@remixmate/cli 0.9.13 → 0.9.14

package/skills/template-registry/scripts/registry_loader.py

@@ -19,7 +19,8 @@
        兼容 ab-agent 注入的 MM_BACKEND_API_URL。默认值内置在 CLI 自身，独立安装
        （codex / npm i -g）开箱即用，无需宿主在 spawn 时注入。
 
-  鉴权：PRIV_TOKEN（env）或 ~/.config/remixmate/credentials.json（同源条目）。
+  鉴权：只读 PRIV_TOKEN 环境变量。凭证库 / 钥匙串 / 设备授权流由 CLI 的 Node 侧
+  唯一鉴权入口负责（src/auth/ensure.ts），并在 spawn 时注入本进程环境。
 
   monorepo / 显式本地文件等其它来源已**移除**。需要离线 / pinned 数据的维护脚本
   （check_contracts.py / sync_registry.py）直接走 template_paths 读 monorepo，
@@ -47,7 +48,6 @@ import urllib.error
 import urllib.request
 from functools import lru_cache
 from typing import Optional
-from urllib.parse import urlparse
 
 __all__ = [
     "load_registry_data",
@@ -55,8 +55,29 @@ __all__ = [
     "get_template",
     "list_templates",
     "invalidate_cache",
+    "RegistryAuthError",
+    "RegistryUnreachableError",
+    "EXIT_NOT_AUTHENTICATED",
+    "EXIT_BACKEND_UNREACHABLE",
 ]
 
+# 与 Node 侧 src/errors.ts 的 EXIT 常量保持一致：宿主据此判断「该引导用户授权」
+# 还是「后端故障，等一会儿再试」，而不是把两者都当成一次普通失败。
+EXIT_NOT_AUTHENTICATED = 4
+EXIT_BACKEND_UNREACHABLE = 5
+
+
+class RegistryAuthError(RuntimeError):
+    """凭证缺失 / 失效 / 被吊销 —— 与「后端不可达」区分开的独立失败模式。
+
+    这两种情况以前被压成同一段「请确认 ab-api 可达…并已设置有效 PRIV_TOKEN」的
+    文案，用户无从判断该去登录还是该等后端恢复。
+    """
+
+
+class RegistryUnreachableError(RuntimeError):
+    """网络不通 / 超时 / 5xx —— 用户无需重新登录，重试或修配置即可。"""
+
 # 默认缓存 TTL（秒）。HTTP 拉取后该时间内不再重新请求。
 _DEFAULT_TTL_SECONDS = 300
 
@@ -127,58 +148,20 @@ def _write_cached(cache_file: str, payload: dict) -> None:
         raise
 
 
-# ── PrivToken 解析（env → 凭证库回退）──────────────────────────────────────
+# ── PrivToken 解析 ────────────────────────────────────────────────────────
 #
-# 与 CLI 的 resolve.ts 共享同一优先级与同一凭证文件路径（Req 7.5）。Python 侧只读
-# 文件存储（不读 keychain —— keychain 由 CLI 写/读，Python 用纯 stdlib 不引依赖）。
-
-def _credentials_file_path() -> str:
-    """凭证文件路径，与 CLI credential-store.ts 的 CRED_FILE 保持一致。"""
-    return os.path.join(os.path.expanduser("~"), ".config", "remixmate", "credentials.json")
-
-
-def _origin(url: str) -> tuple:
-    p = urlparse(url)
-    return (p.scheme, p.hostname, p.port)
-
+# 只读 PRIV_TOKEN 环境变量 —— 凭证库 / 系统钥匙串 / 设备授权流全部由 Node 侧的
+# 唯一鉴权入口（src/auth/ensure.ts）负责，并在 spawn 时把解析结果注入本进程的
+# 环境变量（src/runner.ts）。
+#
+# 这里曾经自己读 ~/.config/remixmate/credentials.json，带来两个问题：一是与 Node
+# 侧的解析逻辑各写一份、只有本 skill 享受得到；二是「只有一条凭证就直接用」的兜底
+# 会把某个后端（如本地开发环境）的 token 发往另一个后端（如生产），属于跨源泄露。
 
-def _priv_token_from_credential_store(url: str) -> str:
-    """从 ~/.config/remixmate/credentials.json 取与 url 同源的 PrivToken。
 
-    匹配顺序：① 与 registry URL 同源（scheme/host/port）的条目；② 仅有单条目时直接用。
-    secret=='keychain' 的条目跳过（Python 无法读取 keychain）。任何异常静默返回空串。
-    """
-    try:
-        with open(_credentials_file_path(), encoding="utf-8") as f:
-            doc = json.load(f)
-    except (OSError, json.JSONDecodeError):
-        return ""
-    creds = doc.get("credentials") if isinstance(doc, dict) else None
-    if not isinstance(creds, dict) or not creds:
-        return ""
-
-    target = _origin(url)
-    for base_url, entry in creds.items():
-        if not isinstance(entry, dict) or entry.get("secret") == "keychain":
-            continue
-        if _origin(base_url) == target:
-            tok = str(entry.get("privToken") or "").strip()
-            if tok:
-                return tok
-    # 单条目兜底：CLI 通常只登录一个后端。
-    if len(creds) == 1:
-        entry = next(iter(creds.values()))
-        if isinstance(entry, dict) and entry.get("secret") != "keychain":
-            return str(entry.get("privToken") or "").strip()
-    return ""
-
-
-def _resolve_priv_token(url: str) -> str:
-    """PrivToken 解析：环境变量优先，空则回退凭证库（与 CLI 一致的优先级）。"""
-    env = os.environ.get("PRIV_TOKEN", "").strip()
-    if env:
-        return env
-    return _priv_token_from_credential_store(url)
+def _resolve_priv_token(_url: str) -> str:
+    """PrivToken 解析：只认由 CLI 注入 / 宿主设置的 PRIV_TOKEN 环境变量。"""
+    return os.environ.get("PRIV_TOKEN", "").strip()
 
 
 def _fetch_http(url: str, timeout: int) -> dict:
@@ -214,9 +197,13 @@ def _fetch_http(url: str, timeout: int) -> dict:
 
             # ab-api 风格：{code, msg, data} → 取 data；其他场景视作直接 registry
             if isinstance(parsed, dict) and "data" in parsed and "code" in parsed:
-                if parsed.get("code") not in (0, "0"):
+                code = parsed.get("code")
+                if str(code) in ("401", "403"):
+                    # ab-api 用 HTTP 200 + code=401 表达鉴权失败，所以这里也要判。
+                    raise RegistryAuthError(str(parsed.get("msg") or f"code={code}"))
+                if code not in (0, "0"):
                     raise RuntimeError(
-                        f"registry HTTP 业务失败: code={parsed.get('code')} msg={parsed.get('msg')}"
+                        f"registry HTTP 业务失败: code={code} msg={parsed.get('msg')}"
                     )
                 data = parsed["data"]
             else:
@@ -233,6 +220,8 @@ def _fetch_http(url: str, timeout: int) -> dict:
             cached["fetchedAt"] = time.time()
             _write_cached(cache_file, cached)
             return cached["data"]
+        if e.code in (401, 403):
+            raise RegistryAuthError(f"HTTP {e.code}") from e
         raise
 
 
@@ -249,6 +238,13 @@ def _load_from_url(url: str, ttl: int, timeout: int) -> dict:
 
     try:
         return _fetch_http(url, timeout)
+    except RegistryAuthError as exc:
+        # 鉴权失败不降级到缓存：缓存可能属于另一个账号，静默返回它会把「凭证已失效」
+        # 掩盖成一份看似正常、实则不属于当前用户的模板列表。
+        raise RegistryAuthError(
+            f"凭证无效或已过期（{exc}）。运行 remixmate login 重新授权，"
+            f"或设置有效的 PRIV_TOKEN。当前后端：{url}"
+        ) from exc
     except Exception as exc:
         # HTTP 故障时降级：有磁盘缓存就继续用（同一数据源的容错，不是第二个源）
         if cached:
@@ -257,10 +253,9 @@ def _load_from_url(url: str, ttl: int, timeout: int) -> dict:
                 file=sys.stderr,
             )
             return cached["data"]
-        raise RuntimeError(
-            f"registry HTTP 拉取失败且无可用缓存: {url} ({exc})。"
-            f" 请确认 ab-api 可达、VIDEO_TEMPLATE_REGISTRY_URL / MM_API_BASE_URL"
-            f" 配置正确，并已设置有效 PRIV_TOKEN。"
+        raise RegistryUnreachableError(
+            f"registry 后端不可达且无可用缓存: {url} ({exc})。"
+            f" 请确认 ab-api 可达、VIDEO_TEMPLATE_REGISTRY_URL / MM_API_BASE_URL 配置正确。"
         ) from exc
 
 
@@ -275,16 +270,21 @@ def load_registry_data(
     未设置则按 ``MM_API_BASE_URL`` 推导（见 ``_default_registry_url``）。
     带磁盘缓存（TTL + ETag/304），返回 ``data.get("templates", [])`` 形状的 dict。
     """
+    # 这两行是实现细节（endpoint 从哪来），对终端用户没有意义，却出现在每一次
+    # 成功调用的 stderr 上。默认收起，排障时用 REMIXMATE_DEBUG=1 打开。
+    debug = os.environ.get("REMIXMATE_DEBUG", "").strip() == "1"
     url = os.environ.get("VIDEO_TEMPLATE_REGISTRY_URL", "").strip()
     if url:
-        print(f"[registry_loader] using HTTP registry: {url}", file=sys.stderr)
+        if debug:
+            print(f"[registry_loader] using HTTP registry: {url}", file=sys.stderr)
     else:
         url = _default_registry_url()
-        print(
-            f"[registry_loader] VIDEO_TEMPLATE_REGISTRY_URL unset; using derived"
-            f" default URL: {url}",
-            file=sys.stderr,
-        )
+        if debug:
+            print(
+                f"[registry_loader] VIDEO_TEMPLATE_REGISTRY_URL unset; using derived"
+                f" default URL: {url}",
+                file=sys.stderr,
+            )
     return _load_from_url(url, ttl=ttl_seconds, timeout=http_timeout)
 
 

package/skills/template-registry/skill.json

@@ -5,6 +5,7 @@
   "category": "authoring",
   "title": "Video Template Registry",
   "description": "List all available video templates (templateId / name / aspect ratio / style tags). Template-to-DSL binding is no longer exposed as a separate step — once prepare_video_assets receives a template_id it runs the full DSL→RenderPlan pipeline internally.",
+  "auth": "required",
   "envVars": ["PRIV_TOKEN", "VIDEO_TEMPLATE_REGISTRY_URL", "MM_API_BASE_URL", "VIDEO_TEMPLATE_REGISTRY_HTTP_METHOD"],
   "entry": { "type": "python", "scriptPath": "scripts/list_templates.py" },
   "parameters": {

package/skills/video-parser/skill.json

@@ -5,6 +5,7 @@
   "category": "consuming",
   "title": "Video Deconstruction",
   "description": "Video deconstruction: split a video into reusable assets (audio extraction, ASR transcript, keyframe extraction, scene segmentation).",
+  "auth": "required",
   "envVars": ["RENDER_API_URL", "PRIV_TOKEN", "CONVERSATION_ID"],
   "scriptPath": "scripts/parse_via_render.py",
   "parameters": {

package/skills/web-record/skill.json

@@ -5,6 +5,7 @@
   "category": "consuming",
   "title": "Web Page Recording",
   "description": "Drive a headless browser (Playwright Python) to RECORD any URL to a video, then (by default) transcode to mp4, grab a cover frame, upload to VOD and return a playable CDN URL. Modes: fixed-duration recording, condition-triggered stop (element appears / disappears), auto-scroll from top to bottom, custom storyboards, and parameterized templates. Storyboard scenes: highlight / focus / zoom / scroll / virtual-cursor click / type / hover / caption / title-card / arrow / numbered sequence / redact / code-line highlight. For still images (png/jpg) use the web_screenshot tool instead. Use this tool whenever the user wants a video / recording / screencast of a web page: record a page, scroll-through video, page-from-top-to-bottom clip, demo of clicks/typing/hover, storyboard / multi-scene intro video, or a template-based clip.",
+  "auth": "optional",
   "envVars": ["WEB_CAPTURE_BROWSER", "WEB_CAPTURE_OUTPUT_BASE", "WEB_CAPTURE_NO_SANDBOX", "WEB_CAPTURE_ALLOW_PRIVATE_HOSTS", "PLAYWRIGHT_BROWSERS_PATH", "REMOTION_RENDER_API_URL", "PRIV_TOKEN"],
   "entry": { "type": "python", "scriptPath": "../web-screenshot/scripts/record.py" },
   "parameters": {

package/skills/web-screenshot/skill.json

@@ -5,6 +5,7 @@
   "category": "consuming",
   "title": "Web Page Screenshot",
   "description": "Drive a headless browser (Playwright Python) to capture any URL to a local STILL IMAGE (png/jpg): full-page / viewport / element / region screenshots, with device emulation, waiting, hide/mask/redact, and static annotations (highlight / arrow / caption / numbered sequence / redact). Images only — for video / recording / scroll-through / storyboard clips (webm) use the web_record tool instead.",
+  "auth": "none",
   "envVars": ["WEB_CAPTURE_BROWSER", "WEB_CAPTURE_OUTPUT_BASE", "WEB_CAPTURE_NO_SANDBOX", "WEB_CAPTURE_ALLOW_PRIVATE_HOSTS", "PLAYWRIGHT_BROWSERS_PATH"],
   "entry": { "type": "python", "scriptPath": "scripts/screenshot.py" },
   "parameters": {