@zltquant/zlt-mcp 0.7.1-beta.0 → 0.7.1

package/README.md

@@ -62,6 +62,8 @@ Agent 将返回的 widget.arguments 传给宿主 show_widget（不支持则展
 用户在网关页核对设备码并确认授权，CLI 保存凭据，只输出脱敏状态。
 普通终端使用 auth login 前台等待。auth status 查看本地配置；auth logout 只删除
 CLI 自己写入的默认凭据，不撤销共享 Key。已有凭据保持不变。
+独立 CLI 只从凭据文件获取认证，不使用继承的 ZLTQUANT_API_KEY 或 ZLTQUANT_API_BASE；
+ZLTQUANT_HOME 和 ZLTQUANT_CREDENTIALS 仍可指定凭据路径。原生 MCP 宿主注入不受此限制。
 首次使用的网关尚未支持设备登录时，请从 https://api.zltquant.com/login 获取 Key，并由用户自己创建
 `%USERPROFILE%\.zltquant\credentials.json`（只填 `apiKey`）。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zltquant/zlt-mcp",
-  "version": "0.7.1-beta.0",
+  "version": "0.7.1",
   "description": "智量通 ZLT Quant MCP server（Windows x64；量化策略创建与本地回测）",
   "bin": {
     "zlt-mcp": "./zlt-mcp-proxy.bundle.cjs"

package/zlt-mcp-proxy.bundle.cjs

@@ -22747,6 +22747,7 @@ function childEnvironment() {
   const forwarded = {};
   for (const [key, value] of Object.entries(process.env)) {
     if (value === void 0) continue;
+    if (/^ZLTQUANT_API_(KEY|BASE)$/i.test(key)) continue;
     if (/^ZLT(?:QUANT)?_/i.test(key) || key === "PYTHONUTF8") forwarded[key] = value;
   }
   return forwarded;
@@ -22759,9 +22760,8 @@ function createMcpClient(options = {}) {
   const transport = new StdioClientTransport({
     command: process.execPath,
     args: [entrypoint],
-    // The child is a short-lived CLI adapter.  Keep the API key available to
-    // the SDK through its normal environment lookup, but mark this process so
-    // mcp-server does not persist the one-shot override to credentials.json.
+    // The child is a short-lived CLI adapter using credential files. Do not
+    // forward inherited API keys or allow startup to persist environment keys.
     env: { ...childEnvironment(), ZLT_MCP_CLI: "1" },
     stderr: "pipe"
   });
@@ -28784,6 +28784,12 @@ var fs18 = __toESM(require("node:fs"), 1);
 var path17 = __toESM(require("node:path"), 1);
 var import_node_crypto4 = require("node:crypto");
 var SOURCE = "zlt-mcp-device-login";
+var IGNORED_API_ENV = /* @__PURE__ */ new Set(["ZLTQUANT_API_KEY", "ZLTQUANT_API_BASE"]);
+function authCliEnv(env) {
+  return Object.fromEntries(
+    Object.entries(env).filter(([key]) => !IGNORED_API_ENV.has(key.toUpperCase()))
+  );
+}
 var client = {
   start: () => startDeviceAuthorization(),
   poll: (s, o) => pollDeviceAuthorization(s, o),
@@ -28855,7 +28861,7 @@ function drop(id, e = process.env) {
   fs18.rmSync(sessionPath(id, e), { force: true });
 }
 function preflight(e) {
-  if (e.ZLTQUANT_CREDENTIALS || e.ZLTQUANT_API_KEY || readCredentials(e))
+  if (e.ZLTQUANT_CREDENTIALS || readCredentials(e))
     throw Error("Authentication is already configured");
 }
 async function finish(s, e, c, json) {
@@ -28878,7 +28884,7 @@ async function finish(s, e, c, json) {
   return o;
 }
 async function runAuthLogin(o = {}) {
-  const e = o.env || process.env;
+  const e = authCliEnv(o.env || process.env);
   preflight(e);
   const c = o.client || client, s = await c.start();
   if (o.widget) {
@@ -28905,7 +28911,7 @@ async function runAuthLogin(o = {}) {
   return finish(s, e, c, o.json);
 }
 async function runAuthWait(id, o = {}) {
-  const e = o.env || process.env;
+  const e = authCliEnv(o.env || process.env);
   preflight(e);
   const lockPath = sessionPath(id, e) + ".lock";
   let lock;
@@ -28927,13 +28933,14 @@ async function runAuthWait(id, o = {}) {
     fs18.rmSync(lockPath, { force: true });
   }
 }
-var authStatus = (e = process.env) => getAuthStatus(e);
+var authStatus = (e = process.env) => getAuthStatus(authCliEnv(e));
 function authLogout(e = process.env) {
-  if (e.ZLTQUANT_CREDENTIALS || e.ZLTQUANT_API_KEY)
-    return { removed: false, status: getAuthStatus(e) };
-  const c = readCredentials(e);
-  const removed = !!c && c.source === SOURCE && removeCredentials({ apiKey: c.apiKey, source: SOURCE }, e);
-  return { removed, status: getAuthStatus(e) };
+  const authEnv = authCliEnv(e);
+  if (authEnv.ZLTQUANT_CREDENTIALS)
+    return { removed: false, status: getAuthStatus(authEnv) };
+  const c = readCredentials(authEnv);
+  const removed = !!c && c.source === SOURCE && removeCredentials({ apiKey: c.apiKey, source: SOURCE }, authEnv);
+  return { removed, status: getAuthStatus(authEnv) };
 }
 
 // src/index.ts
@@ -28952,6 +28959,9 @@ function writeCliArgumentError(message, write2) {
 if (process.argv.length <= 2) {
   startMcpServer();
 } else {
+  for (const key of Object.keys(process.env)) {
+    if (/^ZLTQUANT_API_(KEY|BASE)$/i.test(key)) delete process.env[key];
+  }
   let evidence;
   let evidenceSetupError;
   try {