@qmuse/qmuse-cli 1.0.1 → 1.0.2-dev.0

package/dist/cli.js

@@ -4,7 +4,7 @@
  *
  * 用法见 `qmuse help`。
  */
-import { applyEnvironment, loadConfig, saveConfig, findConfigPath } from './config.js';
+import { loadConfig, saveConfig, deleteSession, findConfigPath } from './config.js';
 import { hasAuth } from './client.js';
 import { log } from './logger.js';
 import * as api from './api.js';
@@ -69,14 +69,11 @@ const num = (f, key, def) => {
 };
 /** 仅允许使用内置环境，避免命令行参数把登录凭证重定向到任意地址。 */
 function resolveCfg(flags) {
-    let cfg = loadConfig();
     const environment = str(flags, '--env');
-    if (environment) {
-        if (!['prod', 'pre', 'local'].includes(environment)) {
-            fail('--env 仅支持 prod / pre / local');
-        }
-        cfg = applyEnvironment(cfg, environment);
+    if (environment && !['prod', 'pre', 'local'].includes(environment)) {
+        fail('--env 仅支持 prod / pre / local');
     }
+    const cfg = loadConfig(undefined, { environment: environment });
     // --space-id 覆盖当前空间
     const sp = str(flags, '--space-id');
     if (sp)
@@ -538,7 +535,7 @@ async function cmdWhoami(flags) {
 async function cmdConfig(command, flags) {
     const sub = command[1];
     if (!sub || sub === 'get') {
-        const cfg = loadConfig();
+        const cfg = resolveCfg(flags);
         const redacted = {
             ...cfg,
             sessionId: cfg.sessionId ? `<已设置，长度${cfg.sessionId.length}>` : '',
@@ -577,7 +574,7 @@ async function cmdSpace(command, flags) {
         const spaceId = command[2] || str(flags, '--space-id');
         if (!spaceId)
             fail('用法: qmuse space use <spaceId>');
-        const next = { ...loadConfig(), spaceId };
+        const next = { ...cfg, spaceId };
         saveConfig(next, true);
         log.success(`已设为当前空间 spaceId=${spaceId}（后续请求带 x-space-id 头）`);
         return;
@@ -622,9 +619,8 @@ async function cmdLogout(flags) {
         log.warn('当前未配置登录态，无需退出');
         return;
     }
-    const cleared = { ...cfg, sessionId: '', credentialOrigin: '' };
-    const path = saveConfig(cleared, true);
-    log.success(`已清除登录态并写入 ${path}`);
+    deleteSession(cfg);
+    log.success('已从系统凭证库清除当前环境的登录态');
 }
 // ---------------- 帮助 & 入口 ----------------
 const HELP = `QMuse CLI —— 将本地 React 项目导入 QMuse

package/dist/config.js

@@ -1,12 +1,14 @@
 /**
  * QMuse CLI 配置。
  *
- * 登录凭证只从用户级配置读取；项目级配置只能提供空间选择，不能改变请求目标
- * 或注入请求头。凭证同时绑定登录时的 API Origin，切换环境后必须重新登录。
+ * 登录凭证存入系统凭证库；项目级配置只能提供空间选择，不能改变请求目标
+ * 或注入请求头。各环境凭证按 API Origin 隔离。
  */
-import { chmodSync, existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { systemCredentialStore } from './credentials.js';
 const CONFIG_FILE = '.qmuse-cli.json';
 export const DEFAULT_CONFIG = {
     baseUrl: 'https://api.qmuse.cn',
@@ -36,18 +38,20 @@ const ENVIRONMENT_CONFIG = {
 export function configPaths() {
     return [join(process.cwd(), CONFIG_FILE), join(homedir(), CONFIG_FILE)];
 }
-function readConfig(path) {
-    if (!existsSync(path))
-        return {};
+function readConfig(path, userLevel = false) {
     try {
+        if (userLevel && !lstatSync(path).isFile()) {
+            throw new Error('User configuration must be a regular file');
+        }
         const parsed = JSON.parse(readFileSync(path, 'utf8'));
-        return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
-            ? parsed
-            : {};
+        if (parsed && typeof parsed === 'object' && !Array.isArray(parsed))
+            return parsed;
     }
-    catch {
-        return {};
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
     }
+    throw new Error(`无法读取配置文件，请检查文件权限和 JSON 格式：${path}`);
 }
 export function apiOrigin(baseUrl) {
     try {
@@ -64,27 +68,68 @@ function storedEnvironment(value) {
     const normalized = value.replace(/\/+$/u, '');
     return Object.values(ENVIRONMENT_CONFIG).find(environment => environment.baseUrl === normalized);
 }
-/**
- * 加载配置。项目配置即使由仓库提交，也只能覆盖 spaceId。
- * 旧配置没有 credentialOrigin 时，将凭证绑定到用户配置自身的 baseUrl。
- */
-export function loadConfig(paths = configPaths()) {
+function credentialOrigins(user) {
+    return Array.isArray(user.credentialOrigins)
+        ? [...new Set(user.credentialOrigins
+                .filter(origin => typeof origin === 'string' && storedEnvironment(origin))
+                .map(origin => apiOrigin(origin)))]
+        : [];
+}
+function writeConfig(path, user) {
+    const value = {
+        ...(typeof user.spaceId === 'string' && user.spaceId.trim() ? { spaceId: user.spaceId.trim() } : {}),
+        ...(credentialOrigins(user).length ? { credentialOrigins: credentialOrigins(user) } : {}),
+    };
+    const temporaryPath = `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, {
+            encoding: 'utf8', mode: 0o600, flag: 'wx',
+        });
+        renameSync(temporaryPath, path);
+    }
+    finally {
+        rmSync(temporaryPath, { force: true });
+    }
+}
+function storeVerified(credentials, origin, sessionId) {
+    credentials.set(origin, sessionId);
+    if (credentials.get(origin) !== sessionId) {
+        throw new Error('系统凭证库写入校验失败，未保存登录配置');
+    }
+}
+function migrateLegacy(path, credentials) {
+    const user = readConfig(path, true);
+    if (!Object.hasOwn(user, 'sessionId'))
+        return user;
+    const endpoint = storedEnvironment(user.baseUrl);
+    const origin = endpoint ? apiOrigin(endpoint.baseUrl) : '';
+    const token = typeof user.sessionId === 'string' ? user.sessionId.trim() : '';
+    const boundOrigin = typeof user.credentialOrigin === 'string' ? user.credentialOrigin.trim() : '';
+    const origins = credentialOrigins(user);
+    if (token && origin && (!boundOrigin || boundOrigin === origin)) {
+        // Prefer an existing keyring session when retrying an interrupted migration.
+        if (!credentials.get(origin))
+            storeVerified(credentials, origin, token);
+        origins.push(origin);
+    }
+    const migrated = { spaceId: user.spaceId, credentialOrigins: [...new Set(origins)] };
+    writeConfig(path, migrated);
+    return migrated;
+}
+/** 加载当前环境凭证；项目配置只能覆盖 spaceId。 */
+export function loadConfig(paths = configPaths(), options = {}) {
     const [projectPath, userPath] = paths;
-    const user = readConfig(userPath);
+    const credentials = options.credentials ?? systemCredentialStore;
+    const user = migrateLegacy(userPath, credentials);
     const project = readConfig(projectPath);
-    const storedEndpoint = storedEnvironment(user.baseUrl);
-    const sessionId = storedEndpoint && typeof user.sessionId === 'string'
-        ? user.sessionId.trim()
-        : '';
-    const credentialOrigin = sessionId
-        ? (typeof user.credentialOrigin === 'string' && user.credentialOrigin.trim()
-            ? user.credentialOrigin.trim()
-            : apiOrigin(storedEndpoint?.baseUrl ?? ''))
-        : '';
+    const environment = ENVIRONMENT_CONFIG[options.environment ?? 'prod'];
+    const origin = apiOrigin(environment.baseUrl);
+    const sessionId = credentialOrigins(user).includes(origin) ? (credentials.get(origin) ?? '') : '';
     return {
         ...DEFAULT_CONFIG,
+        ...environment,
         sessionId,
-        credentialOrigin,
+        credentialOrigin: sessionId ? origin : '',
         ...(typeof user.spaceId === 'string' && user.spaceId.trim()
             ? { spaceId: user.spaceId.trim() }
             : {}),
@@ -97,18 +142,41 @@ export function applyEnvironment(cfg, environment) {
     return { ...cfg, ...ENVIRONMENT_CONFIG[environment] };
 }
 /** 保存配置。项目级文件仅允许保存不敏感的空间选择。 */
-export function saveConfig(cfg, global = true) {
-    const path = global ? join(homedir(), CONFIG_FILE) : join(process.cwd(), CONFIG_FILE);
-    const value = global
-        ? cfg
-        : { ...(cfg.spaceId ? { spaceId: cfg.spaceId } : {}) };
-    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, {
-        encoding: 'utf8',
-        mode: 0o600,
-    });
-    chmodSync(path, 0o600);
+export function saveConfig(cfg, global = true, options = {}) {
+    const paths = options.paths ?? configPaths();
+    const path = global ? paths[1] : paths[0];
+    const user = global ? migrateLegacy(path, options.credentials ?? systemCredentialStore) : {};
+    writeConfig(path, { ...user, spaceId: cfg.spaceId });
     return path;
 }
+/** 登录与续期使用独立写入入口，普通配置永不携带凭证。 */
+export function saveSession(sessionId, cfg, options = {}) {
+    const endpoint = storedEnvironment(cfg.baseUrl);
+    if (!endpoint || !sessionId.trim())
+        throw new Error('登录凭证或目标环境无效');
+    const origin = apiOrigin(endpoint.baseUrl);
+    const path = (options.paths ?? configPaths())[1];
+    const credentials = options.credentials ?? systemCredentialStore;
+    const user = migrateLegacy(path, credentials);
+    storeVerified(credentials, origin, sessionId);
+    writeConfig(path, {
+        spaceId: user.spaceId,
+        credentialOrigins: [...new Set([...credentialOrigins(user), origin])],
+    });
+}
+export function deleteSession(cfg, options = {}) {
+    const endpoint = storedEnvironment(cfg.baseUrl);
+    if (!endpoint)
+        throw new Error('退出登录的目标环境无效');
+    const origin = apiOrigin(endpoint.baseUrl);
+    const path = (options.paths ?? configPaths())[1];
+    const credentials = options.credentials ?? systemCredentialStore;
+    const user = migrateLegacy(path, credentials);
+    credentials.delete(origin);
+    if (credentials.get(origin))
+        throw new Error('系统凭证库删除校验失败，请重试退出登录');
+    writeConfig(path, { spaceId: user.spaceId, credentialOrigins: credentialOrigins(user).filter(value => value !== origin) });
+}
 export function findConfigPath() {
     for (const path of configPaths()) {
         if (existsSync(path))

package/dist/credentials.js

@@ -0,0 +1,63 @@
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const KEYRING_ERROR = '无法访问系统凭证库。请解锁 macOS 钥匙串或 Windows 凭据管理器；Linux 请安装 libsecret 的 secret-tool 并启用、解锁 Secret Service。未回退到明文文件。';
+function protect(operation) {
+    try {
+        return operation();
+    }
+    catch {
+        // Native errors and child-process output may contain credentials.
+        throw new Error(KEYRING_ERROR);
+    }
+}
+export function createNativeCredentialStore(entry) {
+    return {
+        get: origin => protect(() => entry(origin).getPassword()),
+        set: (origin, sessionId) => protect(() => entry(origin).setPassword(sessionId)),
+        delete: origin => protect(() => { entry(origin).deleteCredential(); }),
+    };
+}
+export function createSecretServiceStore(service, run = spawnSync) {
+    function call(command, origin, secret) {
+        return protect(() => {
+            const result = run('/usr/bin/secret-tool', [
+                command,
+                ...(command === 'store' ? ['--label=QMuse CLI'] : []),
+                'service', service, 'account', origin,
+            ], {
+                encoding: 'utf8',
+                input: secret,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: 15_000,
+                maxBuffer: 64 * 1024,
+            });
+            if (result.error || result.signal)
+                throw new Error('Secret Service unavailable');
+            if (result.status === 0)
+                return result.stdout.replace(/\r?\n$/u, '');
+            // secret-tool uses exit 1 with no diagnostic for an absent item.
+            if (command !== 'store' && result.status === 1 && !result.stderr.trim())
+                return null;
+            throw new Error('Secret Service operation failed');
+        });
+    }
+    return {
+        get: origin => call('lookup', origin),
+        set: (origin, sessionId) => { call('store', origin, sessionId); },
+        delete: origin => { call('clear', origin); },
+    };
+}
+export function createSystemCredentialStore(service = 'cn.qmuse.cli') {
+    if (process.platform === 'linux')
+        return createSecretServiceStore(service);
+    return createNativeCredentialStore(origin => {
+        if (process.platform !== 'darwin' && process.platform !== 'win32') {
+            throw new Error('Unsupported credential store');
+        }
+        // Lazy loading keeps help and non-authenticated commands usable without a native binding.
+        const { Entry } = require('@napi-rs/keyring');
+        return new Entry(service, origin);
+    });
+}
+export const systemCredentialStore = createSystemCredentialStore();

package/dist/login.js

@@ -5,7 +5,7 @@ import { execFile } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import * as api from './api.js';
 import { buildUrl } from './client.js';
-import { apiOrigin, loadConfig, saveConfig } from './config.js';
+import { apiOrigin, loadConfig, saveSession } from './config.js';
 import { log } from './logger.js';
 const SESSION_EXCHANGE_POLL_INTERVAL_MS = 2_000;
 const SESSION_EXCHANGE_POLL_TIMEOUT_MS = 120_000;
@@ -61,17 +61,9 @@ export function persistSession(sessionId, targetConfig = loadConfig()) {
     const origin = apiOrigin(targetConfig.baseUrl);
     if (!origin)
         throw new Error('登录目标不是有效的 HTTP(S) 地址');
-    const config = {
-        ...loadConfig(),
-        baseUrl: targetConfig.baseUrl,
-        apiPrefix: targetConfig.apiPrefix,
-        webBaseUrl: targetConfig.webBaseUrl,
-        sessionId,
-        credentialOrigin: origin,
-    };
-    const path = saveConfig(config, true);
-    log.success(`登录态已保存到 ${path}`);
-    return path;
+    saveSession(sessionId, targetConfig);
+    log.success('登录态已保存到系统凭证库');
+    return origin;
 }
 export async function loginBrowser(cfg, options = {}, dependencyOverrides) {
     const dependencies = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qmuse/qmuse-cli",
-  "version": "1.0.1",
+  "version": "1.0.2-dev.0",
   "description": "将本地 React 项目安全导入 QMuse 的命令行客户端",
   "type": "module",
   "bin": {
@@ -18,6 +18,7 @@
     "publish:public": "bash scripts/publish-public.sh"
   },
   "dependencies": {
+    "@napi-rs/keyring": "2.0.0",
     "ignore": "^7.0.8",
     "yazl": "^3.3.1"
   },