 없는 최초 실행은 기존 동작과 호환되는 safe-write를 사용한다.
+            return resolvePermissions(DEFAULT_MCP_PERMISSION_PROFILE, false, null);
+        }
+        throw error;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        throw invalidConfigError(filePath, "file is not valid JSON");
+    }
+    const config = parsePermissionConfig(parsed, filePath);
+    return resolvePermissions(config.profile, true, config.updatedAt);
+}
+export async function writeMcpPermissionProfile(profile) {
+    const filePath = getMcpConfigFilePath();
+    const config = {
+        version: 1,
+        profile,
+        updatedAt: new Date().toISOString(),
+    };
+    await mkdir(path.dirname(filePath), { recursive: true, mode: 0o700 });
+    await writeFile(filePath, `${JSON.stringify(config, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    // 기존 파일을 덮어쓸 때도 소유자만 읽고 쓸 수 있도록 권한을 다시 고정한다.
+    await chmod(filePath, 0o600);
+    return resolvePermissions(profile, true, config.updatedAt);
+}
+export async function resetMcpPermissions() {
+    await rm(getMcpConfigFilePath(), { force: true });
+    return resolvePermissions(DEFAULT_MCP_PERMISSION_PROFILE, false, null);
+}
+export function isMcpPermissionProfile(value) {
+    return MCP_PERMISSION_PROFILES.some((profile) => profile === value);
+}
+export function hasMcpCapability(permissions, capability) {
+    return permissions.capabilities.includes(capability);
+}
+function resolvePermissions(profile, configured, updatedAt) {
+    return {
+        profile,
+        capabilities: [...PROFILE_CAPABILITIES[profile]],
+        configured,
+        updatedAt,
+    };
+}
+function parsePermissionConfig(value, filePath) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        throw invalidConfigError(filePath, "root value must be an object");
+    }
+    const config = value;
+    if (config.version !== 1) {
+        throw invalidConfigError(filePath, "version must be 1");
+    }
+    if (typeof config.profile !== "string" ||
+        !isMcpPermissionProfile(config.profile)) {
+        throw invalidConfigError(filePath, `profile must be one of: ${MCP_PERMISSION_PROFILES.join(", ")}`);
+    }
+    if (typeof config.updatedAt !== "string" ||
+        !Number.isFinite(Date.parse(config.updatedAt))) {
+        throw invalidConfigError(filePath, "updatedAt must be an ISO date-time");
+    }
+    return {
+        version: 1,
+        profile: config.profile,
+        updatedAt: config.updatedAt,
+    };
+}
+function invalidConfigError(filePath, reason) {
+    return new Error(`Invalid OpenLog MCP config at ${filePath}: ${reason}. Run \`openlog mcp permissions reset\` to restore the safe-write default.`);
+}
+function hasErrorCode(error, code) {
+    return Boolean(error &&
+        typeof error === "object" &&
+        "code" in error &&
+        error.code === code);
+}