alink-cli 0.7.1 → 0.7.3

package/README.md

@@ -6,20 +6,17 @@
 npx alink-cli
 ```
 
-首次运行会在本机生成 E2EE 密钥并打印二维码；在 `https://link.harmopath.com` 登录 GitHub 后扫码或粘贴即可。凭证保存到 `~/.agentlink/credential`（`0600`），之后重复同一命令即可上线。
+首次运行输入 AgentLink 账号和密码，这台电脑会自动加入账号并上线。之后直接重复 `npx alink-cli` 即可上线；密码不会保存到本机。
 
 ```bash
 npx alink-cli --hub wss://your-hub.example.com
 npx alink-cli --dir /path/to/project
-npx alink-cli --pair
-npx alink-cli qr
-npx alink-cli credential status
+npx alink-cli logout
 ```
 
 - `--hub`：Hub 地址，默认 `wss://link.harmopath.com`。
 - `--dir`：默认工作目录，缺省为当前目录。
-- `--pair`：忽略已保存凭证并重新配对。
-- `--token`：导入完整机器凭证。
+- `logout`：退出当前账号并清除本机登录记录，下次运行重新输入账号密码。
 - `--legacy`：临时运行旧 daemon；默认始终是 daemon-t3。
 
 Node.js 22.16+。连接为出站 WebSocket，无需端口转发；Hub 只转发 E2EE 密文。

package/bin/agentlink-account.js

@@ -0,0 +1,133 @@
+import { randomBytes } from "node:crypto";
+
+const MACHINE_BUCKET = "agentlink-machines";
+const REQUEST_TIMEOUT_MS = 10_000;
+
+function httpUrl(hub, pathname) {
+  const url = new URL(pathname, hub);
+  if (url.protocol === "ws:") url.protocol = "http:";
+  if (url.protocol === "wss:") url.protocol = "https:";
+  return url;
+}
+
+async function json(response) {
+  return response.json().catch(() => ({}));
+}
+
+export async function loadAgentLinkAccountConfig(hub, fetchFn = fetch) {
+  const response = await fetchFn(httpUrl(hub, "/api/config"), {
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+  });
+  if (!response.ok) throw new Error(`Hub 配置读取失败 (${response.status})。`);
+  return json(response);
+}
+
+function machineIdFromToken(authToken) {
+  try {
+    const payload = JSON.parse(
+      Buffer.from(authToken.split(".")[1] || "", "base64url").toString("utf8"),
+    );
+    return typeof payload.mid === "string" ? payload.mid : "";
+  } catch {
+    return "";
+  }
+}
+
+async function readMachines(bucket, path) {
+  const { data, error } = await bucket.download(path);
+  if (error) {
+    if (/not found|no such|404/i.test(error.message || "")) return [];
+    throw new Error(`读取账号机器列表失败：${error.message}`);
+  }
+  try {
+    const parsed = JSON.parse(await data.text());
+    return Array.isArray(parsed.machines) ? parsed.machines : [];
+  } catch {
+    throw new Error("账号机器列表格式损坏，请在 Web 端移除异常记录后重试。");
+  }
+}
+
+export async function registerAgentLinkAccountMachine({
+  hub,
+  config,
+  identifier,
+  password,
+  machineName,
+  fetchFn = fetch,
+  cloudbaseSdk,
+  randomBytesFn = randomBytes,
+}) {
+  if (!config?.cloudbaseEnvId) throw new Error("当前 Hub 尚未配置账号机器目录。");
+
+  const loginResponse = await fetchFn(httpUrl(hub, "/auth/password/login"), {
+    method: "POST",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    headers: { "Content-Type": "application/json", "X-Requested-With": "agentlink" },
+    body: JSON.stringify({ identifier, password, client: "cli" }),
+  });
+  const login = await json(loginResponse);
+  if (!loginResponse.ok || typeof login.jwt !== "string" || !login.jwt) {
+    throw new Error(
+      login.error === "invalid_account_credentials"
+        ? "账号或密码错误。"
+        : login.error || "账号登录失败。",
+    );
+  }
+
+  const mintResponse = await fetchFn(httpUrl(hub, "/api/machines/mint"), {
+    method: "POST",
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+    headers: {
+      Authorization: `Bearer ${login.jwt}`,
+      "Content-Type": "application/json",
+      "X-Requested-With": "agentlink",
+    },
+    body: JSON.stringify({ name: machineName }),
+  });
+  const minted = await json(mintResponse);
+  const authToken = typeof minted.authToken === "string" ? minted.authToken : "";
+  const machineId =
+    typeof minted.machineId === "string" ? minted.machineId : machineIdFromToken(authToken);
+  if (!mintResponse.ok || !authToken.startsWith("al1.") || !machineId) {
+    throw new Error(minted.error || "机器注册失败。");
+  }
+
+  const sdk = cloudbaseSdk ?? (await import("@cloudbase/js-sdk")).default;
+  const app = sdk.init({ env: config.cloudbaseEnvId, region: "ap-shanghai" });
+  const auth = app.auth();
+  const signedIn = await auth.signInWithPassword(
+    identifier.includes("@") ? { email: identifier, password } : { username: identifier, password },
+  );
+  if (signedIn?.error) throw new Error(signedIn.error.message || "CloudBase 账号登录失败。");
+
+  try {
+    const user = await auth.getCurrentUser();
+    if (!user?.uid) throw new Error("CloudBase 账号登录状态无效。");
+    const path = `${user.uid}/machines.json`;
+    const bucket = app.storage.from(MACHINE_BUCKET);
+    const machines = await readMachines(bucket, path);
+    const current = machines.find((machine) => machine?.machineId === machineId);
+    const enckey = randomBytesFn(32).toString("base64url");
+    const machine = {
+      machineId,
+      name: machineName,
+      hostname: machineName,
+      createdAt: current?.createdAt ?? Date.now(),
+      enckey,
+    };
+    // ponytail: read-modify-write is enough for normal first-time setup; add
+    // versioned retries if concurrent registrations for one account become common.
+    const { error } = await bucket.update(
+      path,
+      JSON.stringify({
+        version: 2,
+        machines: [machine, ...machines.filter((entry) => entry?.machineId !== machineId)],
+      }),
+      { contentType: "application/json" },
+    );
+    if (error) throw new Error(`保存账号机器列表失败：${error.message}`);
+    return { credential: `${authToken}.${enckey}`, machineId };
+  } finally {
+    await auth.signOut().catch(() => undefined);
+  }
+}

package/bin/agentlink.js

@@ -4,9 +4,15 @@ import { randomBytes } from "node:crypto";
 import { chmodSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { hostname, homedir } from "node:os";
 import { join } from "node:path";
+import { createInterface } from "node:readline/promises";
 import { fileURLToPath } from "node:url";
 import WebSocket from "ws";
 
+import {
+  loadAgentLinkAccountConfig,
+  registerAgentLinkAccountMachine,
+} from "./agentlink-account.js";
+
 const OFFICIAL_HUB = process.env.AGENTLINK_DEFAULT_HUB || "wss://link.harmopath.com";
 const STATE_DIR = process.env.AGENTLINK_STATE_DIR || join(homedir(), ".agentlink");
 const CREDENTIAL_FILE = join(STATE_DIR, "credential");
@@ -65,15 +71,6 @@ function parseCredential(credential) {
   return { machineToken: parts.slice(0, 3).join("."), enckey: parts[3] };
 }
 
-async function hubMode(hub) {
-  const url = new URL("/api/config", hub);
-  if (url.protocol === "ws:") url.protocol = "http:";
-  if (url.protocol === "wss:") url.protocol = "https:";
-  const response = await fetch(url);
-  if (!response.ok) throw new Error(`Hub 配置读取失败 (${response.status})。`);
-  return (await response.json()).mode;
-}
-
 async function createSingleCredential(hub) {
   const token = randomBytes(24).toString("base64url");
   const enckey = randomBytes(32).toString("base64url");
@@ -90,6 +87,75 @@ async function createSingleCredential(hub) {
   return credential;
 }
 
+async function readPassword(label) {
+  if (!process.stdin.isTTY || typeof process.stdin.setRawMode !== "function") {
+    throw new Error(
+      "当前终端无法安全读取密码，请在交互式终端运行，或设置 AGENTLINK_ACCOUNT 和 AGENTLINK_PASSWORD。",
+    );
+  }
+  process.stdout.write(label);
+  return new Promise((resolve, reject) => {
+    let password = "";
+    const wasRaw = process.stdin.isRaw;
+    const finish = () => {
+      process.stdin.off("data", onData);
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+      process.stdout.write("\n");
+    };
+    const onData = (chunk) => {
+      for (const char of String(chunk)) {
+        if (char === "\u0003") {
+          finish();
+          reject(new Error("已取消登录。"));
+          return;
+        }
+        if (char === "\r" || char === "\n") {
+          finish();
+          resolve(password);
+          return;
+        }
+        if (char === "\u007f" || char === "\b") password = password.slice(0, -1);
+        else if (char >= " ") password += char;
+      }
+    };
+    process.stdin.setRawMode(true);
+    process.stdin.setEncoding("utf8");
+    process.stdin.resume();
+    process.stdin.on("data", onData);
+  });
+}
+
+async function accountCredentials() {
+  const fromEnv = process.env.AGENTLINK_ACCOUNT?.trim();
+  const passwordFromEnv = process.env.AGENTLINK_PASSWORD;
+  if (fromEnv && passwordFromEnv) return { identifier: fromEnv, password: passwordFromEnv };
+  if (!process.stdin.isTTY) {
+    throw new Error("首次运行需要登录账号，请在交互式终端运行。");
+  }
+  const readline = createInterface({ input: process.stdin, output: process.stdout });
+  const identifier = (await readline.question("AgentLink 账号：")).trim();
+  readline.close();
+  const password = await readPassword("AgentLink 密码：");
+  if (!identifier || !password) throw new Error("账号和密码不能为空。");
+  return { identifier, password };
+}
+
+async function loginAndCreateCredential(hub, config) {
+  console.log("[agentlink] 首次使用，请登录 AgentLink 账号。");
+  const { identifier, password } = await accountCredentials();
+  const result = await registerAgentLinkAccountMachine({
+    hub,
+    config,
+    identifier,
+    password,
+    machineName: hostname(),
+  });
+  saveCredential(result.credential, hub);
+  console.log("[agentlink] 登录成功，这台电脑已加入账号。");
+  return result.credential;
+}
+
 async function printQr(text) {
   const { renderQr } = await import(new URL("../dist/qr.js", import.meta.url));
   renderQr(text);
@@ -130,7 +196,9 @@ async function pair(hub) {
         socket.close();
         const credential = `${message.token}.${enckey}`;
         saveCredential(credential, hub);
-        console.log(`[agentlink] 配对成功，凭证已保存到 ${CREDENTIAL_FILE}（0600）。`);
+        console.log(
+          `[agentlink] 配对成功。alp1 配对串只能使用这一次；已转换为本机凭证并保存到 ${CREDENTIAL_FILE}（0600）。`,
+        );
         resolve(credential);
       }
     });
@@ -140,11 +208,17 @@ async function pair(hub) {
 
 if (args.includes("--help") || args.includes("-h")) {
   console.log(
-    `用法: npx alink-cli [--hub <wss://…>] [--dir <目录>] [--pair]\n\n首次运行会显示配对二维码；之后直接复用 ~/.agentlink/credential。\n--legacy 运行旧 daemon；credential status|path|show|set|clear 管理凭证。`,
+    `用法: npx alink-cli [--hub <wss://…>] [--dir <目录>]\n      npx alink-cli logout\n\n首次运行输入 AgentLink 账号密码，这台电脑会自动加入账号；以后直接运行即可上线。\nlogout 退出当前账号；--legacy 临时运行旧 daemon。`,
   );
   process.exit(0);
 }
 
+if (args[0] === "logout") {
+  rmSync(CREDENTIAL_FILE, { force: true });
+  console.log("[agentlink] 已退出账号；下次启动时需要重新登录。");
+  process.exit(0);
+}
+
 if (args[0] === "credential") {
   const hub = value("hub") || OFFICIAL_HUB;
   const command = args[1] || "status";
@@ -171,11 +245,20 @@ if (args.includes("--legacy")) {
 } else {
   const hub = value("hub") || OFFICIAL_HUB;
   const explicit = value("token") || process.env.AGENTLINK_TOKEN;
+  const config =
+    explicit || savedCredential(hub) || args.includes("--pair")
+      ? null
+      : await loadAgentLinkAccountConfig(hub);
   const credential =
     explicit ||
     (!args.includes("--pair") && savedCredential(hub)) ||
-    ((await hubMode(hub)) === "multi" ? await pair(hub) : await createSingleCredential(hub));
+    (config?.mode === "multi"
+      ? await loginAndCreateCredential(hub, config)
+      : await createSingleCredential(hub));
   if (explicit && explicit !== savedCredential(hub)) saveCredential(explicit, hub);
+  if (!explicit && savedCredential(hub) && !args.includes("--pair")) {
+    console.log("[agentlink] 已登录，正在让这台电脑上线。");
+  }
   const { machineToken, enckey } = parseCredential(credential);
   const daemon = fileURLToPath(new URL("../dist/bin.mjs", import.meta.url));
   const cwd = value("dir") || process.cwd();

package/dist/bin.mjs

@@ -2871,7 +2871,7 @@ const RelayServerGroup = HttpApiGroup.make("server").add(HttpApiEndpoint.post("p
 	success: RelayPublishResponse,
 	error: RelayAgentActivityPublishErrors
 }).annotate(OpenApi.Summary, "Publish agent activity")).annotate(OpenApi.Description, "Environment-authenticated activity publication.").middleware(RelayEnvironmentAuth);
-HttpApi.make("RelayApi").add(RelayHealthGroup, RelayMetadataGroup, RelayMobileGroup, RelayClientGroup, RelayTokenGroup, RelayDpopClientGroup, RelayServerGroup).annotate(OpenApi.Title, "T3 Code Relay API").annotate(OpenApi.Version, "1.0.0").annotate(OpenApi.Description, "Control-plane API for linking T3 environments, connecting authorized clients, and publishing agent activity.");
+HttpApi.make("RelayApi").add(RelayHealthGroup, RelayMetadataGroup, RelayMobileGroup, RelayClientGroup, RelayTokenGroup, RelayDpopClientGroup, RelayServerGroup).annotate(OpenApi.Title, "AgentLink Relay API").annotate(OpenApi.Version, "1.0.0").annotate(OpenApi.Description, "Control-plane API for linking T3 environments, connecting authorized clients, and publishing agent activity.");
 //#endregion
 //#region ../t3-contracts/src/environmentHttp.ts
 const OptionalBearerHeaders = Schema$1.Struct({
@@ -7445,20 +7445,20 @@ const trimmedNonEmpty = (annotations, maxLength) => {
 	return encoded.pipe(Schema$1.decodeTo(encoded, SchemaTransformation.trim()));
 };
 const T3ProjectFileScript = Schema$1.Struct({
-	name: trimmedNonEmpty({ description: "Display name for the script, shown in the T3 Code scripts menu." }),
-	command: trimmedNonEmpty({ description: "Shell command executed in a T3 Code terminal at the project root." }),
+	name: trimmedNonEmpty({ description: "Display name for the script, shown in the AgentLink scripts menu." }),
+	command: trimmedNonEmpty({ description: "Shell command executed in an AgentLink terminal at the project root." }),
 	icon: Schema$1.optionalKey(ProjectScriptIcon.annotate({ description: "Icon shown next to the script in the scripts menu. Defaults to \"play\"." })),
 	runOnWorktreeCreate: Schema$1.optionalKey(Schema$1.Boolean.annotate({ description: "When true, the script runs automatically after a worktree is created for a new thread." })),
 	previewUrl: Schema$1.optionalKey(trimmedNonEmpty({ description: "URL opened in the in-app browser preview when this script runs. Only honored on the desktop build." })),
 	autoOpenPreview: Schema$1.optionalKey(Schema$1.Boolean.annotate({ description: "When true, automatically open the preview panel at `previewUrl` the moment the script starts." }))
-}).annotate({ description: "A project script that team members can import into T3 Code." });
+}).annotate({ description: "A project script that team members can import into AgentLink." });
 const T3ProjectFile = Schema$1.Struct({
 	$schema: Schema$1.optionalKey(Schema$1.String.annotate({ description: `URL of the JSON Schema for this file, typically "${T3_PROJECT_FILE_SCHEMA_URL}".` })),
-	iconPath: Schema$1.optionalKey(trimmedNonEmpty({ description: "Workspace-relative path to the project icon (e.g. \"assets/logo.svg\"). Checked before T3 Code's built-in icon locations." }, T3_PROJECT_FILE_PATH_MAX_LENGTH)),
-	scripts: Schema$1.optionalKey(Schema$1.Array(T3ProjectFileScript).annotate({ description: "Project scripts shared with everyone who opens this repository in T3 Code." }).check(Schema$1.isMaxLength(T3_PROJECT_FILE_MAX_SCRIPTS)))
+	iconPath: Schema$1.optionalKey(trimmedNonEmpty({ description: "Workspace-relative path to the project icon (e.g. \"assets/logo.svg\"). Checked before AgentLink's built-in icon locations." }, T3_PROJECT_FILE_PATH_MAX_LENGTH)),
+	scripts: Schema$1.optionalKey(Schema$1.Array(T3ProjectFileScript).annotate({ description: "Project scripts shared with everyone who opens this repository in AgentLink." }).check(Schema$1.isMaxLength(T3_PROJECT_FILE_MAX_SCRIPTS)))
 }).annotate({
 	title: "T3 project file",
-	description: "Checked-in project configuration for T3 Code (t3.json at the repository root). See https://t3.codes for documentation."
+	description: "Checked-in project configuration for AgentLink (t3.json at the repository root)."
 });
 //#endregion
 //#region ../t3-contracts/src/project.ts
@@ -17921,15 +17921,7 @@ const renderTerminalQrCode = (value, margin = 2) => {
 	}
 	return rows.join("\n");
 };
-const formatHeadlessServeOutput = (accessInfo) => [
-	"T3 Code server is ready.",
-	`Connection string: ${accessInfo.connectionString}`,
-	`Token: ${accessInfo.token}`,
-	`Pairing URL: ${accessInfo.pairingUrl}`,
-	"",
-	renderTerminalQrCode(accessInfo.pairingUrl),
-	""
-].join("\n");
+const formatHeadlessServeOutput = (_accessInfo) => "AgentLink server is ready.\n";
 const issueHeadlessServeAccessInfo = Effect.fn("issueHeadlessServeAccessInfo")(function* () {
 	const serverConfig = yield* ServerConfig;
 	const httpServer = yield* HttpServer.HttpServer;
@@ -68642,7 +68634,7 @@ const runServerCommand = (flags, options) => Effect.gen(function* () {
 	return yield* runServer.pipe(Effect.provideService(ServerConfig, config));
 });
 const startCommand = Command.make("start", { ...sharedServerCommandFlags }).pipe(Command.withDescription("Run the T3 Code server."), Command.withHandler((flags) => runServerCommand(flags)));
-const serveCommand = Command.make("serve", { ...sharedServerCommandFlags }).pipe(Command.withDescription("Run the T3 Code server without opening a browser and print headless pairing details."), Command.withHandler((flags) => runServerCommand(flags, {
+const serveCommand = Command.make("serve", { ...sharedServerCommandFlags }).pipe(Command.withDescription("Run the T3 Code server without opening a browser."), Command.withHandler((flags) => runServerCommand(flags, {
 	startupPresentation: "headless",
 	forceAutoBootstrapProjectFromCwd: false
 })));