@openlibing/openlibing-cli 0.1.8 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -3
- package/dist/auth/store.js +6 -2
- package/dist/auth/store.js.map +1 -1
- package/dist/client/reportApi.js +2 -2
- package/dist/client/reportApi.js.map +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -11,7 +11,7 @@ OpenLibing MCP 本地 CLI：把 ops 报告等只读能力包装为 MCP 工具（
|
|
|
11
11
|
- **MCP 工具**（stdio）：`report_listTemplates` / `report_queryData` / `auth_login`
|
|
12
12
|
- **连接即授权**：`mcp start` 启动时自动续期凭证；凭证失效自动弹出浏览器授权，**点一次即完成**
|
|
13
13
|
- **平台选择**：登录时弹出平台选择页（GitCode / Gitee / GitHub / UniPortal / OpenUBMC），点选后跳转对应平台授权
|
|
14
|
-
- **凭证安全**：token/refresh/csrf 本地 AES-256-GCM 加密存储（`~/.openlibing-cli/auth.json
|
|
14
|
+
- **凭证安全**：token/refresh/csrf 本地 AES-256-GCM 加密存储（`~/.openlibing-cli/auth.{env}.json`，**按环境分文件**，beta/prod 互不覆盖），不落服务端
|
|
15
15
|
- **401 自愈**：工具调用遇 401 自动 refresh 续期重试；续期失败返回明确引导（不依赖外部 cookie）
|
|
16
16
|
|
|
17
17
|
## 安装
|
|
@@ -95,11 +95,12 @@ npx -y @openlibing/openlibing-cli auth logout
|
|
|
95
95
|
| `OPENLIBING_OPS_URL` | 按 env | 覆盖 ops 报告接口地址 |
|
|
96
96
|
| `OPENLIBING_PLUGIN_CLIENT` | `agent_arena` | 插件登录 client（须在网关白名单） |
|
|
97
97
|
| `OPENLIBING_PLUGIN_ID` | `openlibing-cli` | 插件标识 |
|
|
98
|
-
| `OPENLIBING_AUTH_FILE` | `~/.openlibing-cli/auth.json` | 覆盖凭证文件路径（测试隔离用） |
|
|
98
|
+
| `OPENLIBING_AUTH_FILE` | `~/.openlibing-cli/auth.{env}.json` | 覆盖凭证文件路径（测试隔离用） |
|
|
99
99
|
|
|
100
100
|
## 凭证与安全
|
|
101
101
|
|
|
102
|
-
- 凭证文件：`~/.openlibing-cli/auth.json
|
|
102
|
+
- 凭证文件：`~/.openlibing-cli/auth.{env}.json`（如 `auth.prod.json` / `auth.beta.json`；AES-256-GCM，密钥由本机标识派生，换机器/用户不可解密）
|
|
103
|
+
- **环境隔离**：各环境独立登录、独立凭证文件；切换 `OPENLIBING_ENV` 自动读写对应环境凭证，不再互相覆盖
|
|
103
104
|
- token / csrf 有效期约 30 分钟：`mcp start` 启动和 401 时自动用 refresh token 续期，无需手动干预
|
|
104
105
|
- refresh token 失效后需重新授权（自动弹浏览器，点一次即可）
|
|
105
106
|
- 401 错误信息明确指引运行 `auth login` / `auth refresh`，不会引导获取网关 cookie
|
package/dist/auth/store.js
CHANGED
|
@@ -1,14 +1,18 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* 凭证本地安全存储：token/refresh 加密落盘（AES-256-GCM），密钥从本机标识派生。
|
|
3
3
|
* 安全责任在用户侧（方案 D）：CLI 凭证仅存用户本机，不落服务端。
|
|
4
|
+
*
|
|
5
|
+
* <p>凭证按环境分文件（auth.{env}.json）：beta/prod 各自独立存储与登录，
|
|
6
|
+
* 切换环境互不覆盖、互不错配，避免「beta 凭证调 prod 网关」导致 401/续期失败。
|
|
4
7
|
*/
|
|
5
8
|
import { createCipheriv, createDecipheriv, createHash, randomBytes, scryptSync } from "node:crypto";
|
|
6
9
|
import { homedir, hostname } from "node:os";
|
|
7
10
|
import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
|
|
8
11
|
import { join } from "node:path";
|
|
12
|
+
import { env } from "../config/env.js";
|
|
9
13
|
const CONFIG_DIR = join(homedir(), ".openlibing-cli");
|
|
10
|
-
/**
|
|
11
|
-
const AUTH_FILE = process.env.OPENLIBING_AUTH_FILE ?? join(CONFIG_DIR,
|
|
14
|
+
/** 凭证文件：按环境分文件（auth.{env}.json）；测试可用 OPENLIBING_AUTH_FILE 覆盖，避免污染真实凭证 */
|
|
15
|
+
const AUTH_FILE = process.env.OPENLIBING_AUTH_FILE ?? join(CONFIG_DIR, `auth.${env.env}.json`);
|
|
12
16
|
const VERSION = "v1";
|
|
13
17
|
const SALT = "openlibing-cli:auth:v1";
|
|
14
18
|
/** 从本机标识派生加密密钥（换机器/用户后无法解密，符合本地凭证语义） */
|
package/dist/auth/store.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AAgBvC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAC;AACtD,yEAAyE;AACzE,MAAM,SAAS,GACb,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,UAAU,EAAE,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;AAC/E,MAAM,OAAO,GAAG,IAAI,CAAC;AACrB,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,wCAAwC;AACxC,SAAS,SAAS;IAChB,MAAM,QAAQ,GAAG,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC;IAC1F,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAChC,OAAO,GAAG,OAAO,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,OAAO,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpF,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,QAAQ,CAAC,KAAK,EAAE;KACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACxD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAoB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,IAAqB;IAC5C,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,WAAW,CAAC,SAAkB;IAC5C,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC"}
|
package/dist/client/reportApi.js
CHANGED
|
@@ -9,7 +9,7 @@ import { refreshToken } from "../auth/refresh.js";
|
|
|
9
9
|
/**
|
|
10
10
|
* 401 处理（避免 agent 误判为需要外部 cookie）：
|
|
11
11
|
* 1. 自动用 refresh token 续期一次并重试；
|
|
12
|
-
* 2. 续期失败则抛出引导性错误，明确本 CLI 使用独立凭证（~/.openlibing-cli/auth.json
|
|
12
|
+
* 2. 续期失败则抛出引导性错误，明确本 CLI 使用独立凭证（~/.openlibing-cli/auth.{env}.json，按环境分文件），
|
|
13
13
|
* 不依赖 openlibing-auth skill 的 cookie，防止 AI 在 401 后误调外部 skill。
|
|
14
14
|
*/
|
|
15
15
|
async function withAuthRetry(fn) {
|
|
@@ -24,7 +24,7 @@ async function withAuthRetry(fn) {
|
|
|
24
24
|
}
|
|
25
25
|
catch {
|
|
26
26
|
throw new Error("访问被拒绝（HTTP 401）：本地 MCP 凭证已失效。请运行 `openlibing-cli auth login` 重新登录，" +
|
|
27
|
-
"或 `openlibing-cli auth refresh`
|
|
27
|
+
"或 `openlibing-cli auth refresh` 续期（凭证按环境独立存储于 ~/.openlibing-cli/auth.{env}.json）。" +
|
|
28
28
|
"不要调用 openlibing-auth skill 获取 cookie——本 CLI 使用独立凭证，与网关 cookie 无关。");
|
|
29
29
|
}
|
|
30
30
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"reportApi.js","sourceRoot":"","sources":["../../src/client/reportApi.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+DlD;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAI,EAAoB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,YAAY,EAAE,CAAC;gBACrB,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,oEAAoE;oBACpE,
|
|
1
|
+
{"version":3,"file":"reportApi.js","sourceRoot":"","sources":["../../src/client/reportApi.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+DlD;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAAI,EAAoB;IAClD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,YAAY,EAAE,CAAC;gBACrB,OAAO,MAAM,EAAE,EAAE,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,oEAAoE;oBACpE,mFAAmF;oBACnF,mEAAmE,CACpE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iBAAiB;AACjB,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,GAAG,GAAG,CAAC,UAAU,4BAA4B,EAC7C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CACzC,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,uBAAuB;AACvB,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAA6B;IAE7B,OAAO,aAAa,CAAC,KAAK,IAAI,EAAE;QAC9B,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,GAAG,GAAG,CAAC,UAAU,yBAAyB,EAC1C,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAC7C,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC"}
|