@yoonion/mimi-seed-mcp 0.3.39 → 0.3.40

package/dist/jenkins/credentials.d.ts

@@ -6,5 +6,9 @@ export interface JenkinsCredentialSummary {
 }
 export declare function listCredentials(cfg: JenkinsConfig): Promise<JenkinsCredentialSummary[]>;
 export declare function upsertSecretText(cfg: JenkinsConfig, id: string, secret: string, description?: string): Promise<'created' | 'updated'>;
+/**
+ * Secret File credential 생성/교체. Jenkins는 파일을 multipart 로 받고
+ * json 본문이 "file": "<필드명>" 으로 참조한다 (secretBytes JSON 직접 입력은 불가).
+ */
 export declare function upsertSecretFile(cfg: JenkinsConfig, id: string, fileBase64: string, fileName: string, description?: string): Promise<'created' | 'updated'>;
 export declare function deleteCredential(cfg: JenkinsConfig, id: string): Promise<void>;

package/dist/jenkins/credentials.js

@@ -1,17 +1,45 @@
+const FILE_CLASS = 'org.jenkinsci.plugins.plaincredentials.impl.FileCredentialsImpl';
+const TEXT_CLASS = 'org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl';
 function basicAuth(username, token) {
     return 'Basic ' + Buffer.from(`${username}:${token}`).toString('base64');
 }
-function credentialsBase(url) {
+// 도메인(_ = 전역) 레벨 — 목록 조회 / createCredentials 의 베이스
+function storeBase(url) {
     return `${url.replace(/\/$/, '')}/credentials/store/system/domain/_`;
 }
+// 개별 credential 레벨 — 반드시 /credential/<id> 세그먼트 필요 (조회/업데이트/삭제)
+function credentialBase(url, id) {
+    return `${storeBase(url)}/credential/${encodeURIComponent(id)}`;
+}
+/**
+ * CSRF crumb (best-effort). crumb issuer 비활성이거나 API 토큰으로 면제되면 빈 객체.
+ * 구버전 Jenkins / 비밀번호 인증 환경에서 POST 403 방지.
+ */
+async function getCrumb(cfg) {
+    try {
+        const res = await fetch(`${cfg.url.replace(/\/$/, '')}/crumbIssuer/api/json`, {
+            headers: { Authorization: basicAuth(cfg.username, cfg.token) },
+        });
+        if (!res.ok)
+            return {};
+        const data = (await res.json());
+        if (data.crumbRequestField && data.crumb) {
+            return { [data.crumbRequestField]: data.crumb };
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
 async function credentialExists(cfg, id) {
-    const res = await fetch(`${credentialsBase(cfg.url)}/${encodeURIComponent(id)}/api/json`, {
+    const res = await fetch(`${credentialBase(cfg.url, id)}/api/json`, {
         headers: { Authorization: basicAuth(cfg.username, cfg.token) },
     });
     return res.ok;
 }
 export async function listCredentials(cfg) {
-    const res = await fetch(`${credentialsBase(cfg.url)}/api/json?depth=1`, {
+    const res = await fetch(`${storeBase(cfg.url)}/api/json?depth=1`, {
         headers: { Authorization: basicAuth(cfg.username, cfg.token) },
     });
     if (!res.ok)
@@ -24,60 +52,67 @@ export async function listCredentials(cfg) {
     }));
 }
 export async function upsertSecretText(cfg, id, secret, description = '') {
-    const payload = JSON.stringify({
-        '': '0',
+    const exists = await credentialExists(cfg, id);
+    const payload = {
         credentials: {
             scope: 'GLOBAL',
             id,
             description,
             secret,
-            'stapler-class': 'org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl',
-            '$class': 'org.jenkinsci.plugins.plaincredentials.impl.StringCredentialsImpl',
+            $class: TEXT_CLASS,
+            'stapler-class': TEXT_CLASS,
         },
-    });
-    const base = credentialsBase(cfg.url);
-    const exists = await credentialExists(cfg, id);
+    };
     const endpoint = exists
-        ? `${base}/${encodeURIComponent(id)}/updateSubmit`
-        : `${base}/createCredentials`;
+        ? `${credentialBase(cfg.url, id)}/updateSubmit`
+        : `${storeBase(cfg.url)}/createCredentials`;
+    const crumb = await getCrumb(cfg);
     const res = await fetch(endpoint, {
         method: 'POST',
         headers: {
             Authorization: basicAuth(cfg.username, cfg.token),
             'Content-Type': 'application/x-www-form-urlencoded',
+            ...crumb,
         },
-        body: new URLSearchParams({ json: payload }).toString(),
+        body: new URLSearchParams({ json: JSON.stringify(payload) }).toString(),
     });
     if (!res.ok && res.status !== 302) {
         throw new Error(`Jenkins credential ${exists ? 'update' : 'create'} 실패 (${res.status})`);
     }
     return exists ? 'updated' : 'created';
 }
+/**
+ * Secret File credential 생성/교체. Jenkins는 파일을 multipart 로 받고
+ * json 본문이 "file": "<필드명>" 으로 참조한다 (secretBytes JSON 직접 입력은 불가).
+ */
 export async function upsertSecretFile(cfg, id, fileBase64, fileName, description = '') {
-    const payload = JSON.stringify({
-        '': '0',
+    const exists = await credentialExists(cfg, id);
+    const payload = {
         credentials: {
             scope: 'GLOBAL',
             id,
             description,
-            fileName,
-            secretBytes: fileBase64,
-            'stapler-class': 'org.jenkinsci.plugins.plaincredentials.impl.FileCredentialsImpl',
-            '$class': 'org.jenkinsci.plugins.plaincredentials.impl.FileCredentialsImpl',
+            file: 'file0',
+            $class: FILE_CLASS,
+            'stapler-class': FILE_CLASS,
         },
-    });
-    const base = credentialsBase(cfg.url);
-    const exists = await credentialExists(cfg, id);
+    };
+    const form = new FormData();
+    form.append('json', JSON.stringify(payload));
+    const bytes = Buffer.from(fileBase64, 'base64');
+    form.append('file0', new Blob([bytes]), fileName);
     const endpoint = exists
-        ? `${base}/${encodeURIComponent(id)}/updateSubmit`
-        : `${base}/createCredentials`;
+        ? `${credentialBase(cfg.url, id)}/updateSubmit`
+        : `${storeBase(cfg.url)}/createCredentials`;
+    const crumb = await getCrumb(cfg);
+    // Content-Type 은 fetch 가 multipart boundary 와 함께 자동 설정 — 수동 지정 금지
     const res = await fetch(endpoint, {
         method: 'POST',
         headers: {
             Authorization: basicAuth(cfg.username, cfg.token),
-            'Content-Type': 'application/x-www-form-urlencoded',
+            ...crumb,
         },
-        body: new URLSearchParams({ json: payload }).toString(),
+        body: form,
     });
     if (!res.ok && res.status !== 302) {
         throw new Error(`Jenkins secret file credential ${exists ? 'update' : 'create'} 실패 (${res.status})`);
@@ -85,9 +120,13 @@ export async function upsertSecretFile(cfg, id, fileBase64, fileName, descriptio
     return exists ? 'updated' : 'created';
 }
 export async function deleteCredential(cfg, id) {
-    const res = await fetch(`${credentialsBase(cfg.url)}/${encodeURIComponent(id)}/doDelete`, {
+    const crumb = await getCrumb(cfg);
+    const res = await fetch(`${credentialBase(cfg.url, id)}/doDelete`, {
         method: 'POST',
-        headers: { Authorization: basicAuth(cfg.username, cfg.token) },
+        headers: {
+            Authorization: basicAuth(cfg.username, cfg.token),
+            ...crumb,
+        },
     });
     if (!res.ok && res.status !== 302) {
         throw new Error(`Jenkins credential 삭제 실패 (${res.status})`);

package/dist/registers/android.js

@@ -152,6 +152,10 @@ export function registerAndroidTools(server) {
                     text: [
                         '✅ Android upload keystore 생성 완료',
                         '',
+                        '🔒 아래 비밀번호는 채팅 기록에 평문으로 남습니다.',
+                        '   Jenkins 등록을 마친 뒤에는 이 대화/세션을 삭제하는 것을 권장합니다.',
+                        '   keystore 파일과 비밀번호는 분실 시 앱 서명을 영구히 잃으니 별도 안전한 곳에도 백업하세요.',
+                        '',
                         '── 생성된 값 (지금 바로 Jenkins에 등록하세요) ────',
                         `keyAlias:      ${ks.keyAlias}`,
                         `storePassword: ${ks.storePassword}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yoonion/mimi-seed-mcp",
-  "version": "0.3.39",
+  "version": "0.3.40",
   "description": "Mimi Seed MCP server — Firebase + AdMob + Google Play + App Store management for Claude Code / Codex / Cursor / any MCP client.",
   "type": "module",
   "bin": {