@numa-tech/numa 1.19.0 → 1.20.1

package/examples/mcp/runtime-smoke.mjs

@@ -0,0 +1,187 @@
+#!/usr/bin/env node
+// Local MVP acceptance. Identity/profile/cache are supplied through the normal Numa environment.
+// No credentials are printed or written by this runner.
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { parseArgs } from "node:util";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+
+const { values } = parseArgs({ options: {
+  cli: { type: "string", default: "dist/cli.js" },
+  namespace: { type: "string", default: "mcp-lab-a" },
+  instance: { type: "string" },
+  server: { type: "string", default: "catalog-mcp" },
+  tool: { type: "string", default: "search_products" },
+  "denied-tool": { type: "string", default: "update_product" },
+  "error-tool": { type: "string", default: "search_failure" },
+  "reader-env-file": { type: "string" },
+  "writer-env-file": { type: "string" },
+  "denied-env-file": { type: "string" },
+  "other-namespace": { type: "string", default: "mcp-lab-b" },
+  extended: { type: "boolean", default: false }
+} });
+async function identityEnvironment(path) {
+  const provided = path ? JSON.parse(await readFile(path, "utf8")) : {};
+  if (!provided || typeof provided !== "object" || Array.isArray(provided)
+    || Object.values(provided).some(value => typeof value !== "string")) throw new Error("Identity environment must be a string map.");
+  const environment = { ...process.env, ...provided };
+  const base = environment.NUMA_BACKEND_BASE_URL;
+  const parsed = base ? new URL(base) : undefined;
+  if (!parsed || !["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.search || parsed.hash
+    || !["localhost", "127.0.0.1", "[::1]"].includes(parsed.hostname)) {
+    throw new Error("This runner requires NUMA_BACKEND_BASE_URL to explicitly select the local MVP.");
+  }
+  return environment;
+}
+const readerEnvironment = await identityEnvironment(values["reader-env-file"]);
+const writerEnvironment = values["writer-env-file"] ? await identityEnvironment(values["writer-env-file"]) : undefined;
+const deniedEnvironment = values["denied-env-file"] ? await identityEnvironment(values["denied-env-file"]) : undefined;
+const cli = resolve(values.cli);
+const namespaceOptions = (name = values.namespace) => ["--namespace", name, ...(values.instance ? ["--instance", values.instance] : [])];
+const checks = [];
+let lastOperation;
+async function invoke(args, environment = readerEnvironment, targetNamespace = values.namespace) {
+  const child = spawn(process.execPath, [cli, ...args, ...namespaceOptions(targetNamespace), "--json"], {
+    env: environment, stdio: ["ignore", "pipe", "pipe"]
+  });
+  let stdout = "";
+  child.stdout.on("data", chunk => { stdout += chunk; });
+  child.stderr.resume();
+  const timer = setTimeout(() => child.kill("SIGTERM"), 45_000);
+  const code = await new Promise((resolveCode, reject) => { child.once("error", reject); child.once("close", resolveCode); });
+  clearTimeout(timer);
+  let body;
+  try { body = JSON.parse(stdout); } catch { throw new Error("CLI did not return valid JSON; inspect local diagnostics."); }
+  lastOperation = { command: args.slice(0, 4).join(" "), namespace: targetNamespace, exitCode: code,
+    ok: body.ok, errorCode: body.error?.code, httpStatus: body.error?.details?.status ?? body.error?.status };
+  return { code, body };
+}
+async function viaProxy(operation, environment = readerEnvironment, server = values.server, targetNamespace = values.namespace) {
+  lastOperation = { command: "mcp proxy", server, namespace: targetNamespace };
+  const transport = new StdioClientTransport({ command: process.execPath,
+    args: [cli, "mcp", "proxy", server, ...namespaceOptions(targetNamespace)],
+    env: Object.fromEntries(Object.entries(environment).filter(([, value]) => value !== undefined)), stderr: "pipe" });
+  transport.stderr?.resume();
+  const client = new Client({ name: "numa-local-mvp-acceptance", version: "1" }, { capabilities: {} });
+  try { await client.connect(transport, { timeout: 30_000 }); return await operation(client); }
+  finally { await client.close(); }
+}
+try {
+  const tools = await invoke(["mcp", "tools", values.server]);
+  assert.equal(tools.code, 0);
+  assert.equal(tools.body.ok, true);
+  const names = tools.body.tools.map(tool => tool.name);
+  assert(names.includes(values.tool));
+  assert(!names.includes(values["denied-tool"]));
+  checks.push("CLI tools uses gateway-filtered list");
+
+  const call = await invoke(["mcp", "call", values.server, values.tool, "--args", "{}"]);
+  assert.equal(call.code, 0);
+  assert.equal(call.body.ok, true);
+  assert(call.body.result.content?.length > 0);
+  checks.push("CLI tool call completes through gateway and upstream");
+
+  const forbidden = await invoke(["mcp", "call", values.server, values["denied-tool"], "--args", "{}"]);
+  assert.notEqual(forbidden.code, 0);
+  assert.equal(forbidden.body.ok, false);
+  assert.equal(forbidden.body.error.code, "ai_registry_mcp_forbidden");
+  checks.push("CLI forbidden tool is denied by gateway");
+
+  const error = await invoke(["mcp", "call", values.server, values["error-tool"], "--args", "{}"]);
+  assert.notEqual(error.code, 0);
+  assert.equal(error.body.ok, false);
+  assert.equal(error.body.result.isError, true);
+  checks.push("CLI preserves executed tool isError and exits nonzero");
+
+  await viaProxy(async client => {
+    assert(client.getServerCapabilities()?.tools);
+    const listed = await client.listTools();
+    const proxyNames = listed.tools.map(tool => tool.name);
+    assert(proxyNames.includes(values.tool));
+    assert(!proxyNames.includes(values["denied-tool"]));
+    checks.push("stdio proxy negotiates real server and retains filtered tools");
+    const result = await client.callTool({ name: values.tool, arguments: {} });
+    assert(!result.isError);
+    assert(result.content?.length > 0);
+    checks.push("stdio MCP client invokes real remote tool via CLI proxy");
+    const failed = await client.callTool({ name: values["error-tool"], arguments: {} });
+    assert.equal(failed.isError, true);
+    checks.push("stdio proxy preserves protocol tool errors");
+  });
+  let denied = false; let initialized = false;
+  try {
+    await viaProxy(client => { initialized = true; return client.callTool({ name: values["denied-tool"], arguments: {} }, undefined, { timeout: 15_000 }); });
+  } catch { denied = true; }
+  assert(initialized && denied);
+  checks.push("stdio proxy cannot bypass gateway tool authorization");
+  if (values.extended) {
+    for (const [server, tool, args, expected] of [
+      ["notes-mcp", "list_notes", {}, "credentialVerified"],
+      ["stdio-mcp", "calculate_total", { unit_price: 12.5, quantity: 2 }, '"total":25']
+    ]) {
+      const call = await invoke(["mcp", "call", server, tool, "--args", JSON.stringify(args)]);
+      assert.equal(call.code, 0);
+      assert.equal(call.body.ok, true);
+      const serialized = JSON.stringify(call.body.result).replaceAll(/\s/gu, "").replaceAll('\\"', '"');
+      assert(serialized.includes(expected));
+      checks.push(`CLI reaches ${server} real upstream adapter`);
+      await viaProxy(async client => {
+        const tools = await client.listTools();
+        assert(tools.tools.some(item => item.name === tool));
+        const result = await client.callTool({ name: tool, arguments: args });
+        assert(!result.isError);
+        const serialized = JSON.stringify(result).replaceAll(/\s/gu, "").replaceAll('\\"', '"');
+        assert(serialized.includes(expected));
+      }, readerEnvironment, server);
+      checks.push(`local stdio proxy reaches ${server} real upstream adapter`);
+    }
+    await viaProxy(async client => {
+      const first = await client.listTools();
+      const second = await client.callTool({ name: values.tool, arguments: {} });
+      assert(first.tools.some(tool => tool.name === values.tool));
+      assert(!second.isError);
+    }, readerEnvironment, "session-mcp");
+    checks.push("stdio proxy retains stateful upstream session across requests");
+  }
+  if (writerEnvironment) {
+    const write = await invoke(["mcp", "call", values.server, values["denied-tool"], "--args", '{"name":"numa-local-acceptance"}'], writerEnvironment);
+    assert.equal(write.code, 0);
+    assert.equal(write.body.ok, true);
+    checks.push("writer CLI executes authorized fixture write");
+    await viaProxy(async client => {
+      const tools = await client.listTools();
+      assert(tools.tools.some(tool => tool.name === values["denied-tool"]));
+      const written = await client.callTool({ name: values["denied-tool"], arguments: { name: "numa-stdio-acceptance" } });
+      assert(!written.isError);
+    }, writerEnvironment);
+    checks.push("writer stdio proxy executes authorized fixture write");
+    const unclassified = await invoke(["mcp", "call", values.server, "unclassified_operation", "--args", "{}"], writerEnvironment);
+    assert.notEqual(unclassified.code, 0);
+    assert.equal(unclassified.body.error.code, "ai_registry_mcp_forbidden");
+    checks.push("writer still cannot invoke unclassified tool");
+    const readOther = await invoke(["mcp", "call", values.server, values.tool, "--args", "{}"], readerEnvironment, values["other-namespace"]);
+    assert.notEqual(readOther.code, 0);
+    assert.equal(readOther.body.ok, false);
+    assert.match(readOther.body.error.code, /forbidden/u);
+    checks.push("reader cannot cross into another namespace");
+    const writerOther = await invoke(["mcp", "call", values.server, values.tool, "--args", "{}"], writerEnvironment, values["other-namespace"]);
+    assert.equal(writerOther.code, 0);
+    assert.equal(writerOther.body.ok, true);
+    checks.push("explicitly granted writer can call another namespace");
+  }
+  if (deniedEnvironment) {
+    const denied = await invoke(["mcp", "tools", values.server], deniedEnvironment);
+    assert.notEqual(denied.code, 0);
+    assert.equal(denied.body.ok, false);
+    assert(denied.body.error.details?.status === 403 || /forbidden/u.test(denied.body.error.code));
+    checks.push("ungranted identity cannot discover callable server");
+  }
+  process.stdout.write(JSON.stringify({ ok: true, checks }, null, 2) + "\n");
+} catch {
+  process.stderr.write(JSON.stringify({ ok: false, completedChecks: checks, lastOperation,
+    message: "MCP runtime acceptance failed; credential-bearing responses were withheld." }, null, 2) + "\n");
+  process.exitCode = 1;
+}

package/examples/mcp/server.json

@@ -0,0 +1,17 @@
+{
+  "serverSpecification": {
+    "name": "cli-local-example",
+    "description": "Local CLI registration example; gateway access requires a separate binding and authorization.",
+    "protocol": "mcp-streamable",
+    "frontProtocol": "mcp-streamable",
+    "enabled": false,
+    "versionDetail": { "version": "1.0.0" },
+    "remoteServerConfig": { "exportPath": "/mcp" }
+  },
+  "toolSpecification": {
+    "tools": [{ "name": "echo", "description": "Example metadata only", "inputSchema": { "type": "object", "properties": {} } }],
+    "toolsMeta": {}
+  },
+  "endpointSpecification": { "type": "DIRECT", "data": { "address": "127.0.0.1", "port": "8080" } },
+  "latest": true
+}

package/examples/oss/README.md

@@ -0,0 +1,78 @@
+# OSS CLI list / write / read example
+
+Use the local build only. Nothing here publishes to npm or changes a global installation.
+
+```bash
+cd /Users/changhz/source/numa-business-issuers
+npm run build
+# A local binary still reads the global configuration unless this is set.
+export NUMA_CONFIG_DIR="$PWD/tmp/issuer-mvp-cli"
+export NUMA_PROFILE_URL='http://localhost:28080/public/v1/client-configurations/issuer-mvp'
+node dist/cli.js config --set profileUrl="$NUMA_PROFILE_URL" profileId=issuer-mvp apiBaseUrl=http://localhost:28080 checkUpdates=false
+node dist/cli.js login --no-console --no-config
+node dist/cli.js oss grants --json
+# Replace 123 with the exact ACTIVE, synced/verified read/write grant shown above.
+python3 examples/oss/roundtrip.py --grant-id 123
+```
+
+For interactive commands, `./scripts/mvp-cli.sh login --issuer cluster-b
+--no-console --no-config` and `./scripts/mvp-cli.sh oss grants --issuer cluster-b`
+set up the same isolated local directory automatically. They never change
+`~/.config/numa`. Merely setting NUMA_PROFILE_URL with your global configuration
+can still leave its pinned profileId pointing at numa-realm.
+
+The local profile must first be created and published in DevOps. Its platform
+issuer is fixed; `login` uses the business default. To explicitly select another
+business issuer, use the same selector for login and the example:
+
+```bash
+node dist/cli.js login --issuer cluster-b --no-console --no-config
+node dist/cli.js oss grants --issuer cluster-b --json
+python3 examples/oss/roundtrip.py --issuer cluster-b --grant-id 123
+```
+
+`--cli /absolute/path/dist/cli.js` selects another local build. The script never
+runs npx, downloads packages, chooses a grant automatically or changes permissions.
+It queries Grant/STS APIs through Numa, uses the STS-backed OSS client to list up
+to ten objects, uploads a small unique object, checks metadata, downloads it and
+compares bytes. Both read and write permission are required. `--prefix` must be
+inside the selected grant's scope. No existing object is overwritten. The remote
+test object is retained and its key is printed; temporary local files are removed.
+Credentials are handled internally by the CLI, never printed by the script.
+
+Machine identities use the selected issuer too. Configure
+`NUMA_KEYCLOAK_AUTH_MODE=client_credentials`, the dedicated
+`NUMA_KEYCLOAK_CLIENT_ID`, and `NUMA_KEYCLOAK_CLIENT_SECRET_FILE` (owner-only file).
+Do not run browser login in machine mode. The backend still requires the canonical
+OSS role and a grant for this exact issuer/subject.
+
+For the local acceptance run, the published `issuer-mvp` Profile defaults to
+cluster-a. Its existing fixture grants are intentionally unpublished/read-only
+and cannot run the write example. Select a separately verified read/write grant
+before executing the example against real OSS.
+
+`oss grants` lists authorization records, including records whose cloud policy is
+not yet synced/verified. Its count is not a count of grants ready for object access.
+The normal output shows each grant ID, bucket/prefix, permission and sync state.
+For example, the local MVP fixture Grant 2 has `cloudPolicySynced=false` and
+`permissionLevel=READ_ONLY`: it cannot run this roundtrip. The unified API returns
+`actions` and `effect`; the CLI authorizes operations from those fields, never
+from the template label. `oss ls` only requires Allow + `oss:ListObjects`; stat/get
+require `oss:GetObject`, and upload requires `oss:PutObject`. The roundtrip requires
+all three Actions. System ADMIN uses `oss:*`, which is broader than selecting all
+currently editable object Actions.
+The roundtrip reports all status/permission blockers before requesting STS or
+performing any object operations; it never publishes policies or expands access.
+
+If `oss ls` fails with `OSS_STS_BROKER_NOT_CONFIGURED` (HTTP 503), the platform
+account lacks an active STS broker RAM-user AK. A synced OSS policy alone does
+not make STS ready. A platform administrator must configure the dedicated broker
+identity and its managed AK, permission to assume the selected RAM Role, and the
+Role's trust policy. The default management AK is separate from the broker AK.
+`OSS_STS_ASSUME_ROLE_FAILED` means the STS call failed after broker selection;
+check broker credentials, trust, permissions and connectivity. Neither error is
+fixed by logging in with another issuer or changing the grant's read/write level.
+
+The imported OSS development branch had a hard-coded machine test bucket. This
+build uses server-authorized Grant/STS scope for both user and machine identities;
+SDK prefix and permission checks remain enabled.

package/examples/oss/roundtrip.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""Exercise Grant/STS APIs and OSS list/write/read using an unpublished local Numa build."""
+import argparse
+import hashlib
+import json
+import pathlib
+import subprocess
+import tempfile
+import uuid
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--cli', type=pathlib.Path, default=pathlib.Path(__file__).resolve().parents[2] / 'dist/cli.js', help='Local dist/cli.js; never downloads or installs a CLI')
+    parser.add_argument('--issuer', help='Business issuer code from the selected Profile; omit to use its default')
+    parser.add_argument('--grant-id', required=True, type=int, help='An exact grant ID from numa oss grants')
+    parser.add_argument('--prefix', help='Optional test prefix inside the grant scope')
+    args = parser.parse_args()
+    if not args.cli.is_file():
+        parser.error('Build the local CLI first (npm run build), or pass --cli /absolute/path/dist/cli.js')
+    command = ['node', str(args.cli.resolve())]
+    if args.issuer:
+        command += ['--issuer', args.issuer]
+
+    def cli(*arguments):
+        result = subprocess.run(command + list(arguments) + ['--json'], capture_output=True, text=True)
+        try:
+            value = json.loads(result.stdout)
+        except ValueError:
+            raise RuntimeError('CLI did not return JSON; check the local build and Profile configuration') from None
+        if result.returncode or not value.get('ok'):
+            # Do not echo arbitrary stdout, stderr, API responses or credentials.
+            error = value.get('error', {})
+            code = error.get('code', 'command_failed') if isinstance(error, dict) else 'command_failed'
+            raise RuntimeError(f'CLI command {arguments[0]} {arguments[1]} failed: {code}')
+        return value
+
+    grants = cli('oss', 'grants')['grants']
+    grant = next((g for g in grants if g['grantId'] == args.grant_id), None)
+    if not grant:
+        parser.error(f'Grant {args.grant_id} 未出现在当前身份的授权列表中；请使用相同 --issuer 执行 oss grants 查看授权 ID')
+    blockers = []
+    if grant['status'] != 'ACTIVE':
+        blockers.append('授权未启用（status=' + json.dumps(grant['status'], ensure_ascii=False) + '）')
+    if not grant['cloudPolicySynced']:
+        blockers.append('云端策略未同步/验证（cloudPolicySynced=false）')
+    required_actions = {'oss:ListObjects', 'oss:GetObject', 'oss:PutObject'}
+    actions = grant.get('actions')
+    permitted = grant.get('effect') == 'Allow' and isinstance(actions, list) and (required_actions.issubset(set(actions)) or 'oss:*' in actions)
+    if not permitted:
+        blockers.append('读写示例需要 Allow 且同时包含 ListObjects、GetObject、PutObject，当前 actions=' + json.dumps(actions, ensure_ascii=False))
+    if blockers:
+        parser.error(f'Grant {args.grant_id} 无法运行读写示例：' + '；'.join(blockers) + '。尚未申请 STS 或执行 OSS 对象操作。请选择已同步/验证且具有读写权限的授权。')
+    scope = grant['scopeType']
+    allowed = grant.get('objectPrefix') or ''
+    if scope not in ('BUCKET', 'PREFIX') or scope == 'PREFIX' and not allowed:
+        parser.error('Grant scope is incomplete')
+    prefix = args.prefix if args.prefix is not None else allowed
+    if scope == 'PREFIX' and not prefix.startswith(allowed):
+        parser.error('--prefix must be inside the granted objectPrefix')
+    if prefix and not prefix.endswith('/'):
+        prefix += '/'
+    key = prefix + 'numa-cli-example-' + uuid.uuid4().hex + '.txt'
+    grant_id = str(args.grant_id)
+    print(json.dumps({'bucket': grant['bucketName'], 'object_key': key, 'issuer': args.issuer or 'profile-default'}, ensure_ascii=False))
+    cli('oss', 'ls', grant_id, prefix, '--limit', '10')
+    with tempfile.TemporaryDirectory(prefix='numa-oss-example-') as directory:
+        source = pathlib.Path(directory) / 'source.txt'
+        downloaded = pathlib.Path(directory) / 'downloaded.txt'
+        source.write_text('Numa OSS CLI roundtrip\n' + str(uuid.uuid4()) + '\n', encoding='utf-8')
+        cli('oss', 'put', grant_id, key, str(source))  # No --overwrite.
+        cli('oss', 'stat', grant_id, key)
+        cli('oss', 'get', grant_id, key, '--output', str(downloaded))
+        if source.read_bytes() != downloaded.read_bytes():
+            raise RuntimeError('Downloaded contents do not match the uploaded file')
+        print(json.dumps({'ok': True, 'verified': ['list', 'write', 'read'], 'sha256': hashlib.sha256(downloaded.read_bytes()).hexdigest(), 'retained_object_key': key}))
+    # Deliberately retain the unique remote object. There is no implicit delete.
+
+
+if __name__ == '__main__':
+    try:
+        main()
+    except (RuntimeError, OSError) as error:
+        raise SystemExit(str(error)) from None

package/examples/oss/test_roundtrip.py

@@ -0,0 +1,66 @@
+"""Contract tests for the runnable example; all CLI/cloud responses are simulated."""
+import contextlib
+import importlib.util
+import io
+import json
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+spec=importlib.util.spec_from_file_location('roundtrip',Path(__file__).with_name('roundtrip.py'))
+module=importlib.util.module_from_spec(spec);spec.loader.exec_module(module)
+
+class RoundtripTest(unittest.TestCase):
+    def exercise(self,permission='READ_WRITE',prefix=None,corrupt=False,synced=True,status='ACTIVE',missing=False,blocked_message=None):
+        calls=[];storage={}
+        with tempfile.TemporaryDirectory() as directory:
+            entry=Path(directory)/'cli.js';entry.touch()
+            argv=['roundtrip','--cli',str(entry),'--grant-id','7','--issuer','cluster-b']
+            if prefix is not None:argv += ['--prefix',prefix]
+            def run(command,**kwargs):
+                self.assertEqual(command[2:4],['--issuer','cluster-b'])
+                args=command[4:-1];calls.append(args)
+                self.assertEqual(args[0],'oss');self.assertNotIn('--overwrite',args)
+                if args[1]=='grants': payload={'grants':[] if missing else [{'grantId':7,'status':status,'cloudPolicySynced':synced,'permissionLevel':permission,'effect':'Allow','actions':['oss:ListObjects','oss:GetObject']+([] if permission=='READ_ONLY' else ['oss:PutObject']),'scopeType':'PREFIX','objectPrefix':'tenant/kb/','bucketName':'example-bucket'}]}
+                elif args[1]=='put': storage[args[3]]=Path(args[4]).read_bytes();payload={}
+                elif args[1]=='get': Path(args[5]).write_bytes(b'wrong' if corrupt else storage[args[3]]);payload={}
+                elif args[1] in ('ls','stat'): payload={}
+                else:raise AssertionError('Unexpected object mutation: '+args[1])
+                return subprocess.CompletedProcess(command,0,json.dumps({'ok':True,**payload}),'')
+            output=io.StringIO();errors=io.StringIO()
+            with patch.object(sys,'argv',argv),patch.object(module.subprocess,'run',run),contextlib.redirect_stdout(output),contextlib.redirect_stderr(errors):
+                if blocked_message is None:
+                    module.main()
+                else:
+                    with self.assertRaises(SystemExit) as error:module.main()
+                    self.assertEqual(error.exception.code,2)
+                    self.assertRegex(errors.getvalue(),blocked_message)
+                    self.assertEqual([c[1] for c in calls],['grants'])
+                    self.assertEqual(storage,{})
+            return calls,storage,output.getvalue()
+
+    def test_roundtrip_selects_one_issuer_and_keeps_unique_object(self):
+        calls,storage,output=self.exercise()
+        self.assertEqual([c[1] for c in calls],['grants','ls','put','stat','get'])
+        key=next(iter(storage));self.assertTrue(key.startswith('tenant/kb/numa-cli-example-'))
+        self.assertEqual(json.loads(output.splitlines()[-1])['retained_object_key'],key)
+
+    def test_refuses_readonly_and_out_of_scope_before_write(self):
+        with self.assertRaises(SystemExit):self.exercise(permission='READ_ONLY')
+        with self.assertRaises(SystemExit):self.exercise(prefix='another-tenant/')
+
+    def test_detects_corrupted_download(self):
+        with self.assertRaisesRegex(RuntimeError,'do not match'):self.exercise(corrupt=True)
+
+    def test_reports_all_fixture_blockers_without_requesting_sts_or_objects(self):
+        self.exercise(permission='READ_ONLY',synced=False,blocked_message=r'Grant 7.*cloudPolicySynced=false.*actions=.*oss:GetObject.*尚未申请 STS')
+
+    def test_distinguishes_missing_inactive_and_synced_readonly_grants(self):
+        self.exercise(missing=True,blocked_message=r'Grant 7 未出现在当前身份')
+        self.exercise(status='DISABLED',blocked_message=r'授权未启用.*DISABLED')
+        self.exercise(permission='READ_ONLY',blocked_message=r'需要 Allow.*ListObjects.*GetObject.*PutObject.*actions=')
+
+if __name__=='__main__':unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@numa-tech/numa",
-  "version": "1.19.0",
+  "version": "1.20.1",
   "description": "Cross-platform CLI for the Numa internal developer platform with Keycloak authentication and MCP support.",
   "author": "numa-tech",
   "keywords": [
@@ -22,6 +22,7 @@
     "dist",
     "README.md",
     "docs/wecom-messaging.md",
+    "docs/application-default-groups.md",
     "docs/module-maintenance-and-skills-updates.md",
     "examples",
     "skills",
@@ -35,9 +36,9 @@
     "root:typecheck": "tsc --noEmit",
     "test": "turbo run test root:test",
     "dev:oss-web": "tsx src/cli.ts oss web",
-    "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts",
+    "test:oss-web": "node --import tsx --test src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts",
     "test:oss-auth-code": "node scripts/test-oss-auth-code.mjs",
-    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/group-client.test.ts src/authorization/group-commands.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts",
+    "root:test": "node --import tsx --test --test-concurrency=4 src/mcp-gateway/profile.test.ts src/mcp-gateway/runtime.test.ts src/mcp-gateway/install.test.ts src/branding.test.ts src/app-config.test.ts src/platform-profile.test.ts src/identity.test.ts src/backend.test.ts src/oauth.test.ts src/web-console.test.ts src/cli-options.test.ts src/mail/client.test.ts src/wecom/client.test.ts src/wecom/commands.test.ts src/wecom/tools.test.ts src/ai-registry/client.test.ts src/ai-registry/bootstrap.test.ts src/ai-registry/install-defaults.test.ts src/ai-registry/workspace.test.ts src/ai-registry/namespace.test.ts src/ai-registry/sync.test.ts src/ai-registry/bridge.test.ts src/ai-registry/skill-installer.test.ts src/ai-registry/skill-uninstaller.test.ts src/ai-registry/skill-dependencies.test.ts src/ai-registry/updates.test.ts src/maintenance/scheduler.test.ts src/maintenance/codex.test.ts src/ai-registry/mcp-installer.test.ts src/media/client.test.ts src/media/commands.test.ts src/media/transfers.test.ts src/oss/client.test.ts src/oss/commands.test.ts src/oss/auth-code.test.ts src/oss/clipboard.test.ts src/oss/web.test.ts src/oss/web-session.test.ts src/oss/web-transfers.test.ts src/oss/web-command.test.ts src/oss/local-picker.test.ts src/oss/transfer-paths.test.ts src/oss/transfer-worker.test.ts src/oss/transfer-queue.test.ts src/oss/web-page.test.ts src/oss/file-operations.test.ts src/oss/bootstrap.test.ts src/oss/transfers.test.ts src/oss/search.test.ts src/oss/tools.test.ts src/mcp/install.test.ts src/mcp/catalog.test.ts src/interactive/wizard.test.ts src/pipeline/client.test.ts src/pipeline/commands.test.ts src/gitops/client.test.ts src/gitops/commands.test.ts src/repositories/client.test.ts src/repositories/commands.test.ts src/publications/scanner.test.ts src/publications/client.test.ts src/publications/commands.test.ts src/jenkins-jobs/client.test.ts src/jenkins-jobs/commands.test.ts src/clusters/client.test.ts src/clusters/commands.test.ts src/clusters/kubeconfig-discovery.test.ts src/teams/client.test.ts src/teams/commands.test.ts src/authorization/bootstrap-client.test.ts src/authorization/commands.test.ts src/authorization/access-request-client.test.ts src/authorization/access-request-commands.test.ts src/application-candidates/client.test.ts src/application-candidates/commands.test.ts src/application-onboarding/client.test.ts src/application-onboarding/commands.test.ts src/application-onboarding/tui.test.ts src/chatgpt-desktop.test.ts src/codex-integration.test.ts scripts/release-all.test.mjs src/authorization/enrollment.test.ts src/authorization/application-commands.test.ts src/authorization/application-client.test.ts src/authorization/application-schemas.test.ts src/authorization/enrollment-client.test.ts src/notion/client.test.ts src/notion/commands.test.ts src/notion/tools.test.ts src/notion/machine-cli.test.ts src/cloud/accounts.test.ts src/cloud/bootstrap.test.ts src/cloud/business-bootstrap.test.ts src/cloud/maintenance.test.ts src/cloud/wizard.test.ts src/cloud/oss-bootstrap.test.ts src/business-issuer.test.ts src/login-configuration.test.ts src/login-recovery.test.ts src/ai-registry/mcp-management.test.ts src/ai-registry/mcp-runtime.test.ts src/ai-registry/mcp-stdio.test.ts",
     "pack:check": "turbo run pack:check root:pack:check",
     "root:pack:check": "node scripts/check-root-package.mjs",
     "boundaries": "node scripts/check-workspace-boundaries.mjs",
@@ -60,8 +61,8 @@
   "dependencies": {
     "@clack/prompts": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@numa-tech/cli-auth": "1.19.0",
-    "@tokensrc/codex": "1.19.0",
+    "@numa-tech/cli-auth": "1.20.1",
+    "@tokensrc/codex": "1.20.1",
     "ali-oss": "^6.23.0",
     "commander": "^14.0.3",
     "ink": "^6.8.0",

package/dist/authorization/client.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/authorization/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC3B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EAMvB,MAAM,cAAc,CAAC;AAEtB,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AACzD,MAAM,SAAS,GAAG,GAAG,kBAAkB,QAAQ,CAAC;AAChD,MAAM,QAAQ,GAAG,GAAG,kBAAkB,yBAAyB,CAAC;AAChE,MAAM,cAAc,GAAG,GAAG,kBAAkB,YAAY,CAAC;AACzD,MAAM,0BAA0B,GAAG,GAAG,kBAAkB,wBAAwB,CAAC;AAqDjF,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ;WAC3B,KAAK,CAAC,MAAM,IAAI,GAAG;WACnB,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QACxC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,QAAkB,EAAE,IAAa;IACtD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;IAClC,CAAC;IACD,OAAO,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAa;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoC;QAChD,GAAG,EAAE,mDAAmD;QACxD,GAAG,EAAE,uDAAuD;QAC5D,GAAG,EAAE,8DAA8D;QACnE,GAAG,EAAE,kEAAkE;QACvE,GAAG,EAAE,2DAA2D;QAChE,GAAG,EAAE,qEAAqE;QAC1E,GAAG,EAAE,sEAAsE;KAC5E,CAAC;IACF,OAAO,IAAI,kBAAkB,CAC3B,0BAA0B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,iBAAiB,EAAE,EAC9F,IAAI,EACJ,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,EAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC/C,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,mBAAmB;IAID,MAAM;IAHlB,SAAS,CAAe;IACxB,aAAa,CAAwB;IAEtD,YAA6B,MAAkB,EAAE,YAAY,GAAoC,EAAE;sBAAtE,MAAM;QACjC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,iBAAiB,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAY,EAAE,IAAI,GAAgB,EAAE;QACnE,iFAAiF;QACjF,yEAAyE;QACzE,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvE,OAAO,yBAAyB,CAC9B,IAAI,CAAC,MAAM,EACX,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAC5B,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAC7D,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAAiB,EACjB,IAAI,GAAgB,EAAE,EACtB,gBAAgB,GAAa,CAAC,GAAG,CAAC;QAElC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAC1B,mCAAmC,QAAQ,CAAC,MAAM,cAAc,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAChG,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,kFAAkF,EAClF,gCAAgC,EAChC,QAAQ,CAAC,MAAM,EACf,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAC9B,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,2BAA2B,CAAC,CAAC;IAC3D,CAAC;IAED,UAAU,CAAC,KAAmC;QAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,MAAM,uBAAuB,EAAE,0BAA0B,CAAC,CAAC;IAC9F,CAAC;IAED,SAAS,CAAC,MAAc,EAAE,KAA8B;QACtD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,IAAI,MAAM,eAAe,EAAE,sBAAsB,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjB,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,EAAE,sBAAsB,CAAC,CAAC;IACnE,CAAC;IAED,sBAAsB,CAAC,KAAkC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,WAAW,EAAE,4BAA4B,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB,CAAC,KAAa;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,cAAc,SAAS,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IAClF,CAAC;IAED,wBAAwB,CAAC,KAAoC;QAC3D,OAAO,IAAI,CAAC,IAAI,CAAC,0BAA0B,EAAE,4BAA4B,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,yBAAyB,CAAC,KAAa;QACrC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,0BAA0B,IAAI,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzF,CAAC;CACF"}