@mu-cabin/muc-cli 0.2.0 → 0.2.1

package/dist/muc.mjs

@@ -21634,11 +21634,59 @@ function read() {
 var CLI_VERSION = read();
 
 // src/commands/login.ts
-import { release } from "node:os";
+import { release as release2 } from "node:os";
 import * as readline from "node:readline";
 
 // src/lib/http.ts
 var import_needle = __toESM(require_needle(), 1);
+import { release } from "node:os";
+
+// src/lib/sign.ts
+var import_crypto_js = __toESM(require_crypto_js(), 1);
+import { createHash } from "node:crypto";
+function getMucSign(qs, secret) {
+  const keys = Object.keys(qs).sort();
+  const body = keys.map((k) => `${k}${qs[k] ?? ""}`).join("");
+  return createHash("md5").update(`${secret}${body}${secret}`).digest("hex");
+}
+function signRest(qs, secret) {
+  return getMucSign(qs, secret);
+}
+function signSecure(qs, secret) {
+  return getMucSign(qs, secret);
+}
+function encryptPassword(plain, desKey) {
+  const key = import_crypto_js.default.enc.Utf8.parse(desKey);
+  const iv = import_crypto_js.default.enc.Hex.parse("0102030405060708");
+  const enc = import_crypto_js.default.DES.encrypt(plain, key, {
+    iv,
+    mode: import_crypto_js.default.mode.CBC,
+    padding: import_crypto_js.default.pad.Pkcs7
+  });
+  return enc.toString();
+}
+
+// src/lib/device.ts
+import { homedir as homedir3, hostname } from "node:os";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
+import { join as join3 } from "node:path";
+import { randomBytes, createHash as createHash2 } from "node:crypto";
+var DIR3 = join3(homedir3(), ".muc");
+var FILE3 = join3(DIR3, "device-id");
+function getDeviceId() {
+  if (!existsSync3(DIR3)) mkdirSync3(DIR3, { recursive: true, mode: 448 });
+  if (existsSync3(FILE3)) {
+    const v = readFileSync4(FILE3, "utf8").trim();
+    if (v) return v;
+  }
+  const seed = randomBytes(32).toString("hex") + ":" + Date.now();
+  const id = createHash2("sha256").update(seed).digest("hex");
+  writeFileSync3(FILE3, id, { mode: 384 });
+  return id;
+}
+function getDeviceName() {
+  return `${hostname()} (muc-cli)`;
+}
 
 // src/lib/constants.ts
 var APP_NAME = "MUC";
@@ -21690,7 +21738,75 @@ function redact(url) {
     return url;
   }
 }
+var inflightRefresh = null;
+async function refreshAccessTokenWithTokenPwd() {
+  if (inflightRefresh) return inflightRefresh;
+  inflightRefresh = (async () => {
+    const cred = loadCredentials();
+    if (!cred?.tokenPwd) {
+      throw new CliError(
+        "AUTH_REQUIRED",
+        "no saved tokenPwd; cannot refresh accessToken",
+        "run `muc login --account <UID>` interactively in your own terminal"
+      );
+    }
+    const cfg = requireConfig();
+    const platform2 = DEFAULT_REST_PLATFORM;
+    const appVersion = platform2 === PLATFORM_IOS ? APP_VERSION_IOS : APP_VERSION;
+    const form = {
+      account: cred.uid,
+      password: encryptPassword(cred.tokenPwd, pwdDesKeyOf(cfg)),
+      appName: APP_NAME,
+      appKey: cfg.appKey,
+      appVersion,
+      platform: platform2,
+      osVersion: release(),
+      deviceId: cred.deviceId || getDeviceId(),
+      deviceName: cred.deviceName || getDeviceName(),
+      passwordType: 1,
+      createTokenPwd: false,
+      encrypt: true
+    };
+    form.sign = signRest(form, cfg.signSecretRest);
+    const res = await requestRaw({
+      method: "POST",
+      url: `${apiUrls(cfg).MUC}/emp/login`,
+      form
+    });
+    if (res.code !== 0 || !res.data?.accessToken) {
+      throw new CliError(
+        "AUTH_REQUIRED",
+        `tokenPwd refresh rejected: code=${res.code} msg=${res.msg ?? ""}`.trim(),
+        "run `muc login --account <UID>` interactively to mint fresh credentials"
+      );
+    }
+    const next = {
+      ...cred,
+      accessToken: res.data.accessToken,
+      accessTokenExpireAt: res.data.accessTokenExpireTime ?? res.data.accessTokenExpireAt ?? cred.accessTokenExpireAt,
+      savedAt: Date.now()
+    };
+    saveCredentials(next);
+    return next;
+  })();
+  try {
+    return await inflightRefresh;
+  } finally {
+    inflightRefresh = null;
+  }
+}
 async function request(opts) {
+  try {
+    return await requestRaw(opts);
+  } catch (e) {
+    if (e instanceof CliError && e.code === "AUTH_EXPIRED" && opts.auth === true && !opts._isRefreshRetry && loadCredentials()?.tokenPwd) {
+      await refreshAccessTokenWithTokenPwd();
+      return await requestRaw({ ...opts, _isRefreshRetry: true });
+    }
+    throw e;
+  }
+}
+async function requestRaw(opts) {
   const method = opts.method ?? "GET";
   const url = appendQs(opts.url, opts.qs);
   const headers = {
@@ -21761,53 +21877,6 @@ function appendQs(url, qs) {
   return u.toString();
 }
 
-// src/lib/sign.ts
-var import_crypto_js = __toESM(require_crypto_js(), 1);
-import { createHash } from "node:crypto";
-function getMucSign(qs, secret) {
-  const keys = Object.keys(qs).sort();
-  const body = keys.map((k) => `${k}${qs[k] ?? ""}`).join("");
-  return createHash("md5").update(`${secret}${body}${secret}`).digest("hex");
-}
-function signRest(qs, secret) {
-  return getMucSign(qs, secret);
-}
-function signSecure(qs, secret) {
-  return getMucSign(qs, secret);
-}
-function encryptPassword(plain, desKey) {
-  const key = import_crypto_js.default.enc.Utf8.parse(desKey);
-  const iv = import_crypto_js.default.enc.Hex.parse("0102030405060708");
-  const enc = import_crypto_js.default.DES.encrypt(plain, key, {
-    iv,
-    mode: import_crypto_js.default.mode.CBC,
-    padding: import_crypto_js.default.pad.Pkcs7
-  });
-  return enc.toString();
-}
-
-// src/lib/device.ts
-import { homedir as homedir3, hostname } from "node:os";
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync3, mkdirSync as mkdirSync3 } from "node:fs";
-import { join as join3 } from "node:path";
-import { randomBytes, createHash as createHash2 } from "node:crypto";
-var DIR3 = join3(homedir3(), ".muc");
-var FILE3 = join3(DIR3, "device-id");
-function getDeviceId() {
-  if (!existsSync3(DIR3)) mkdirSync3(DIR3, { recursive: true, mode: 448 });
-  if (existsSync3(FILE3)) {
-    const v = readFileSync4(FILE3, "utf8").trim();
-    if (v) return v;
-  }
-  const seed = randomBytes(32).toString("hex") + ":" + Date.now();
-  const id = createHash2("sha256").update(seed).digest("hex");
-  writeFileSync3(FILE3, id, { mode: 384 });
-  return id;
-}
-function getDeviceName() {
-  return `${hostname()} (muc-cli)`;
-}
-
 // src/commands/login.ts
 var PLATFORM_NAMES = {
   ios: PLATFORM_IOS,
@@ -21866,7 +21935,7 @@ var Output = external_exports.object({
 function register(program3) {
   define2(program3, {
     name: "login",
-    description: "Authenticate against MUC and persist accessToken + tokenPwd. Non-interactive: pass --account and one of --password / --password-stdin / --token-pwd / $MUC_PASSWORD. Interactive: omit those and a TTY prompt with echo suppressed will appear.",
+    description: "Authenticate against MUC and persist accessToken + tokenPwd. Run interactively in your own terminal: `muc login --account <UID>` prompts for the password with echo off. `--token-pwd` reuses the saved refresh token and needs no password (this is the only form an agent should run silently). Avoid `--password` / `--password-stdin` / `$MUC_PASSWORD` \u2014 they leak the password into shell history, process lists, and agent chat scrollback.",
     output: Output,
     configure: (cmd) => {
       cmd.option("-a, --account <uid>", "MUC account uid (uppercase, e.g. WANGLULU8)").option("-p, --password <pwd>", "plaintext password (avoid; ends up in shell history)").option("--password-stdin", "read password from stdin (no trailing newline)").option("--token-pwd", "reuse the saved tokenPwd (skips password)").option("--platform <p>", "ios|android|win|mac or numeric code", (v) => parsePlatform(v)).option("--app-version <v>", "override appVersion sent in the login form");
@@ -21913,7 +21982,7 @@ function register(program3) {
         throw new CliError(
           "AUTH_REQUIRED",
           "password required",
-          "pass --password / --password-stdin / --token-pwd, set $MUC_PASSWORD, or run interactively (TTY)"
+          "open your own terminal and run `muc login --account <UID>` \u2014 it will prompt for the password with echo off. Do not pipe / env-var / inline the password from an agent shell; the prompt cannot be proxied through Claude Code's `!` shell-exec."
         );
       }
       const cfg = requireConfig();
@@ -21929,7 +21998,7 @@ function register(program3) {
         appKey: cfg.appKey,
         appVersion,
         platform: platform2,
-        osVersion: release(),
+        osVersion: release2(),
         deviceId,
         deviceName,
         passwordType: isAutoLogin ? 1 : 0,
@@ -22614,7 +22683,7 @@ function register8(program3) {
 }
 
 // src/lib/chat.ts
-import { release as release2 } from "node:os";
+import { release as release3 } from "node:os";
 
 // src/lib/wire.ts
 import { EventEmitter } from "node:events";
@@ -22856,7 +22925,7 @@ function buildLoginPayload(cred, chatOs, cfg) {
       account: cred.uid,
       accessToken: cred.accessToken,
       os: chatOs,
-      osVersion: release2(),
+      osVersion: release3(),
       sdkVersion: 21,
       deviceId: cred.deviceId,
       deviceName: cred.deviceName,
@@ -22951,7 +23020,7 @@ async function refreshAccessTokenViaTokenPwd(cred, cfg) {
     appKey: cfg.appKey,
     appVersion: APP_VERSION,
     platform: PLATFORM_MAC,
-    osVersion: release2(),
+    osVersion: release3(),
     deviceId: cred.deviceId,
     deviceName: cred.deviceName,
     passwordType: 1,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mu-cabin/muc-cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Terminal client for MUC IM (com.meicloud.im.dh).",
   "license": "MIT",
   "type": "module",