@qingflow-tech/qingflow-cli 1.1.40 → 1.1.41

package/README.md

@@ -7,7 +7,7 @@ Qingflow CLI 是轻流面向开发者和 AI Agent 的命令行工具。它把轻
 ## 安装
 
 ```bash
-npm install @qingflow-tech/qingflow-cli@1.1.40
+npm install @qingflow-tech/qingflow-cli@1.1.41
 ```
 
 推荐从官网复制这一条一键安装 Qingflow CLI：
@@ -21,7 +21,7 @@ npx qingflow-cli@latest install
 ## 运行
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.40 qingflow
+npx -y -p @qingflow-tech/qingflow-cli@1.1.41 qingflow
 ```
 
 全局安装后可以直接运行：
@@ -55,7 +55,7 @@ qingflow-skills install --agent codex --scope user
 如果你通过一次性 `npx -p` 执行 skills 安装，建议加 `--copy`，避免 symlink 指向 npm 临时执行缓存：
 
 ```bash
-npx -y -p @qingflow-tech/qingflow-cli@1.1.40 qingflow-skills install --agent codex --scope user --copy
+npx -y -p @qingflow-tech/qingflow-cli@1.1.41 qingflow-skills install --agent codex --scope user --copy
 ```
 
 `qingflow-skills install` 默认使用 symlink，且遇到同名 skill 不会覆盖；只有显式传入 `--force` 才会替换。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qingflow-tech/qingflow-cli",
-  "version": "1.1.40",
+  "version": "1.1.41",
   "description": "Human-friendly Qingflow command line interface for auth, record operations, import, tasks, and stable builder flows.",
   "license": "MIT",
   "type": "module",

package/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "qingflow-mcp"
-version = "1.1.40"
+version = "1.1.41"
 description = "User-authenticated MCP server for Qingflow"
 readme = "README.md"
 license = "MIT"

package/src/qingflow_mcp/session_store.py

@@ -105,7 +105,7 @@ class SessionStore:
         persist: bool,
     ) -> SessionProfile:
         now = _utcnow()
-        previous = self.get_profile(profile)
+        previous = self.peek_profile(profile)
         persisted = False
         if persist:
             persisted = self._set_secret(self._token_key(profile), token)
@@ -163,6 +163,12 @@ class SessionStore:
             session_profile = SessionProfile.from_dict(raw_profile) if isinstance(raw_profile, dict) else None
         return session_profile
 
+    def peek_profile(self, profile: str) -> SessionProfile | None:
+        """读取 profile，但不触发缺失、过期会话的自动刷新。"""
+        payload = self._load_profiles()
+        raw_profile = payload.get("profiles", {}).get(profile)
+        return SessionProfile.from_dict(raw_profile) if isinstance(raw_profile, dict) else None
+
     def get_backend_session(self, profile: str) -> BackendSession | None:
         if profile in self._logged_out_profiles:
             return None

package/src/qingflow_mcp/tools/auth_tools.py

@@ -1,8 +1,8 @@
 from __future__ import annotations
 
 import json
-from typing import Any
 import os
+from typing import Any
 
 from mcp.server.fastmcp import FastMCP
 
@@ -85,7 +85,8 @@ class AuthTools(ToolBase):
         persist: bool = False,
     ) -> dict[str, Any]:
         """执行认证与会话相关逻辑。"""
-        resolved_base_url, resolved_credential = self._resolve_mcporter_auth_inputs(
+        resolved_base_url, resolved_credential = self._resolve_auth_inputs(
+            profile=profile,
             base_url=base_url,
             credential=credential,
         )
@@ -306,10 +307,18 @@ class AuthTools(ToolBase):
             ),
         }
 
-    def _resolve_mcporter_auth_inputs(self, *, base_url: str | None, credential: str | None) -> tuple[str | None, str]:
-        """从参数或 mcporter 配置解析登录所需 base_url 与 credential。"""
+    def _resolve_auth_inputs(
+        self,
+        *,
+        profile: str,
+        base_url: str | None,
+        credential: str | None,
+    ) -> tuple[str | None, str]:
+        """按显式参数、环境变量、mcporter、profile 的顺序解析认证输入。"""
         normalized_base_url = self._normalize_text(base_url)
         normalized_credential = self._normalize_text(credential)
+        if not normalized_credential:
+            normalized_credential = self._normalize_text(os.getenv("QINGFLOW_CREDENTIAL"))
         if normalized_base_url and normalized_credential:
             return normalized_base_url, normalized_credential
 
@@ -317,11 +326,13 @@ class AuthTools(ToolBase):
         if not normalized_base_url:
             normalized_base_url = self._normalize_text(mcporter_context.get("base_url"))
         if not normalized_base_url:
-            normalized_base_url = os.getenv("QINGFLOW_BASE_URL")
+            normalized_base_url = self._normalize_text(os.getenv("QINGFLOW_BASE_URL"))
         if not normalized_credential:
             normalized_credential = self._normalize_text(mcporter_context.get("credential"))
         if not normalized_credential:
-            normalized_credential = os.getenv("QINGFLOW_CREDENTIAL")
+            session_profile = self.sessions.peek_profile(profile)
+            if session_profile is not None:
+                normalized_credential = self._normalize_text(session_profile.credential)
         return normalized_base_url, normalized_credential or ""
 
     def _read_mcporter_qingflow_context(self) -> dict[str, str]:
@@ -355,15 +366,12 @@ class AuthTools(ToolBase):
         profile: str,
         session_profile,
     ) -> bool:
-        backend_session = self.sessions.get_backend_session(profile) if session_profile is not None else None
         base_url = session_profile.base_url if session_profile is not None else None
-        credential = backend_session.credential if backend_session is not None else None
         persist = bool(session_profile.persisted) if session_profile is not None else False
         try:
             self.auth_use_credential(
                 profile=profile,
                 base_url=base_url,
-                credential=credential,
                 persist=persist,
             )
         except (QingflowApiError, RuntimeError):

package/src/qingflow_mcp/tools/base.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import os
 from contextvars import ContextVar
 from typing import Any, Callable, TypeVar
 
@@ -29,6 +30,7 @@ class ToolBase:
         if cloud_context is not None:
             return cloud_context.as_tool_context(profile)
 
+        self._ensure_environment_credential_matches(profile)
         session_profile = self.sessions.get_profile(profile)
         if session_profile is None:
             raise QingflowApiError.auth_required(profile)
@@ -151,50 +153,106 @@ class ToolBase:
         if not credential:
             return False
         try:
-            response = self.backend.public_request_with_meta(
-                "POST",
-                session_profile.base_url,
-                "/mcp/auth/context",
-                json_body={"credential": credential},
-                qf_version=backend_session.qf_version,
-            )
-            payload = self._unwrap_context_payload(response.data)
-            token = self._normalize_text(payload.get("token"))
-            ws_id = self._coerce_positive_int(payload.get("wsId"))
-            uid = self._coerce_positive_int(payload.get("uid")) or session_profile.uid
-            if not token or ws_id is None:
-                return False
-            backend_qf_version = self._normalize_text(payload.get("qfVersion")) or response.qf_response_version
-            qf_version = backend_qf_version if backend_qf_version is not None else backend_session.qf_version
-            qf_version_source = (
-                "backend_response"
-                if backend_qf_version is not None
-                else backend_session.qf_version_source
-            )
-            base_url = self._normalize_text(payload.get("baseUrl")) or session_profile.base_url
-            ws_name = self._normalize_text(payload.get("wsName")) or session_profile.selected_ws_name
-            self.sessions.save_session(
-                profile=profile,
-                base_url=base_url,
-                qf_version=qf_version,
-                qf_version_source=qf_version_source,
-                token=token,
-                login_token=None,
+            self._exchange_session_from_credential(
+                profile,
+                session_profile=session_profile,
                 credential=credential,
-                uid=uid,
-                email=self._normalize_text(payload.get("email")) or session_profile.email,
-                nick_name=(
-                    self._normalize_text(payload.get("nickName"))
-                    or self._normalize_text(payload.get("displayName"))
-                    or self._normalize_text(payload.get("name"))
-                    or session_profile.nick_name
-                ),
-                persist=session_profile.persisted,
             )
-            self.sessions.select_workspace(profile, ws_id=ws_id, ws_name=ws_name)
-            return True
         except QingflowApiError:
             return False
+        return True
+
+    def _ensure_environment_credential_matches(self, profile: str) -> None:
+        environment_credential = self._normalize_text(os.getenv("QINGFLOW_CREDENTIAL"))
+        if environment_credential is None:
+            return
+        session_profile = self.sessions.peek_profile(profile)
+        if session_profile is None:
+            return
+        if self._normalize_text(session_profile.credential) == environment_credential:
+            return
+        try:
+            self._exchange_session_from_credential(
+                profile,
+                session_profile=session_profile,
+                credential=environment_credential,
+                preserve_existing_metadata=False,
+            )
+        except QingflowApiError as error:
+            raise QingflowApiError(
+                category="auth",
+                message=(
+                    f"QINGFLOW_CREDENTIAL changed for profile '{profile}', "
+                    "but the session could not be refreshed."
+                ),
+                backend_code=error.backend_code,
+                request_id=error.request_id,
+                http_status=error.http_status,
+                details={
+                    "reason": "environment_credential_changed",
+                },
+            ) from error
+
+    def _exchange_session_from_credential(
+        self,
+        profile: str,
+        *,
+        session_profile: SessionProfile,
+        credential: str,
+        preserve_existing_metadata: bool = True,
+    ) -> None:
+        response = self.backend.public_request_with_meta(
+            "POST",
+            session_profile.base_url,
+            "/mcp/auth/context",
+            json_body={"credential": credential},
+            qf_version=session_profile.qf_version,
+        )
+        payload = self._unwrap_context_payload(response.data)
+        token = self._normalize_text(payload.get("token"))
+        ws_id = self._coerce_positive_int(payload.get("wsId"))
+        response_uid = self._coerce_positive_int(payload.get("uid"))
+        if not token or ws_id is None or (response_uid is None and not preserve_existing_metadata):
+            raise QingflowApiError(
+                category="auth",
+                message="Credential context did not return a valid user session and workspace.",
+                request_id=response.request_id,
+                http_status=response.http_status,
+            )
+        uid = response_uid or session_profile.uid
+        backend_qf_version = self._normalize_text(payload.get("qfVersion")) or response.qf_response_version
+        qf_version = backend_qf_version if backend_qf_version is not None else session_profile.qf_version
+        qf_version_source = (
+            "backend_response"
+            if backend_qf_version is not None
+            else session_profile.qf_version_source
+        )
+        base_url = self._normalize_text(payload.get("baseUrl")) or session_profile.base_url
+        ws_name = self._normalize_text(payload.get("wsName"))
+        email = self._normalize_text(payload.get("email"))
+        nick_name = (
+            self._normalize_text(payload.get("nickName"))
+            or self._normalize_text(payload.get("displayName"))
+            or self._normalize_text(payload.get("name"))
+        )
+        if preserve_existing_metadata:
+            ws_name = ws_name or session_profile.selected_ws_name
+            email = email or session_profile.email
+            nick_name = nick_name or session_profile.nick_name
+        self.sessions.save_session(
+            profile=profile,
+            base_url=base_url,
+            qf_version=qf_version,
+            qf_version_source=qf_version_source,
+            token=token,
+            login_token=None,
+            credential=credential,
+            uid=uid,
+            email=email,
+            nick_name=nick_name,
+            persist=session_profile.persisted,
+        )
+        self.sessions.select_workspace(profile, ws_id=ws_id, ws_name=ws_name)
 
     def _unwrap_context_payload(self, payload: Any) -> dict[str, Any]:
         if not isinstance(payload, dict):