natureco-cli 5.51.1 → 5.51.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +10 -0
  2. package/package.json +97 -97
  3. package/src/commands/account.js +11 -5
  4. package/src/utils/natureco-account.js +40 -1
package/CHANGELOG.md CHANGED
@@ -2,6 +2,16 @@
2
2
 
3
3
  All notable changes to NatureCo CLI will be documented in this file.
4
4
 
5
+ ## [5.51.3] - 2026-07-11 — "account: implicit magic link (fragment access_token)"
6
+
7
+ ### Fixed
8
+ - **Giriş linki fragment'inde `access_token`+`refresh_token` doğrudan geldiğinde de çalışır** (Supabase implicit-flow / SiteURL redirect). Link `#access_token=...&refresh_token=...` biçimindeyse /verify gerekmez — CLI tokenları doğrudan kaydeder, kullanıcıyı JWT'den çözer. (5.51.2 yalnız token_hash biçimini işliyordu.)
9
+
10
+ ## [5.51.2] - 2026-07-11 — "account: giriş linki (magic link) desteği"
11
+
12
+ ### Fixed
13
+ - **`natureco account login` OTP akışı, e-posta 6 haneli kod yerine GİRİŞ LİNKİ (magic link) gönderdiğinde de çalışır.** Supabase e-posta şablonu `{{ .Token }}` yerine link gönderiyorsa, gelen linki yapıştırmak yeterli — CLI linkteki `token_hash`+`type`'ı çıkarıp `/verify` ile oturum açar (`verifyLink`). Kod da link de kabul edilir.
14
+
5
15
  ## [5.51.1] - 2026-07-10 — "SECURITY: edit_file onay atlaması + kendi-kaynağını-düzenleme kısıtı"
6
16
 
7
17
  ### Security
package/package.json CHANGED
@@ -1,97 +1,97 @@
1
- {
2
- "name": "natureco-cli",
3
- "version": "5.51.1",
4
- "description": "OpenClaw'dan daha güvenli, daha hızlı, daha ucuz AI agent CLI. Multi-agent, self-evolving skills, audit log, maliyet optimizasyonu ve NatureCo platform-native.",
5
- "bin": {
6
- "natureco": "bin/natureco.js"
7
- },
8
- "files": [
9
- "bin/",
10
- "src/",
11
- "scripts/",
12
- "skills/",
13
- "README.md",
14
- "SELF.md",
15
- "CHANGELOG.md",
16
- "AUDIT.md",
17
- "SECURITY_AUDIT_SUMMARY.md",
18
- "DEPLOY_v2.0.0.md"
19
- ],
20
- "scripts": {
21
- "test": "vitest run",
22
- "test:unit": "vitest run",
23
- "test:watch": "vitest",
24
- "test:coverage": "vitest run --coverage",
25
- "lint": "eslint src/ bin/ test/",
26
- "lint:fix": "eslint src/ bin/ test/ --fix",
27
- "lint:errors-only": "eslint src/ bin/ test/ --quiet",
28
- "smoke": "node --check bin/natureco.js && node bin/natureco.js help",
29
- "postinstall": "node scripts/postinstall.js",
30
- "prepublishOnly": "node --check bin/natureco.js && eslint src/ bin/ test/ --quiet && vitest run"
31
- },
32
- "keywords": [
33
- "natureco",
34
- "ai",
35
- "ai-agent",
36
- "bot",
37
- "cli",
38
- "terminal",
39
- "openclaw-alternative",
40
- "claude-code-alternative",
41
- "multi-agent",
42
- "self-evolving-skills",
43
- "audit-log",
44
- "cost-optimization",
45
- "seo",
46
- "türkçe",
47
- "turkish",
48
- "whatsapp-bot",
49
- "telegram-bot",
50
- "discord-bot",
51
- "natureco-me"
52
- ],
53
- "author": {
54
- "name": "Gencay Olgun",
55
- "email": "hello@natureco.me",
56
- "url": "https://natureco.me"
57
- },
58
- "homepage": "https://natureco.me/cli",
59
- "repository": {
60
- "type": "git",
61
- "url": "git+https://github.com/natureco-official/natureco-cli.git"
62
- },
63
- "bugs": {
64
- "url": "https://github.com/natureco-official/natureco-cli/issues"
65
- },
66
- "license": "MIT",
67
- "engines": {
68
- "node": ">=18.0.0"
69
- },
70
- "dependencies": {
71
- "@anthropic-ai/sdk": "^0.105.0",
72
- "@inquirer/prompts": "^8.5.2",
73
- "@slack/web-api": "^7.17.0",
74
- "@whiskeysockets/baileys": "^7.0.0-rc10",
75
- "chalk": "^4.1.2",
76
- "commander": "^11.1.0",
77
- "discord.js": "^14.26.4",
78
- "irc": "^0.5.2",
79
- "mattermost": "^3.4.0",
80
- "node-cron": "^4.2.1",
81
- "node-telegram-bot-api": "^0.67.0",
82
- "openai": "^6.45.0",
83
- "pino": "^8.21.0",
84
- "qrcode": "^1.5.4",
85
- "qrcode-terminal": "^0.12.0",
86
- "semver": "^7.8.1",
87
- "twilio": "^6.0.2",
88
- "ws": "^8.20.0"
89
- },
90
- "devDependencies": {
91
- "@eslint/js": "^10.0.1",
92
- "@vitest/coverage-v8": "^4.1.9",
93
- "eslint": "^10.6.0",
94
- "globals": "^15.15.0",
95
- "vitest": "^4.1.9"
96
- }
97
- }
1
+ {
2
+ "name": "natureco-cli",
3
+ "version": "5.51.3",
4
+ "description": "OpenClaw'dan daha güvenli, daha hızlı, daha ucuz AI agent CLI. Multi-agent, self-evolving skills, audit log, maliyet optimizasyonu ve NatureCo platform-native.",
5
+ "bin": {
6
+ "natureco": "bin/natureco.js"
7
+ },
8
+ "files": [
9
+ "bin/",
10
+ "src/",
11
+ "scripts/",
12
+ "skills/",
13
+ "README.md",
14
+ "SELF.md",
15
+ "CHANGELOG.md",
16
+ "AUDIT.md",
17
+ "SECURITY_AUDIT_SUMMARY.md",
18
+ "DEPLOY_v2.0.0.md"
19
+ ],
20
+ "scripts": {
21
+ "test": "vitest run",
22
+ "test:unit": "vitest run",
23
+ "test:watch": "vitest",
24
+ "test:coverage": "vitest run --coverage",
25
+ "lint": "eslint src/ bin/ test/",
26
+ "lint:fix": "eslint src/ bin/ test/ --fix",
27
+ "lint:errors-only": "eslint src/ bin/ test/ --quiet",
28
+ "smoke": "node --check bin/natureco.js && node bin/natureco.js help",
29
+ "postinstall": "node scripts/postinstall.js",
30
+ "prepublishOnly": "node --check bin/natureco.js && eslint src/ bin/ test/ --quiet && vitest run"
31
+ },
32
+ "keywords": [
33
+ "natureco",
34
+ "ai",
35
+ "ai-agent",
36
+ "bot",
37
+ "cli",
38
+ "terminal",
39
+ "openclaw-alternative",
40
+ "claude-code-alternative",
41
+ "multi-agent",
42
+ "self-evolving-skills",
43
+ "audit-log",
44
+ "cost-optimization",
45
+ "seo",
46
+ "türkçe",
47
+ "turkish",
48
+ "whatsapp-bot",
49
+ "telegram-bot",
50
+ "discord-bot",
51
+ "natureco-me"
52
+ ],
53
+ "author": {
54
+ "name": "Gencay Olgun",
55
+ "email": "hello@natureco.me",
56
+ "url": "https://natureco.me"
57
+ },
58
+ "homepage": "https://natureco.me/cli",
59
+ "repository": {
60
+ "type": "git",
61
+ "url": "git+https://github.com/natureco-official/natureco-cli.git"
62
+ },
63
+ "bugs": {
64
+ "url": "https://github.com/natureco-official/natureco-cli/issues"
65
+ },
66
+ "license": "MIT",
67
+ "engines": {
68
+ "node": ">=18.0.0"
69
+ },
70
+ "dependencies": {
71
+ "@anthropic-ai/sdk": "^0.105.0",
72
+ "@inquirer/prompts": "^8.5.2",
73
+ "@slack/web-api": "^7.17.0",
74
+ "@whiskeysockets/baileys": "^7.0.0-rc10",
75
+ "chalk": "^4.1.2",
76
+ "commander": "^11.1.0",
77
+ "discord.js": "^14.26.4",
78
+ "irc": "^0.5.2",
79
+ "mattermost": "^3.4.0",
80
+ "node-cron": "^4.2.1",
81
+ "node-telegram-bot-api": "^0.67.0",
82
+ "openai": "^6.45.0",
83
+ "pino": "^8.21.0",
84
+ "qrcode": "^1.5.4",
85
+ "qrcode-terminal": "^0.12.0",
86
+ "semver": "^7.8.1",
87
+ "twilio": "^6.0.2",
88
+ "ws": "^8.20.0"
89
+ },
90
+ "devDependencies": {
91
+ "@eslint/js": "^10.0.1",
92
+ "@vitest/coverage-v8": "^4.1.9",
93
+ "eslint": "^10.6.0",
94
+ "globals": "^15.15.0",
95
+ "vitest": "^4.1.9"
96
+ }
97
+ }
package/src/commands/account.js CHANGED
@@ -47,15 +47,21 @@ async function doLogin() {
47
47
  console.log(chalk.gray('\n Doğrulanıyor...'));
48
48
  await acc.loginWithPassword(email.trim(), password);
49
49
  } else {
50
- console.log(chalk.gray('\n Kod gönderiliyor...'));
50
+ console.log(chalk.gray('\n Gönderiliyor...'));
51
51
  await acc.sendOtp(email.trim());
52
- console.log(chalk.gray(' ') + chalk.cyan(email.trim()) + chalk.gray(' adresine 6 haneli kod gönderildi.'));
52
+ console.log(chalk.gray(' ') + chalk.cyan(email.trim()) + chalk.gray(' adresine e-posta gönderildi.'));
53
+ console.log(chalk.gray(' 6 haneli kod geldiyse kodu, giriş linki geldiyse linki yapıştır.'));
53
54
  const { token } = await inquirer.prompt([{
54
- type: 'input', name: 'token', message: ' Koddan gelen 6 hane:',
55
- validate: (v) => ((v || '').trim().length >= 6 ? true : 'Kodu gir'),
55
+ type: 'input', name: 'token', message: ' Kod veya giriş linki:',
56
+ validate: (v) => ((v || '').trim().length >= 6 ? true : 'Kodu ya da linki gir'),
56
57
  }]);
57
58
  console.log(chalk.gray('\n Doğrulanıyor...'));
58
- await acc.verifyOtp(email.trim(), token.trim());
59
+ const val = token.trim();
60
+ if (/^https?:\/\//i.test(val) || val.includes('token')) {
61
+ await acc.verifyLink(val);
62
+ } else {
63
+ await acc.verifyOtp(email.trim(), val);
64
+ }
59
65
  }
60
66
  } catch (err) {
61
67
  console.log(chalk.red(`\n ❌ ${err.message || 'Giriş başarısız'}\n`));
package/src/utils/natureco-account.js CHANGED
@@ -75,6 +75,45 @@ async function verifyOtp(email, token) {
75
75
  return saveSession(_shape(await _post('/verify', { type: 'email', email, token })));
76
76
  }
77
77
 
78
+ // JWT access_token içinden kullanıcıyı çöz (imza doğrulaması yok — sadece görüntüleme)
79
+ function _userFromJwt(token) {
80
+ try {
81
+ const p = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString('utf8'));
82
+ return { id: p.sub, email: p.email };
83
+ } catch (_) { return null; }
84
+ }
85
+
86
+ /**
87
+ * E-postadan gelen GİRİŞ LİNKİ'ni işle (şablon 6 haneli kod yerine magic link
88
+ * gönderdiğinde). İki biçim:
89
+ * 1) Implicit: link fragment'inde ZATEN access_token+refresh_token var → doğrudan oturum.
90
+ * 2) token_hash: /verify ile doğrula.
91
+ */
92
+ async function verifyLink(link) {
93
+ let u;
94
+ try { u = new URL(link.trim()); }
95
+ catch (e) { throw new Error('Geçersiz link', { cause: e }); }
96
+ const q = u.searchParams;
97
+ const frag = new URLSearchParams((u.hash || '').replace(/^#/, ''));
98
+ const pick = (k) => frag.get(k) || q.get(k);
99
+
100
+ const access_token = pick('access_token');
101
+ if (access_token) {
102
+ return saveSession(_shape({
103
+ access_token,
104
+ refresh_token: pick('refresh_token'),
105
+ token_type: pick('token_type') || 'bearer',
106
+ expires_at: parseInt(pick('expires_at') || '0', 10) || null,
107
+ expires_in: parseInt(pick('expires_in') || '0', 10) || null,
108
+ user: _userFromJwt(access_token),
109
+ }));
110
+ }
111
+ const token_hash = pick('token_hash') || pick('token');
112
+ const type = pick('type') || 'magiclink';
113
+ if (!token_hash) throw new Error("Linkte doğrulama token'ı bulunamadı");
114
+ return saveSession(_shape(await _post('/verify', { type, token_hash })));
115
+ }
116
+
78
117
  /** Access token yenile */
79
118
  async function refresh() {
80
119
  const s = loadSession();
@@ -114,7 +153,7 @@ function currentEmail() {
114
153
  function logout() { clearSession(); }
115
154
 
116
155
  module.exports = {
117
- loginWithPassword, sendOtp, verifyOtp, refresh,
156
+ loginWithPassword, sendOtp, verifyOtp, verifyLink, refresh,
118
157
  getAccessToken, whoami, isLoggedIn, currentEmail, logout,
119
158
  SUPABASE_URL,
120
159
  };