@optima-chat/dev-skills 0.7.11 → 0.7.13

package/.claude/commands/query-db.md

@@ -2,7 +2,7 @@
 
 执行 SQL 查询，支持 CI/Stage/Prod 三个环境。
 
-**版本**: v0.6.0
+**版本**: v0.7.0
 
 ## 使用场景
 
@@ -182,11 +182,11 @@ INFISICAL_TOKEN=$(curl -s -X POST "${INFISICAL_URL}/api/v1/auth/universal-auth/l
   | python3 -c "import sys, json; print(json.load(sys.stdin)['accessToken'])")
 
 # 3. 从 Infisical 获取数据库配置（以 commerce-backend 为例）
-curl -s "${INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${INFISICAL_PROJECT_ID}&environment=staging&secretPath=/infrastructure" \
+# 项目: optima-secrets-v2, 路径: /shared-secrets/database-users
+curl -s "${INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${INFISICAL_PROJECT_ID}&environment=staging&secretPath=/shared-secrets/database-users" \
   -H "Authorization: Bearer ${INFISICAL_TOKEN}" | python3 -c "
 import sys, json
 secrets = {s['secretKey']: s['secretValue'] for s in json.load(sys.stdin)['secrets']}
-print(f\"DATABASE_HOST={secrets['DATABASE_HOST']}\")
 print(f\"COMMERCE_DB_USER={secrets['COMMERCE_DB_USER']}\")
 print(f\"COMMERCE_DB_PASSWORD={secrets['COMMERCE_DB_PASSWORD']}\")
 " > /tmp/stage_db_config.sh && source /tmp/stage_db_config.sh
@@ -216,7 +216,7 @@ pkill -f "ssh.*15432:${DATABASE_HOST}:5432"
 # 使用 BI_DB_USER, BI_DB_PASSWORD, 数据库: optima_bi
 
 # session-gateway (注意: Stage 数据库名是 optima_shell)
-# 使用 SHELL_DB_USER, SHELL_DB_PASSWORD, 数据库: optima_shell
+# 使用 AI_SHELL_DB_USER, AI_SHELL_DB_PASSWORD, 数据库: optima_shell
 ```
 
 **数据库配置映射**：
@@ -242,12 +242,12 @@ pkill -f "ssh.*15432:${DATABASE_HOST}:5432"
 
 - `session-gateway`:
   - 数据库: `optima_shell` ⚠️ (Stage 与 Prod 不同)
-  - 用户: Infisical `SHELL_DB_USER`
-  - 密码: Infisical `SHELL_DB_PASSWORD`
+  - 用户: Infisical `AI_SHELL_DB_USER`
+  - 密码: Infisical `AI_SHELL_DB_PASSWORD`
 
 **说明**:
 - Infisical 配置从 GitHub Variables 获取
-- 数据库密钥从 Infisical 动态获取（项目: optima-secrets, 环境: staging, 路径: /infrastructure）
+- 数据库密钥从 Infisical 动态获取（项目: optima-secrets-v2, 环境: staging, 路径: /shared-secrets/database-users）
 - Stage RDS: `optima-stage-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com`
 - Shared EC2 IP: `13.251.46.219`
 - SSH 隧道: 本地端口 `15432` → Shared EC2 → Stage RDS `5432`
@@ -280,11 +280,11 @@ INFISICAL_TOKEN=$(curl -s -X POST "${INFISICAL_URL}/api/v1/auth/universal-auth/l
   | python3 -c "import sys, json; print(json.load(sys.stdin)['accessToken'])")
 
 # 3. 从 Infisical 获取数据库配置（以 commerce-backend 为例）
-curl -s "${INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${INFISICAL_PROJECT_ID}&environment=prod&secretPath=/infrastructure" \
+# 项目: optima-secrets-v2, 路径: /shared-secrets/database-users
+curl -s "${INFISICAL_URL}/api/v3/secrets/raw?workspaceId=${INFISICAL_PROJECT_ID}&environment=prod&secretPath=/shared-secrets/database-users" \
   -H "Authorization: Bearer ${INFISICAL_TOKEN}" | python3 -c "
 import sys, json
 secrets = {s['secretKey']: s['secretValue'] for s in json.load(sys.stdin)['secrets']}
-print(f\"DATABASE_HOST={secrets['DATABASE_HOST']}\")
 print(f\"COMMERCE_DB_USER={secrets['COMMERCE_DB_USER']}\")
 print(f\"COMMERCE_DB_PASSWORD={secrets['COMMERCE_DB_PASSWORD']}\")
 " > /tmp/prod_db_config.sh && source /tmp/prod_db_config.sh
@@ -345,7 +345,7 @@ pkill -f "ssh.*15433:${DATABASE_HOST}:5432"
 
 **说明**:
 - Infisical 配置从 GitHub Variables 获取
-- 数据库密钥从 Infisical 动态获取（项目: optima-secrets, 环境: prod, 路径: /infrastructure）
+- 数据库密钥从 Infisical 动态获取（项目: optima-secrets-v2, 环境: prod, 路径: /shared-secrets/database-users）
 - Prod RDS: `optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com`
 - Shared EC2 IP: `13.251.46.219`
 - SSH 隧道: 本地端口 `15433` → Shared EC2 → Prod RDS `5432`

package/.claude/skills/query-db/SKILL.md

@@ -178,6 +178,33 @@ optima-query-db commerce-backend "SELECT status, COUNT(*) FROM orders GROUP BY s
 - 通过 SSH 隧道访问 RDS
 - ⚠️ 谨慎使用
 
+## 🔧 技术架构
+
+### Infisical 配置（v0.7.0+）
+
+数据库凭证从 Infisical 动态获取：
+- **项目**: `optima-secrets-v2`
+- **路径**: `/shared-secrets/database-users`
+- **环境**: Stage 用 `staging`，Prod 用 `prod`
+
+**凭证 Key 映射**：
+| 服务 | 用户 Key | 密码 Key |
+|------|----------|----------|
+| commerce-backend | `COMMERCE_DB_USER` | `COMMERCE_DB_PASSWORD` |
+| user-auth | `AUTH_DB_USER` | `AUTH_DB_PASSWORD` |
+| agentic-chat | `CHAT_DB_USER` | `CHAT_DB_PASSWORD` |
+| bi-backend | `BI_DB_USER` | `BI_DB_PASSWORD` |
+| session-gateway | `AI_SHELL_DB_USER` | `AI_SHELL_DB_PASSWORD` |
+
+### RDS 连接
+
+| 环境 | RDS Host | 本地端口 |
+|------|----------|----------|
+| Stage | `optima-stage-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com` | 15432 |
+| Prod | `optima-prod-postgres.ctg866o0ehac.ap-southeast-1.rds.amazonaws.com` | 15433 |
+
+**跳板机**: `13.251.46.219` (Shared EC2)
+
 ## 🔗 相关命令
 
 - `optima-query-db` - CLI 查询工具（推荐）

package/bin/helpers/query-db.ts

@@ -40,7 +40,7 @@ const SERVICE_DB_MAP = {
   },
   'session-gateway': {
     ci: null, // CI 环境暂无 session-gateway 数据库
-    stage: { userKey: 'SHELL_DB_USER', passwordKey: 'SHELL_DB_PASSWORD', database: 'optima_shell' },
+    stage: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_shell' },
     prod: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_ai_shell' }
   }
 };
@@ -75,14 +75,14 @@ function getInfisicalToken(config: InfisicalConfig): string {
   return JSON.parse(response).accessToken;
 }
 
-function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string): Record<string, string> {
+function getInfisicalSecrets(config: InfisicalConfig, token: string, environment: string, secretPath: string): Record<string, string> {
   const response = execSync(
-    `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=/infrastructure" -H "Authorization: Bearer ${token}"`,
+    `curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`,
     { encoding: 'utf-8' }
   );
   const data = JSON.parse(response);
   const secrets: Record<string, string> = {};
-  for (const secret of data.secrets) {
+  for (const secret of data.secrets || []) {
     secrets[secret.secretKey] = secret.secretValue;
   }
   return secrets;
@@ -223,8 +223,10 @@ async function main() {
     const token = getInfisicalToken(infisicalConfig);
     console.log('✓ Obtained Infisical access token');
 
-    // 数据库凭证统一存储在 Infisical 的 prod 环境（Stage/Prod 共享相同凭证）
-    const secrets = getInfisicalSecrets(infisicalConfig, token, 'prod');
+    // 数据库凭证存储在 Infisical 的 /shared-secrets/database-users 路径
+    // Stage 从 staging 环境读取，Prod 从 prod 环境读取
+    const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
+    const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
     console.log('✓ Retrieved database credentials from Infisical');
 
     const { userKey, passwordKey, database } = serviceConfig as any;

package/dist/bin/helpers/query-db.js

@@ -59,7 +59,7 @@ const SERVICE_DB_MAP = {
     },
     'session-gateway': {
         ci: null, // CI 环境暂无 session-gateway 数据库
-        stage: { userKey: 'SHELL_DB_USER', passwordKey: 'SHELL_DB_PASSWORD', database: 'optima_shell' },
+        stage: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_shell' },
         prod: { userKey: 'AI_SHELL_DB_USER', passwordKey: 'AI_SHELL_DB_PASSWORD', database: 'optima_ai_shell' }
     }
 };
@@ -85,11 +85,11 @@ function getInfisicalToken(config) {
     const response = (0, child_process_1.execSync)(`curl -s -X POST "${config.url}/api/v1/auth/universal-auth/login" -H "Content-Type: application/json" -d '{"clientId": "${config.clientId}", "clientSecret": "${config.clientSecret}"}'`, { encoding: 'utf-8' });
     return JSON.parse(response).accessToken;
 }
-function getInfisicalSecrets(config, token, environment) {
-    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=/infrastructure" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
+function getInfisicalSecrets(config, token, environment, secretPath) {
+    const response = (0, child_process_1.execSync)(`curl -s "${config.url}/api/v3/secrets/raw?workspaceId=${config.projectId}&environment=${environment}&secretPath=${secretPath}" -H "Authorization: Bearer ${token}"`, { encoding: 'utf-8' });
     const data = JSON.parse(response);
     const secrets = {};
-    for (const secret of data.secrets) {
+    for (const secret of data.secrets || []) {
         secrets[secret.secretKey] = secret.secretValue;
     }
     return secrets;
@@ -201,8 +201,10 @@ async function main() {
         console.log('✓ Loaded Infisical config from GitHub Variables');
         const token = getInfisicalToken(infisicalConfig);
         console.log('✓ Obtained Infisical access token');
-        // 数据库凭证统一存储在 Infisical 的 prod 环境（Stage/Prod 共享相同凭证）
-        const secrets = getInfisicalSecrets(infisicalConfig, token, 'prod');
+        // 数据库凭证存储在 Infisical 的 /shared-secrets/database-users 路径
+        // Stage 从 staging 环境读取，Prod 从 prod 环境读取
+        const infisicalEnv = environment === 'stage' ? 'staging' : 'prod';
+        const secrets = getInfisicalSecrets(infisicalConfig, token, infisicalEnv, '/shared-secrets/database-users');
         console.log('✓ Retrieved database credentials from Infisical');
         const { userKey, passwordKey, database } = serviceConfig;
         const dbHost = RDS_HOSTS[environment];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@optima-chat/dev-skills",
-  "version": "0.7.11",
+  "version": "0.7.13",
   "description": "Claude Code Skills for Optima development team - cross-environment collaboration tools",
   "main": "index.js",
   "bin": {