@qcplay/cli 1.0.5 → 1.0.7

package/README.md

@@ -7,6 +7,9 @@
 - 认证默认请求线上接口：`https://cli.qcg.ink`
 - 发布默认请求线上接口：`https://cli.qcg.ink`
 - 登录默认打开线上页面：`https://cli.qcg.ink/auth.html`
+- 登录凭证保存在当前用户本机的 `~/.qcplay/auth.json`，不同客户端之间不共享账号
+- 状态、权限和发布请求通过 Bearer Token 识别当前账号
+- `qcplay-cli update` 会更新 npm 全局包，并同步 `~/.agents/skills`
 - 本地调试时可直接使用 `--local`
 - `--local` 默认指向 `http://127.0.0.1:8787`
 - `qcplay-cli auth --local` 会打开仓库里的本地页面 `web/auth.html`

package/bin/qcplay.js

@@ -91,18 +91,27 @@ const BOOLEAN_TEXT_MAP = {
 const QCPLAY_DIR = path.join(os.homedir(), ".qcplay");
 const AGENTS_DIR = path.join(os.homedir(), ".agents");
 const CONFIG_FILE = path.join(QCPLAY_DIR, "config.json");
+const AUTH_FILE = path.join(QCPLAY_DIR, "auth.json");
 const SKILLS_DIR = path.join(AGENTS_DIR, "skills");
 
-function readPackageVersion() {
+function readPackageMetadata() {
   try {
     const packageJson = JSON.parse(fs.readFileSync(PACKAGE_JSON, "utf8"));
-    return packageJson.version || "0.0.0";
+    return {
+      name: packageJson.name || "@qcplay/cli",
+      version: packageJson.version || "0.0.0"
+    };
   } catch {
-    return "0.0.0";
+    return {
+      name: "@qcplay/cli",
+      version: "0.0.0"
+    };
   }
 }
 
-const PACKAGE_VERSION = readPackageVersion();
+const PACKAGE_METADATA = readPackageMetadata();
+const PACKAGE_NAME = PACKAGE_METADATA.name;
+const PACKAGE_VERSION = PACKAGE_METADATA.version;
 const colorsEnabled = process.stdout.isTTY && process.env.NO_COLOR !== "1";
 
 const chalk = {
@@ -126,6 +135,7 @@ function printRootHelp() {
 
 Usage:
   qcplay-cli install [--local]
+  qcplay-cli update
   qcplay-cli auth [login|status|logout] [--local] [--backend <url>] [--auth-page <url>]
   qcplay-cli auth permissions [--local] [--key <key>] [--json]
   qcplay-cli article
@@ -141,6 +151,11 @@ Options:
 `);
 }
 
+function printUpdateHelp() {
+  console.log("Usage:");
+  console.log("  qcplay-cli update");
+}
+
 function printAuthHelp() {
   console.log("Usage:");
   console.log("  qcplay-cli auth [login|status|logout] [--local] [--backend <url>] [--auth-page <url>]");
@@ -220,6 +235,7 @@ async function writeJson(filePath, value) {
     encoding: "utf8",
     mode: 0o600
   });
+  await fs.promises.chmod(filePath, 0o600);
 }
 
 async function readJson(filePath) {
@@ -236,15 +252,70 @@ async function ensureLocalDirs() {
   await ensureDir(SKILLS_DIR);
 }
 
+async function filesAreEqual(sourcePath, targetPath) {
+  try {
+    const [sourceContent, targetContent] = await Promise.all([
+      fs.promises.readFile(sourcePath),
+      fs.promises.readFile(targetPath)
+    ]);
+    return sourceContent.equals(targetContent);
+  } catch {
+    return false;
+  }
+}
+
+async function syncDirectoryChanges(sourceDir, targetDir, rootDir = sourceDir, changes = { added: [], updated: [] }) {
+  await ensureDir(targetDir);
+  const entries = await fs.promises.readdir(sourceDir, { withFileTypes: true });
+
+  for (const entry of entries) {
+    const sourcePath = path.join(sourceDir, entry.name);
+    const targetPath = path.join(targetDir, entry.name);
+
+    if (entry.isDirectory()) {
+      await syncDirectoryChanges(sourcePath, targetPath, rootDir, changes);
+      continue;
+    }
+
+    if (!entry.isFile()) {
+      continue;
+    }
+
+    const relativePath = path.relative(rootDir, sourcePath);
+    if (!(await pathExists(targetPath))) {
+      await ensureDir(path.dirname(targetPath));
+      await fs.promises.copyFile(sourcePath, targetPath);
+      changes.added.push(relativePath);
+      continue;
+    }
+
+    if (await filesAreEqual(sourcePath, targetPath)) {
+      continue;
+    }
+
+    await fs.promises.copyFile(sourcePath, targetPath);
+    changes.updated.push(relativePath);
+  }
+
+  return changes;
+}
+
 async function installSkills() {
   const sourceDir = path.resolve(__dirname, "../templates/skills");
 
   if (!(await pathExists(sourceDir))) {
-    return false;
+    return {
+      available: false,
+      added: [],
+      updated: []
+    };
   }
 
-  await copyRecursive(sourceDir, SKILLS_DIR);
-  return true;
+  const changes = await syncDirectoryChanges(sourceDir, SKILLS_DIR);
+  return {
+    available: true,
+    ...changes
+  };
 }
 
 async function saveConfig(authBackendUrl, publishBackendUrl, authPageUrl, localMode = false) {
@@ -264,6 +335,19 @@ async function loadConfig() {
   return readJson(CONFIG_FILE);
 }
 
+async function updateStoredConfigVersion(version) {
+  const config = await loadConfig();
+  if (Object.keys(config).length === 0) {
+    return;
+  }
+
+  await writeJson(CONFIG_FILE, {
+    ...config,
+    version,
+    updated_at: Date.now()
+  });
+}
+
 function normalizeText(value) {
   return String(value ?? "").trim();
 }
@@ -409,7 +493,7 @@ function parsePublishOptions(args) {
   };
 }
 
-function requestJson(method, baseUrl, pathname, payload) {
+function requestJson(method, baseUrl, pathname, payload, headers = {}) {
   return new Promise((resolve, reject) => {
     const url = new URL(pathname, baseUrl);
     const client = url.protocol === "https:" ? https : http;
@@ -423,6 +507,7 @@ function requestJson(method, baseUrl, pathname, payload) {
           Accept: "application/json",
           "Content-Type": "application/json",
           "User-Agent": `qcplay-cli/${PACKAGE_VERSION}`,
+          ...headers,
           ...(body ? { "Content-Length": Buffer.byteLength(body) } : {})
         }
       },
@@ -441,7 +526,9 @@ function requestJson(method, baseUrl, pathname, payload) {
           }
 
           if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) {
-            reject(new Error(json.message || `接口请求失败 (${res.statusCode})`));
+            const error = new Error(json.message || `接口请求失败 (${res.statusCode})`);
+            error.statusCode = res.statusCode || 0;
+            reject(error);
             return;
           }
 
@@ -489,6 +576,28 @@ function openBrowser(targetUrl) {
   });
 }
 
+function getNpmCommand() {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+
+function runCommand(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: "inherit"
+    });
+
+    child.on("error", reject);
+    child.on("close", code => {
+      if (code === 0) {
+        resolve();
+        return;
+      }
+
+      reject(new Error(`命令执行失败 (${code}): ${command} ${args.join(" ")}`));
+    });
+  });
+}
+
 function delay(ms) {
   return new Promise(resolve => {
     setTimeout(resolve, ms);
@@ -557,9 +666,18 @@ function resolvePublishBackendUrl(options, config = {}) {
   return ensureAbsoluteUrl(backendUrl, "--backend");
 }
 
-async function fetchLoginSuccessSequence(baseUrl) {
-  const response = await requestJson("GET", baseUrl, "/api/auth/login-success");
-  return Number(response.data?.sequence || 0);
+async function createLoginRequest(baseUrl) {
+  const response = await requestJson("POST", baseUrl, "/api/auth/login-request", {});
+  const requestId = normalizeText(response.data?.request_id);
+  const pollToken = normalizeText(response.data?.poll_token);
+  if (!requestId || !pollToken) {
+    throw new Error("认证后端没有返回有效的登录请求凭证");
+  }
+  return {
+    requestId,
+    pollToken,
+    expiresIn: Number(response.data?.expires_in || 600)
+  };
 }
 
 function isNonJsonResponseError(error) {
@@ -569,22 +687,30 @@ function isNonJsonResponseError(error) {
 function buildAuthBackendError(baseUrl, error) {
   if (isNonJsonResponseError(error)) {
     return new Error(
-      `认证接口 ${baseUrl} 返回了 HTML 页面，不是 JSON。请确认 ${baseUrl}/api/auth/login、${baseUrl}/api/auth/login-success、${baseUrl}/api/auth/status 已正确部署，而不是被站点首页或登录页接管。`
+      `认证接口 ${baseUrl} 返回了 HTML 页面，不是 JSON。请确认 ${baseUrl}/api/auth/login-request、${baseUrl}/api/auth/login、${baseUrl}/api/auth/login-success、${baseUrl}/api/auth/status 已正确部署，而不是被站点首页或登录页接管。`
     );
   }
 
   return error;
 }
 
-async function waitForLoginSuccessSequence(baseUrl, previousSequence, intervalMs = 1000, timeoutMs = 60000) {
+async function waitForLoginResult(baseUrl, loginRequest, intervalMs = 1000) {
   const startedAt = Date.now();
+  const timeoutMs = Math.max(1, loginRequest.expiresIn) * 1000;
   let lastError;
+  const query = new URLSearchParams({ request_id: loginRequest.requestId });
 
   while (true) {
     try {
-      const nextSequence = await fetchLoginSuccessSequence(baseUrl);
-      if (nextSequence > previousSequence) {
-        return nextSequence;
+      const response = await requestJson("GET", baseUrl, `/api/auth/login-success?${query}`, undefined, {
+        "X-QCPlay-Poll-Token": loginRequest.pollToken
+      });
+      if (response.data?.complete) {
+        const result = response.data?.result;
+        if (!result?.access_token || !result?.refresh_token) {
+          throw new Error("认证后端返回的登录结果不完整");
+        }
+        return result;
       }
     } catch (error) {
       lastError = error;
@@ -602,13 +728,15 @@ async function waitForLoginSuccessSequence(baseUrl, previousSequence, intervalMs
   }
 }
 
-function buildAuthPageUrl(backendUrl, authPageUrl = "") {
+function buildAuthPageUrl(backendUrl, authPageUrl = "", requestId = "") {
   const targetUrl = authPageUrl ? new URL(authPageUrl) : pathToFileURL(AUTH_PAGE);
 
   if (shouldAttachBackendQuery(targetUrl, backendUrl)) {
     targetUrl.searchParams.set("backend", backendUrl);
   }
 
+  targetUrl.searchParams.set("request_id", requestId);
+
   return targetUrl.toString();
 }
 
@@ -625,6 +753,117 @@ function shouldAttachBackendQuery(targetUrl, backendUrl) {
   return normalizedBackendUrl.origin !== targetUrl.origin;
 }
 
+function normalizeTimestamp(value) {
+  const timestamp = Number(value || 0);
+  return timestamp > 0 && timestamp < 1_000_000_000_000 ? timestamp * 1000 : timestamp;
+}
+
+function tokenIsValid(token, expiresAt) {
+  return Boolean(normalizeText(token)) && Date.now() < normalizeTimestamp(expiresAt);
+}
+
+function authRequiredError(message) {
+  const error = new Error(message);
+  error.code = "AUTH_REQUIRED";
+  return error;
+}
+
+async function loadAuthState() {
+  const state = await readJson(AUTH_FILE);
+  return normalizeText(state.access_token) ? state : {};
+}
+
+async function saveAuthState(result, backendUrl) {
+  if (!normalizeText(result?.access_token) || !normalizeText(result?.refresh_token)) {
+    throw new Error("认证后端返回的登录结果不完整");
+  }
+
+  await writeJson(AUTH_FILE, {
+    backend_url: backendUrl,
+    api_base: result.api_base || "",
+    access_token: result.access_token,
+    refresh_token: result.refresh_token,
+    token_type: result.token_type || "Bearer",
+    expires_at: Number(result.expires_at || 0),
+    refresh_expires_at: Number(result.refresh_expires_at || 0),
+    created_at: Number(result.created_at || Date.now()),
+    id: Number(result.id || 0),
+    account: result.account || "",
+    name: result.name || "",
+    status: result.status || "",
+    type: result.type || ""
+  });
+}
+
+async function removeAuthState() {
+  try {
+    await fs.promises.unlink(AUTH_FILE);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+}
+
+async function refreshAuthState(state, fallbackBackendUrl) {
+  if (!tokenIsValid(state.refresh_token, state.refresh_expires_at)) {
+    throw authRequiredError("登录状态已过期，请重新登录");
+  }
+
+  const authBackendUrl = normalizeOptionalUrl(state.backend_url) || fallbackBackendUrl;
+  const response = await requestJson("POST", authBackendUrl, "/api/auth/login", {
+    refresh_token: state.refresh_token
+  });
+  const result = response.data?.result;
+  await saveAuthState(result, authBackendUrl);
+  return loadAuthState();
+}
+
+async function requireAuthState(backendUrl) {
+  let state = await loadAuthState();
+  if (!normalizeText(state.access_token)) {
+    throw authRequiredError("未检测到登录状态，请先执行 qcplay-cli auth");
+  }
+
+  if (!tokenIsValid(state.access_token, state.expires_at)) {
+    try {
+      state = await refreshAuthState(state, backendUrl);
+    } catch (error) {
+      if (error.code === "AUTH_REQUIRED" || error.statusCode === 401) {
+        await removeAuthState();
+      }
+      throw error;
+    }
+  }
+  return state;
+}
+
+async function authenticatedRequest(method, baseUrl, pathname, payload) {
+  let state = await requireAuthState(baseUrl);
+  try {
+    return await requestJson(method, baseUrl, pathname, payload, {
+      Authorization: `Bearer ${state.access_token}`
+    });
+  } catch (error) {
+    if (error.statusCode !== 401) {
+      throw error;
+    }
+  }
+
+  try {
+    state = await refreshAuthState(state, baseUrl);
+  } catch (error) {
+    if (error.code === "AUTH_REQUIRED" || error.statusCode === 401) {
+      await removeAuthState();
+    }
+    throw error;
+  }
+
+  return requestJson(method, baseUrl, pathname, payload, {
+    Authorization: `Bearer ${state.access_token}`
+  });
+}
+
 function flattenPermissionTree(items, bucket = []) {
   for (const item of items) {
     bucket.push(item);
@@ -675,6 +914,33 @@ function printPermissionTree(items) {
   }
 }
 
+function formatAccountSummary(data = {}) {
+  const id = Number(data.id || 0);
+  const name = normalizeText(data.name) || "未知账号";
+  const account = normalizeText(data.account);
+  const type = normalizeText(data.type);
+  const status = normalizeText(data.status);
+  const parts = [name];
+
+  if (account && account !== name) {
+    parts.push(`account=${account}`);
+  }
+
+  if (id > 0) {
+    parts.push(`id=${id}`);
+  }
+
+  if (type) {
+    parts.push(`type=${type}`);
+  }
+
+  if (status) {
+    parts.push(`status=${status}`);
+  }
+
+  return parts.join(" | ");
+}
+
 async function installCommand(options) {
   const config = await loadConfig();
   const localMode = isLocalMode(options, config);
@@ -690,7 +956,7 @@ async function installCommand(options) {
   console.log(chalk.green("✔ 本地目录已创建"));
 
   const skillsInstalled = await installSkills();
-  if (skillsInstalled) {
+  if (skillsInstalled.available) {
     console.log(chalk.green("✔ Skills 已安装"));
     console.log(`Skills 目录: ${chalk.gray(SKILLS_DIR)}`);
   } else {
@@ -708,6 +974,56 @@ async function installCommand(options) {
   console.log("");
 }
 
+function printSkillsSyncResult(result) {
+  if (!result.available) {
+    console.log(chalk.yellow("! 未找到 Skills 模板，已跳过"));
+    return;
+  }
+
+  const addedCount = result.added.length;
+  const updatedCount = result.updated.length;
+  if (addedCount === 0 && updatedCount === 0) {
+    console.log(chalk.green("✔ Skills 已检查，无新增或变更"));
+    console.log(`Skills 目录: ${chalk.gray(SKILLS_DIR)}`);
+    return;
+  }
+
+  const parts = [];
+  if (addedCount > 0) {
+    parts.push(`新增 ${addedCount} 个文件`);
+  }
+  if (updatedCount > 0) {
+    parts.push(`更新 ${updatedCount} 个文件`);
+  }
+
+  console.log(chalk.green(`✔ Skills 已同步（${parts.join("，")}）`));
+  console.log(`Skills 目录: ${chalk.gray(SKILLS_DIR)}`);
+}
+
+async function updateCommand() {
+  console.log("");
+  console.log(chalk.cyan("正在更新 QCPlay CLI..."));
+  console.log(chalk.gray(`当前版本: ${PACKAGE_VERSION}`));
+  console.log("");
+
+  await ensureLocalDirs();
+  await runCommand(getNpmCommand(), ["install", "-g", `${PACKAGE_NAME}@latest`]);
+
+  const latestPackage = readPackageMetadata();
+  await updateStoredConfigVersion(latestPackage.version);
+  const skillsInstalled = await installSkills();
+
+  console.log("");
+  console.log(chalk.green("CLI 更新完成"));
+  if (latestPackage.version !== PACKAGE_VERSION) {
+    console.log(chalk.gray(`版本: ${PACKAGE_VERSION} -> ${latestPackage.version}`));
+  } else {
+    console.log(chalk.gray(`版本: ${latestPackage.version}`));
+  }
+  printSkillsSyncResult(skillsInstalled);
+  console.log("");
+}
+
 async function authCommand(rawArgs = []) {
   const parsed = parseBackendOptions(rawArgs);
   const options = parsed.options;
@@ -718,8 +1034,8 @@ async function authCommand(rawArgs = []) {
   const authPageUrl = resolveAuthPageUrl(options, config);
 
   if (!action || action === "login") {
-    const loginPageUrl = buildAuthPageUrl(backendUrl, authPageUrl);
-    let previousSequence = 0;
+    const loginRequest = await createLoginRequest(backendUrl);
+    const loginPageUrl = buildAuthPageUrl(backendUrl, authPageUrl, loginRequest.requestId);
 
     console.log(chalk.cyan("正在登录中"));
     try {
@@ -729,35 +1045,50 @@ async function authCommand(rawArgs = []) {
       console.log(chalk.gray(loginPageUrl));
     }
 
-    try {
-      previousSequence = await fetchLoginSuccessSequence(backendUrl);
-    } catch {}
-
-    await waitForLoginSuccessSequence(backendUrl, previousSequence);
+    const result = await waitForLoginResult(backendUrl, loginRequest);
+    await saveAuthState(result, backendUrl);
+    const statusResponse = await authenticatedRequest("GET", backendUrl, "/api/auth/status");
+    if (!statusResponse.data?.logged_in) {
+      await removeAuthState();
+      throw new Error("登录结果校验失败，请重新登录");
+    }
     console.log(chalk.green("登录成功"));
+    console.log(chalk.gray(`当前账号: ${formatAccountSummary(statusResponse.data)}`));
     return;
   }
 
   if (action === "status") {
-    const response = await requestJson("GET", backendUrl, "/api/auth/status");
+    let response;
+    try {
+      response = await authenticatedRequest("GET", backendUrl, "/api/auth/status");
+    } catch (error) {
+      if (error.code === "AUTH_REQUIRED" || error.statusCode === 401 || !(await pathExists(AUTH_FILE))) {
+        await removeAuthState();
+        console.log(chalk.yellow("未登录"));
+        return;
+      }
+      throw error;
+    }
     if (response.data?.logged_in) {
       console.log(chalk.green("已登录"));
+      console.log(chalk.gray(`当前账号: ${formatAccountSummary(response.data)}`));
       return;
     }
 
+    await removeAuthState();
     console.log(chalk.yellow("未登录"));
     return;
   }
 
   if (action === "logout") {
-    const response = await requestJson("POST", backendUrl, "/api/auth/logout", {});
-    console.log(chalk.green(response.message || "已退出登录"));
+    await removeAuthState();
+    console.log(chalk.green("已退出登录"));
     return;
   }
 
   if (action === "permissions") {
     const flags = parsePermissionsOptions(args.slice(1));
-    const response = await requestJson("GET", backendUrl, "/api/permissions");
+    const response = await authenticatedRequest("GET", backendUrl, "/api/permissions");
     let permissions = response.data || [];
 
     if (flags.key) {
@@ -1150,7 +1481,7 @@ async function publishArticleCommand(file, options) {
   console.log(chalk.gray(`文章文件: ${articleFile}`));
   console.log("");
 
-  const response = await requestJson("POST", backendUrl, "/api/articles/publish", payload);
+  const response = await authenticatedRequest("POST", backendUrl, "/api/articles/publish", payload);
   console.log(chalk.green(response.message || "发布成功"));
   const articleId = response.data?.id ?? response.data?.article_id ?? response.data?.articleId;
   if (articleId !== undefined) {
@@ -1189,6 +1520,16 @@ async function main() {
     return;
   }
 
+  if (command === "update") {
+    if (subcommand === "-h" || subcommand === "--help") {
+      printUpdateHelp();
+      return;
+    }
+
+    await runWithErrorBanner("更新失败", () => updateCommand());
+    return;
+  }
+
   if (command === "auth") {
     if (subcommand === "-h" || subcommand === "--help") {
       printAuthHelp();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qcplay/cli",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "QCPlay CLI",
   "type": "module",
   "bin": {