@optima-chat/dev-skills 0.7.10 → 0.7.12

package/bin/helpers/query-db.ts

@@ -40,7 +40,7 @@ const SERVICE_DB_MAP = {
   },
   'session-gateway': {
     ci: null, // CI 环境暂无 session-gateway 数据库
-    stage: { userKey: 'SHELL_DB_USER', passwordKey: 'SHELL_DB_PASSWORD', database: 'optima_shell' },
+    stage: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_shell' },
     prod: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_ai_shell' }
   }
 };
@@ -75,14 +75,14 @@ function getInfisicalToken(config: InfisicalConfig): string {
   return JSON.parse(response).accessToken;
 }
 
-function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string): Record<string, string> {
+function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
   const response = execSync(
-    `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=/infrastructure" -H "Authorization: Bearer ${token}"`,
+    `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`,
     { encoding: 'utf-8' }
   );
   const data = JSON.parse(response);
   const secrets: Record<string, string> = {};
-  for (const secret of data.secrets) {
+  for (const secret of data.secrets || []) {
     secrets[secret.secretKey] = secret.secretValue;
   }
   return secrets;
@@ -214,42 +214,23 @@ async function main() {
       { encoding: 'utf-8' }
     );
 
-    console.log('\n' + result);
-  } else if (environment === 'stage') {
-    // Stage 环境：直连 RDS（Stage RDS 在公有子网，可以本地直连）
-    const infisicalConfig = getInfisicalConfig();
-    console.log('✓ Loaded Infisical config from GitHub Variables');
-
-    const token = getInfisicalToken(infisicalConfig);
-    console.log('✓ Obtained Infisical access token');
-
-    const secrets = getInfisicalSecrets(infisicalConfig, token, 'staging');
-    console.log('✓ Retrieved database credentials from Infisical');
-
-    const { userKey, passwordKey, database } = serviceConfig as any;
-    const dbHost = RDS_HOSTS.stage;
-    const dbUser = secrets[userKey];
-    const dbPassword = secrets[passwordKey];
-
-    if (!dbUser || !dbPassword) {
-      throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
-    }
-
-    const result = queryDatabase(dbHost, 5432, dbUser, dbPassword, database, sql);
     console.log('\n' + result);
   } else {
-    // Prod 环境：通过 SSH 隧道访问 RDS（Prod RDS 在私有子网）
+    // Stage/Prod 环境：通过 SSH 隧道访问 RDS
     const infisicalConfig = getInfisicalConfig();
     console.log('✓ Loaded Infisical config from GitHub Variables');
 
     const token = getInfisicalToken(infisicalConfig);
     console.log('✓ Obtained Infisical access token');
 
-    const secrets = getInfisicalSecrets(infisicalConfig, token, 'prod');
+    // 数据库凭证存储在 Infisical 的 /shared-secrets/database-users 路径
+    // Stage 从 staging 环境读取，Prod 从 prod 环境读取
+    const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
+    const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
     console.log('✓ Retrieved database credentials from Infisical');
 
     const { userKey, passwordKey, database } = serviceConfig as any;
-    const dbHost = RDS_HOSTS.prod;
+    const dbHost = RDS_HOSTS[environment as 'stage' | 'prod'];
     const dbUser = secrets[userKey];
     const dbPassword = secrets[passwordKey];
 
@@ -257,7 +238,7 @@ async function main() {
       throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
     }
 
-    const localPort = 15433;
+    const localPort = environment === 'stage' ? 15432 : 15433;
 
     setupSSHTunnel(EC2_HOST, dbHost, localPort);
 

package/dist/bin/helpers/query-db.js

@@ -59,7 +59,7 @@ const SERVICE_DB_MAP = {
     },
     'session-gateway': {
         ci: null, // CI 环境暂无 session-gateway 数据库
-        stage: { userKey: 'SHELL_DB_USER', passwordKey: 'SHELL_DB_PASSWORD', database: 'optima_shell' },
+        stage: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_shell' },
         prod: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_ai_shell' }
     }
 };
@@ -85,11 +85,11 @@ function getInfisicalToken(config) {
     const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
     return JSON.parse(response).accessToken;
 }
-function getInfisicalSecrets(config, token, environment) {
-    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=/infrastructure" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
+function getInfisicalSecrets(config, token, environment, secretPath) {
+    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
     const data = JSON.parse(response);
     const secrets = {};
-    for (const secret of data.secrets) {
+    for (const secret of data.secrets || []) {
         secrets[secret.secretKey] = secret.secretValue;
     }
     return secrets;
@@ -195,40 +195,25 @@ async function main() {
         const result = (0, child_process_1.execSync)(`sshpass -p "${ciPassword}" ssh -o StrictHostKeyChecking=no ${ciUser}@${ciHost} "docker exec ${container} psql -U ${user} -d ${database} -c \\"${sql}\\""`, { encoding: 'utf-8' });
         console.log('\n' + result);
     }
-    else if (environment === 'stage') {
-        // Stage 环境：直连 RDS（Stage RDS 在公有子网，可以本地直连）
-        const infisicalConfig = getInfisicalConfig();
-        console.log('✓ Loaded Infisical config from GitHub Variables');
-        const token = getInfisicalToken(infisicalConfig);
-        console.log('✓ Obtained Infisical access token');
-        const secrets = getInfisicalSecrets(infisicalConfig, token, 'staging');
-        console.log('✓ Retrieved database credentials from Infisical');
-        const { userKey, passwordKey, database } = serviceConfig;
-        const dbHost = RDS_HOSTS.stage;
-        const dbUser = secrets[userKey];
-        const dbPassword = secrets[passwordKey];
-        if (!dbUser || !dbPassword) {
-            throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
-        }
-        const result = queryDatabase(dbHost, 5432, dbUser, dbPassword, database, sql);
-        console.log('\n' + result);
-    }
     else {
-        // Prod 环境：通过 SSH 隧道访问 RDS（Prod RDS 在私有子网）
+        // Stage/Prod 环境：通过 SSH 隧道访问 RDS
         const infisicalConfig = getInfisicalConfig();
         console.log('✓ Loaded Infisical config from GitHub Variables');
         const token = getInfisicalToken(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
-        const secrets = getInfisicalSecrets(infisicalConfig, token, 'prod');
+        // 数据库凭证存储在 Infisical 的 /shared-secrets/database-users 路径
+        // Stage 从 staging 环境读取，Prod 从 prod 环境读取
+        const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
+        const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
         console.log('✓ Retrieved database credentials from Infisical');
         const { userKey, passwordKey, database } = serviceConfig;
-        const dbHost = RDS_HOSTS.prod;
+        const dbHost = RDS_HOSTS[environment];
         const dbUser = secrets[userKey];
         const dbPassword = secrets[passwordKey];
         if (!dbUser || !dbPassword) {
             throw new Error(`Database credentials not found in Infisical for ${service}. Keys: ${userKey}, ${passwordKey}`);
         }
-        const localPort = 15433;
+        const localPort = environment === 'stage' ? 15432 : 15433;
         setupSSHTunnel(EC2_HOST, dbHost, localPort);
         // 等待隧道建立
         await new Promise(resolve => setTimeout(resolve, 1000));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.10",
+  "version": "0.7.12",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {