rkb-cli 0.3.0-beta.1 → 0.3.0-beta.2

package/README.md

@@ -2,7 +2,7 @@
 
 Requires Node.js 20 or later. Run `rkb --help` for usage.
 
-Run `rkb login` to authorize the official Alibaba Cloud CLI OAuth application and obtain temporary STS credentials. Requires `aliyun >= 3.3.0`; no manual AK/SK is needed. Set `RKB_EXTERNAL_ALIYUN_CLI` only if the binary is not on PATH. Credentials are stored in `~/.rkb-external/aliyun/config.json` with owner-only file permissions. Use `--force` to authorize again. Run `rkb logout` to revoke the refresh token and remove this profile, or `logout --local` for local cleanup. POP APIs must enable AccessKey authentication and authorize the caller through RAM.
+Run `rkb login` to authorize the official Alibaba Cloud CLI OAuth application and obtain temporary STS credentials. RKB reuses an installed `aliyun >= 3.3.0`, or automatically downloads a pinned, SHA-256-verified official CLI on first login. Automatic installation supports macOS/Linux x64 and arm64, and Windows x64, and caches the executable under `~/.rkb-external/tools/aliyun/`. First use requires access to `https://aliyuncli.alicdn.com`. For offline installation, set `RKB_EXTERNAL_ALIYUN_CLI` to a trusted official executable. No manual AK/SK is needed. Credentials are stored in `~/.rkb-external/aliyun/config.json` with owner-only file permissions. Use `--force` to authorize again. Run `rkb logout` to revoke the refresh token and remove this profile, or `logout --local` for local cleanup. POP APIs must enable AccessKey authentication and authorize the caller through RAM.
 
 Configuration: `~/.rkb-external/config.yaml`; environment prefix: `RKB_EXTERNAL_ENV_`.
 

package/lib/adapters/aliyun/cli-binary.js

@@ -0,0 +1,199 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { chmod, lstat, mkdir, mkdtemp, open, readFile, rename, rm, writeFile, } from "node:fs/promises";
+import { join } from "node:path";
+import { extract } from "tar";
+import { unzipSync } from "fflate";
+import { getConfigDir } from "../../config/index.js";
+import { CapabilityError } from "../../core/result.js";
+export const managedCliVersion = "3.5.0";
+const downloadOrigin = "https://aliyuncli.alicdn.com";
+const maxArchiveBytes = 128 * 1024 * 1024;
+const maxBinaryBytes = 512 * 1024 * 1024;
+// Official release asset digests, pinned with the CLI version:
+// https://github.com/aliyun/aliyun-cli/releases/expanded_assets/v3.5.0
+const artifacts = {
+    "darwin-x64": [
+        "macosx-3.5.0-amd64.tgz",
+        "26fa8c289963c07146f475d7df80e4cebf23c02ff7cdbe4f22045fe5f902be34",
+    ],
+    "darwin-arm64": [
+        "macosx-3.5.0-arm64.tgz",
+        "6f1b0c380a456849adab800ee1396be58976020c6d9dfa3196dcfc41f496a518",
+    ],
+    "linux-x64": [
+        "linux-3.5.0-amd64.tgz",
+        "f97640bd11002f26e19c4f0b4725a3695e37b43499268837f35dd938cbe043aa",
+    ],
+    "linux-arm64": [
+        "linux-3.5.0-arm64.tgz",
+        "912250835e658894aa2ec04eed205292f18f7dc4a99b5ead00fa63d913769418",
+    ],
+    "win32-x64": [
+        "windows-3.5.0-amd64.zip",
+        "9b1c23a90a5f9cd1c5ff2ccd7e64945272e659e1f66496c507db494f4a271895",
+    ],
+};
+export function cliArtifact(platform, arch) {
+    const target = `${platform}-${arch}`;
+    const asset = artifacts[target];
+    if (!asset)
+        throw new CapabilityError("ALIYUN_CLI_UNSUPPORTED_PLATFORM", `Automatic Alibaba Cloud CLI installation is not supported on ${target}. Set RKB_EXTERNAL_ALIYUN_CLI to a compatible official CLI executable.`);
+    return {
+        target,
+        filename: `aliyun-cli-${asset[0]}`,
+        sha256: asset[1],
+        executable: platform === "win32" ? "aliyun.exe" : "aliyun",
+    };
+}
+export function supportsOAuth(version) {
+    const match = version?.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
+    return Boolean(match &&
+        (Number(match[1]) > 3 || (Number(match[1]) === 3 && Number(match[2]) >= 3)));
+}
+async function sha256(file) {
+    const hash = createHash("sha256");
+    for await (const chunk of createReadStream(file))
+        hash.update(chunk);
+    return hash.digest("hex");
+}
+async function cachedBinary(directory, asset) {
+    const binary = join(directory, asset.executable);
+    try {
+        if (!(await lstat(directory)).isDirectory() ||
+            !(await lstat(binary)).isFile())
+            return undefined;
+        const saved = JSON.parse(await readFile(join(directory, "checksum.json"), "utf8"));
+        if (saved.archive === asset.sha256 &&
+            saved.binary === (await sha256(binary)))
+            return binary;
+    }
+    catch {
+        // Incomplete or damaged caches are replaced with a verified download.
+    }
+    return undefined;
+}
+async function download(asset, destination, signal, request) {
+    const response = await request(`${downloadOrigin}/${asset.filename}`, {
+        redirect: "error",
+        signal: AbortSignal.any([signal, AbortSignal.timeout(120000)]),
+    });
+    if (!response.ok || !response.body)
+        throw new CapabilityError("ALIYUN_CLI_DOWNLOAD_FAILED", `Official CLI download failed (HTTP ${response.status}). Check access to aliyuncli.alicdn.com and retry rkb login.`);
+    const reader = response.body.getReader();
+    const file = await open(destination, "wx", 0o600);
+    const hash = createHash("sha256");
+    let bytes = 0;
+    try {
+        while (true) {
+            signal.throwIfAborted();
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            bytes += chunk.value.byteLength;
+            if (bytes > maxArchiveBytes)
+                throw new Error("Archive too large");
+            hash.update(chunk.value);
+            await file.writeFile(chunk.value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        await file.close();
+    }
+    if (hash.digest("hex") !== asset.sha256)
+        throw new CapabilityError("ALIYUN_CLI_CHECKSUM_MISMATCH", "The downloaded Alibaba Cloud CLI failed SHA-256 verification. Retry rkb login or set RKB_EXTERNAL_ALIYUN_CLI to a trusted official executable.");
+}
+export async function installManagedCli(asset, cacheRoot, options, request = fetch) {
+    const { signal } = options;
+    signal.throwIfAborted();
+    const parent = join(cacheRoot, managedCliVersion);
+    const destination = join(parent, asset.target);
+    const cached = await cachedBinary(destination, asset);
+    signal.throwIfAborted();
+    if (cached)
+        return cached;
+    let temporary;
+    try {
+        await mkdir(parent, { recursive: true, mode: 0o700 });
+        await rm(destination, { recursive: true, force: true });
+        temporary = await mkdtemp(join(parent, `.${asset.target}-`));
+        const archive = join(temporary, "download");
+        const binary = join(temporary, asset.executable);
+        options.onProgress?.(`Downloading Alibaba Cloud CLI ${managedCliVersion} for ${asset.target} (first use only)...`);
+        await download(asset, archive, signal, request);
+        signal.throwIfAborted();
+        if (asset.filename.endsWith(".zip")) {
+            const files = unzipSync(await readFile(archive), {
+                filter: (entry) => entry.name === asset.executable &&
+                    entry.originalSize > 0 &&
+                    entry.originalSize <= maxBinaryBytes,
+            });
+            if (!files[asset.executable])
+                throw new Error("Missing executable");
+            await writeFile(binary, files[asset.executable], {
+                flag: "wx",
+                mode: 0o700,
+            });
+        }
+        else {
+            await extract({
+                file: archive,
+                cwd: temporary,
+                strict: true,
+                filter: (path, entry) => (path === asset.executable || path === `./${asset.executable}`) &&
+                    "type" in entry &&
+                    entry.type === "File" &&
+                    entry.size > 0 &&
+                    entry.size <= maxBinaryBytes,
+            });
+        }
+        if (!(await lstat(binary)).isFile())
+            throw new Error("Invalid executable");
+        await chmod(binary, 0o700);
+        await writeFile(join(temporary, "checksum.json"), JSON.stringify({ archive: asset.sha256, binary: await sha256(binary) }), { flag: "wx", mode: 0o600 });
+        await rm(archive);
+        signal.throwIfAborted();
+        try {
+            await rename(temporary, destination);
+        }
+        catch (error) {
+            // A simultaneous login may have completed the same atomic installation.
+            if (!(await cachedBinary(destination, asset)))
+                throw error;
+        }
+        return join(destination, asset.executable);
+    }
+    catch (error) {
+        signal.throwIfAborted();
+        if (error instanceof CapabilityError)
+            throw error;
+        throw new CapabilityError("ALIYUN_CLI_INSTALL_FAILED", "Could not download or install the official Alibaba Cloud CLI. Check the network and external cache permissions, then retry rkb login. For offline use, set RKB_EXTERNAL_ALIYUN_CLI to a trusted executable.");
+    }
+    finally {
+        if (temporary)
+            await rm(temporary, { recursive: true, force: true });
+    }
+}
+function readVersion(executable, signal, env) {
+    return new Promise((resolve, reject) => {
+        execFile(executable, ["version"], { env, signal, timeout: 5000, maxBuffer: 65536, windowsHide: true }, (error, stdout) => {
+            if (signal.aborted)
+                reject(signal.reason);
+            else
+                resolve(error ? undefined : stdout.trim());
+        });
+    });
+}
+export async function resolveAliyunCli(options, probe = readVersion, install = installManagedCli) {
+    const { signal, env = process.env } = options;
+    signal.throwIfAborted();
+    const explicit = env.RKB_EXTERNAL_ALIYUN_CLI;
+    const version = await probe(explicit || "aliyun", signal, env);
+    if (supportsOAuth(version))
+        return explicit || "aliyun";
+    if (explicit)
+        throw new CapabilityError(version ? "ALIYUN_CLI_VERSION" : "ALIYUN_CLI_NOT_FOUND", "RKB_EXTERNAL_ALIYUN_CLI must point to a runnable official Alibaba Cloud CLI 3.3.0 or later.");
+    return install(cliArtifact(options.platform ?? process.platform, options.arch ?? process.arch), options.cacheRoot ?? join(getConfigDir(), "tools", "aliyun"), options);
+}

package/lib/adapters/aliyun/official-cli.js

@@ -6,6 +6,7 @@ import OpenApiClient, { Config, Params, OpenApiRequest, } from "@alicloud/openap
 import { RuntimeOptions } from "@alicloud/tea-util";
 import { getConfigDir } from "../../config/index.js";
 import { CapabilityError } from "../../core/result.js";
+import { resolveAliyunCli, supportsOAuth } from "./cli-binary.js";
 const profileName = "rkb-external";
 const oauthEndpoint = "https://oauth.aliyun.com/v1";
 // Used only to refresh tokens issued by the official CLI's own login flow.
@@ -32,67 +33,71 @@ export function officialCliEnvironment(source) {
     return Object.fromEntries(Object.entries(source).filter(([key]) => !/^(ALIBABA_CLOUD|ALIBABACLOUD|ALICLOUD)_(ACCESS_KEY|SECURITY_TOKEN|PROFILE|REGION|ENDPOINT|STS_|BEARER_|OIDC_|ROLE_|CREDENTIALS_URI|EXTERNAL_)/.test(key) &&
         !/^(ACCESS_KEY_ID|ACCESS_KEY_SECRET|SECURITY_TOKEN|REGION_ID|REGION)$/.test(key)));
 }
-export const runOfficialCli = (args, options) => new Promise((resolve, reject) => {
-    options.signal.throwIfAborted();
-    const child = spawn(process.env.RKB_EXTERNAL_ALIYUN_CLI || "aliyun", args, {
-        shell: false,
-        env: officialCliEnvironment(process.env),
-        stdio: ["pipe", "pipe", "pipe"],
-        signal: options.signal,
-        killSignal: "SIGKILL",
-    });
-    let stdout = "", stderr = "", pending = "";
-    const seen = new Set();
-    const authorizationLines = (chunk, final = false) => {
-        pending += chunk;
-        const lines = pending.split(/\r?\n/);
-        pending = final ? "" : lines.pop() || "";
-        for (const line of lines) {
-            const url = line.match(/https:\/\/signin\.aliyun\.com\/oauth2\/v1\/auth\?[^\s]+/)?.[0];
-            if (url && !seen.has(url)) {
-                seen.add(url);
-                options.onAuthorization?.(url);
+export const runOfficialCli = async (args, options) => {
+    const env = officialCliEnvironment(process.env);
+    const executable = await resolveAliyunCli({ ...options, env });
+    return new Promise((resolve, reject) => {
+        options.signal.throwIfAborted();
+        const child = spawn(executable, args, {
+            shell: false,
+            env,
+            stdio: ["pipe", "pipe", "pipe"],
+            signal: options.signal,
+            killSignal: "SIGKILL",
+        });
+        let stdout = "", stderr = "", pending = "";
+        const seen = new Set();
+        const authorizationLines = (chunk, final = false) => {
+            pending += chunk;
+            const lines = pending.split(/\r?\n/);
+            pending = final ? "" : lines.pop() || "";
+            for (const line of lines) {
+                const url = line.match(/https:\/\/signin\.aliyun\.com\/oauth2\/v1\/auth\?[^\s]+/)?.[0];
+                if (url && !seen.has(url)) {
+                    seen.add(url);
+                    options.onAuthorization?.(url);
+                }
             }
-        }
-    };
-    child.stdout.on("data", (chunk) => {
-        stdout += chunk.toString();
-        authorizationLines(chunk.toString());
-        if (stdout.length > 1024 * 1024)
-            child.kill("SIGKILL");
-    });
-    child.stderr.on("data", (chunk) => {
-        stderr += chunk.toString();
-        if (stderr.length > 1024 * 1024)
-            child.kill("SIGKILL");
-    });
-    child.stdin.on("error", () => {
-        /* process errors are handled below */
-    });
-    // Region and language already have defaults in the isolated profile.
-    child.stdin.end("\n\n");
-    child.on("error", (error) => reject(options.signal.aborted
-        ? options.signal.reason
-        : new CapabilityError(error.code === "ENOENT"
-            ? "ALIYUN_CLI_NOT_FOUND"
-            : "ALIYUN_CLI_FAILED", error.code === "ENOENT"
-            ? "Install the official Alibaba Cloud CLI (aliyun >= 3.3.0), then run rkb login again."
-            : "The official Alibaba Cloud CLI could not run.")));
-    child.on("close", (code) => {
-        authorizationLines("", true);
-        if (options.signal.aborted) {
-            reject(options.signal.reason);
-            return;
-        }
-        if (code !== 0) {
-            // CLI stderr may contain tokens and signed URLs; never relay it verbatim.
-            const requestId = stderr.match(/request[_ ]?id["\s:=]+([A-Fa-f0-9-]{16,64})/i)?.[1];
-            reject(new CapabilityError("ALIYUN_CLI_FAILED", `Official Alibaba Cloud login failed${requestId ? `; RequestId: ${requestId}` : ""}. Check official-cli application authorization and try rkb login --force.`, requestId));
-            return;
-        }
-        resolve(stdout);
+        };
+        child.stdout.on("data", (chunk) => {
+            stdout += chunk.toString();
+            authorizationLines(chunk.toString());
+            if (stdout.length > 1024 * 1024)
+                child.kill("SIGKILL");
+        });
+        child.stderr.on("data", (chunk) => {
+            stderr += chunk.toString();
+            if (stderr.length > 1024 * 1024)
+                child.kill("SIGKILL");
+        });
+        child.stdin.on("error", () => {
+            /* process errors are handled below */
+        });
+        // Region and language already have defaults in the isolated profile.
+        child.stdin.end("\n\n");
+        child.on("error", (error) => reject(options.signal.aborted
+            ? options.signal.reason
+            : new CapabilityError(error.code === "ENOENT"
+                ? "ALIYUN_CLI_NOT_FOUND"
+                : "ALIYUN_CLI_FAILED", error.code === "ENOENT"
+                ? "The selected Alibaba Cloud CLI is unavailable. Retry rkb login or check RKB_EXTERNAL_ALIYUN_CLI."
+                : "The official Alibaba Cloud CLI could not run.")));
+        child.on("close", (code) => {
+            authorizationLines("", true);
+            if (options.signal.aborted) {
+                reject(options.signal.reason);
+                return;
+            }
+            if (code !== 0) {
+                // CLI stderr may contain tokens and signed URLs; never relay it verbatim.
+                const requestId = stderr.match(/request[_ ]?id["\s:=]+([A-Fa-f0-9-]{16,64})/i)?.[1];
+                reject(new CapabilityError("ALIYUN_CLI_FAILED", `Official Alibaba Cloud login failed${requestId ? `; RequestId: ${requestId}` : ""}. Check official-cli application authorization and try rkb login --force.`, requestId));
+                return;
+            }
+            resolve(stdout);
+        });
     });
-});
+};
 async function callerIdentity(credentials) {
     const client = new Client(new Config({ endpoint: "sts.aliyuncs.com", ...credentials }));
     const response = await client.callApi(new Params({
@@ -250,11 +255,8 @@ export class OfficialCliSession {
         const saved = await this.load();
         const reused = !options.force && Boolean(saved?.profile.oauth_access_token);
         if (!reused) {
-            const version = await this.run(["version"], { signal: options.signal });
-            const match = version.trim().match(/^(\d+)\.(\d+)\.(\d+)$/);
-            if (!match ||
-                Number(match[1]) < 3 ||
-                (Number(match[1]) === 3 && Number(match[2]) < 3))
+            const version = await this.run(["version"], options);
+            if (!supportsOAuth(version))
                 throw new CapabilityError("ALIYUN_CLI_VERSION", "Official Alibaba Cloud CLI 3.3.0 or later is required.");
             if (!saved)
                 await this.save({

package/lib/features/auth/aliyun/command.js

@@ -5,7 +5,7 @@ import { createAliyunLoginService } from "./factory.js";
 export default class AliyunLogin extends Command {
     static summary = "Sign in with your Alibaba Cloud identity";
     static description = `Use the official Alibaba Cloud CLI OAuth login (PKCE) and obtain temporary STS credentials.
-Requires aliyun CLI 3.3.0 or later. No manual AccessKey configuration is needed.
+Uses an installed aliyun CLI 3.3.0 or later, or automatically downloads a verified official CLI on first login. No manual AccessKey configuration is needed.
 The official-cli application must be authorized for your account. Credentials are stored in ~/.rkb-external/aliyun/config.json (owner access only).
 External POP commands use AccessKey signatures and Alibaba Cloud RAM permissions.`;
     static examples = [
@@ -39,6 +39,7 @@ External POP commands use AccessKey signatures and Alibaba Cloud RAM permissions
             const result = await createAliyunLoginService().login({
                 force: flags.force,
                 signal: controller.signal,
+                onProgress: (message) => this.logToStderr(message),
                 onAuthorization: (url) => {
                     this.logToStderr("Complete Alibaba Cloud sign-in on this computer. If needed, open this URL manually:");
                     // Deliberately bypass file logging; never persist authorization URLs or codes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rkb-cli",
-  "version": "0.3.0-beta.1",
+  "version": "0.3.0-beta.2",
   "description": "RaaS Knowledge Buddy command-line interface",
   "type": "module",
   "bin": {
@@ -20,7 +20,9 @@
     "@alicloud/tea-util": "^1.4.11",
     "@oclif/core": "^4.3.0",
     "chalk": "^4.1.2",
+    "fflate": "0.8.3",
     "open": "^11.0.0",
+    "tar": "^7.5.10",
     "yaml": "^2.9.0"
   },
   "oclif": {