tyc-cli 0.3.5 → 0.3.7

package/dist/commands/login.js

@@ -1,8 +1,7 @@
-import { DEFAULT_MCP_URL, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
+import { DEFAULT_MCP_URL, applyOAuthTokenToConfig, defaultCoreURL, loadConfig, resolveConfig, saveConfig, } from "../config.js";
 import { verifyCoreAuthEndpoint } from "../coreClient.js";
-import { clearSession } from "../session.js";
-import { ensureSession } from "../mcpClient.js";
-import { buildAuthorizationURL, createPKCE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, knownOAuthDefaultsForMcpURL, openBrowser, randomState, registerDynamicOAuthClient, startCallbackServer, } from "../oauth.js";
+import { buildAuthorizationURL, buildCliCallbackRedirectUri, createPKCE, discoverAuthorizationServer, discoverProtectedResourceMetadata, exchangeAuthorizationCode, knownOAuthDefaultsForMcpURL, openBrowser, parseAuthorizationCallbackCode, randomState, registerDynamicOAuthClient, startCallbackServer, } from "../oauth.js";
+import { clearPendingOAuthLogin, loadPendingOAuthLogin, savePendingOAuthLogin, } from "../oauthPending.js";
 import { printLoginSuccessBanner } from "../logo.js";
 function parsePort(raw) {
     if (!raw)
@@ -13,10 +12,61 @@ function parsePort(raw) {
     }
     return n;
 }
-function normalizeTokenType(raw) {
-    if (!raw)
-        return "Bearer";
-    return raw.toLowerCase() === "bearer" ? "Bearer" : raw;
+function normalizeCallbackPath(raw) {
+    const path = raw || "/oauth/callback";
+    return path.startsWith("/") ? path : `/${path}`;
+}
+function pickCallbackToken(opts) {
+    if (opts.callbackToken && opts.token) {
+        throw new Error("--callback-token 和 --token 只能指定一个。");
+    }
+    return opts.callbackToken || opts.token;
+}
+function saveOAuthTokenConfig(mcpURL, token, oauth, verbose) {
+    const cfg = loadConfig() || {};
+    cfg.url = mcpURL;
+    delete cfg.transport;
+    cfg.coreUrl = defaultCoreURL(mcpURL);
+    applyOAuthTokenToConfig(cfg, token, oauth);
+    saveConfig(cfg);
+    if (verbose) {
+        console.error(`> OAuth login state saved to ~/.tyc/config.json (url=${cfg.url})`);
+    }
+}
+async function verifySavedOAuthLogin(verify, verbose) {
+    if (!verify) {
+        printLoginSuccessBanner();
+        return;
+    }
+    const resolved = resolveConfig();
+    await verifyCoreAuthEndpoint(resolved, verbose);
+    if (verbose) {
+        console.error("> Shared Core auth check passed");
+    }
+    printLoginSuccessBanner();
+}
+async function completePendingOAuthLogin(pending, callbackToken, verify, verbose) {
+    const code = parseAuthorizationCallbackCode(callbackToken, pending.state);
+    if (verbose) {
+        console.error("> authorization code provided; exchanging access token");
+    }
+    const token = await exchangeAuthorizationCode({
+        tokenEndpoint: pending.tokenEndpoint,
+        clientId: pending.clientId,
+        clientSecret: pending.clientSecret,
+        code,
+        redirectUri: pending.redirectUri,
+        codeVerifier: pending.codeVerifier,
+        resource: pending.resource,
+    });
+    saveOAuthTokenConfig(pending.mcpURL, token, {
+        tokenEndpoint: pending.tokenEndpoint,
+        clientId: pending.clientId,
+        clientSecret: pending.clientSecret,
+        resource: pending.resource,
+    }, verbose);
+    clearPendingOAuthLogin(verbose);
+    await verifySavedOAuthLogin(verify, verbose);
 }
 export function registerLoginCommand(program) {
     program
@@ -34,9 +84,29 @@ export function registerLoginCommand(program) {
         .option("--redirect-host <host>", "本地回调 host（默认 localhost）")
         .option("--redirect-port <port>", "本地回调端口（默认 7078）")
         .option("--callback-path <path>", "本地回调路径（默认 /oauth/callback）")
+        .option("--callback-token <code-or-url>", "继续非阻塞登录：传入授权回调 code 或包含 code 的完整 callback URL")
+        .option("--token <code-or-url>", "同 --callback-token（兼容别名；仍需传授权回调 code）")
         .option("--no-open", "不自动打开浏览器，只打印授权 URL")
-        .option("--no-verify", "保存 token 后跳过 initialize 连通性校验")
+        .option("--no-block", "配合 --no-open：打印授权 URL 并保存 pending 状态后立即退出")
+        .option("--no-verify", "保存 token 后跳过 shared core 鉴权校验")
         .action(async (opts) => {
+        const verbose = !!program.opts().verbose;
+        const callbackToken = pickCallbackToken(opts);
+        if (callbackToken) {
+            const pending = loadPendingOAuthLogin();
+            if (!pending) {
+                throw new Error("未找到待完成的 OAuth 登录状态。请先运行 tyc login --no-open --no-block。");
+            }
+            if (verbose) {
+                console.error(`> loaded pending OAuth login from ~/.tyc/oauth_pending.json (url=${pending.mcpURL})`);
+            }
+            await completePendingOAuthLogin(pending, callbackToken, opts.verify !== false && pending.verify !== false, verbose);
+            return;
+        }
+        const noBlock = opts.block === false;
+        if (noBlock && opts.open !== false) {
+            throw new Error("--no-block 需要与 --no-open 一起使用。");
+        }
         const current = loadConfig() || {};
         const mcpURL = opts.url || process.env.TYC_MCP_ENDPOINT || current.url || DEFAULT_MCP_URL;
         const knownDefaults = knownOAuthDefaultsForMcpURL(mcpURL);
@@ -45,8 +115,7 @@ export function registerLoginCommand(program) {
         const scope = opts.scope || "mcp:tools.call";
         const redirectHost = opts.redirectHost || "localhost";
         const redirectPort = parsePort(opts.redirectPort || "7078");
-        const callbackPath = opts.callbackPath || "/oauth/callback";
-        const verbose = !!program.opts().verbose;
+        const callbackPath = normalizeCallbackPath(opts.callbackPath);
         let issuer = opts.issuer || "";
         let resource = opts.resource || "";
         if (!opts.issuer || !opts.resource) {
@@ -108,16 +177,19 @@ export function registerLoginCommand(program) {
         }
         const state = randomState();
         const pkce = createPKCE();
-        const callback = await startCallbackServer({
-            host: redirectHost,
-            port: redirectPort,
-            path: callbackPath.startsWith("/") ? callbackPath : `/${callbackPath}`,
-            state,
-            timeoutMs: 5 * 60 * 1000,
-        });
+        let callback;
+        const redirectUri = noBlock
+            ? buildCliCallbackRedirectUri(issuer)
+            : (callback = await startCallbackServer({
+                host: redirectHost,
+                port: redirectPort,
+                path: callbackPath,
+                state,
+                timeoutMs: 5 * 60 * 1000,
+            })).redirectUri;
         if (!clientId) {
             if (!endpoints.registrationEndpoint) {
-                callback.close();
+                callback?.close();
                 throw new Error("OAuth metadata 未提供 registration_endpoint，请用 --client-id 指定预注册客户端。");
             }
             if (verbose) {
@@ -128,12 +200,12 @@ export function registerLoginCommand(program) {
                 registeredClient = await registerDynamicOAuthClient({
                     registrationEndpoint: endpoints.registrationEndpoint,
                     clientName: "tyc-cli",
-                    redirectUris: [callback.redirectUri],
+                    redirectUris: [redirectUri],
                     tokenEndpointAuthMethod: "none",
                 });
             }
             catch (err) {
-                callback.close();
+                callback?.close();
                 throw err;
             }
             clientId = registeredClient.clientId;
@@ -145,14 +217,36 @@ export function registerLoginCommand(program) {
         const authorizationURL = buildAuthorizationURL({
             authorizationEndpoint: endpoints.authorizationEndpoint,
             clientId,
-            redirectUri: callback.redirectUri,
+            redirectUri,
             scope,
             state,
             codeChallenge: pkce.codeChallenge,
             resource,
         });
         if (verbose) {
-            console.error(`> OAuth callback: ${callback.redirectUri}`);
+            console.error(`> OAuth callback: ${redirectUri}`);
+        }
+        if (noBlock) {
+            savePendingOAuthLogin({
+                version: 1,
+                createdAt: Date.now(),
+                mcpURL,
+                tokenEndpoint: endpoints.tokenEndpoint,
+                clientId,
+                clientSecret,
+                redirectUri,
+                codeVerifier: pkce.codeVerifier,
+                resource,
+                state,
+                verify: opts.verify !== false,
+            });
+            console.error("请在浏览器打开以下 URL 完成登录：");
+            console.error(authorizationURL);
+            console.error("");
+            console.error("完成授权后，浏览器会打开天眼查 CLI 回调页。请按页面提示复制命令到终端执行。");
+            console.error("也可以复制完整回调 URL 后运行：");
+            console.error(`tyc login --callback-token "${redirectUri}?code=...&state=..."`);
+            return;
         }
         if (opts.open === false) {
             console.error("请在浏览器打开以下 URL 完成登录：");
@@ -162,6 +256,9 @@ export function registerLoginCommand(program) {
             console.error("正在打开浏览器完成 OAuth 登录...");
             openBrowser(authorizationURL);
         }
+        if (!callback) {
+            throw new Error("OAuth callback server not initialized");
+        }
         const code = await callback.waitForCode();
         if (verbose) {
             console.error("> authorization code received; exchanging access token");
@@ -171,40 +268,17 @@ export function registerLoginCommand(program) {
             clientId,
             clientSecret,
             code,
-            redirectUri: callback.redirectUri,
+            redirectUri,
             codeVerifier: pkce.codeVerifier,
             resource,
         });
-        const cfg = loadConfig() || {};
-        cfg.url = mcpURL;
-        if (!cfg.transport)
-            cfg.transport = "core";
-        if (!cfg.coreUrl)
-            cfg.coreUrl = defaultCoreURL(mcpURL);
-        cfg.headers = { ...(cfg.headers || {}) };
-        cfg.headers.Authorization = `${normalizeTokenType(token.token_type)} ${token.access_token}`;
-        saveConfig(cfg);
-        clearSession();
-        if (verbose) {
-            console.error(`> OAuth login state saved to ~/.tyc/config.json (url=${cfg.url})`);
-        }
-        if (opts.verify === false) {
-            printLoginSuccessBanner();
-            return;
-        }
-        const resolved = resolveConfig();
-        if (resolved.transport === "mcp") {
-            const sess = await ensureSession(resolved, { verbose });
-            if (verbose) {
-                console.error(`> MCP session initialized (sessionId=${sess.sessionId.slice(0, 16)}...)`);
-            }
-        }
-        else {
-            await verifyCoreAuthEndpoint(resolved, verbose);
-            if (verbose) {
-                console.error("> Shared Core auth check passed");
-            }
-        }
-        printLoginSuccessBanner();
+        saveOAuthTokenConfig(mcpURL, token, {
+            tokenEndpoint: endpoints.tokenEndpoint,
+            clientId,
+            clientSecret,
+            resource,
+        }, verbose);
+        clearPendingOAuthLogin(verbose);
+        await verifySavedOAuthLogin(opts.verify !== false, verbose);
     });
 }

package/dist/commands/output.js

@@ -0,0 +1,60 @@
+import { jsonToMarkdown } from "../utils/jsonToMarkdown.js";
+import { applyTruncation, resolveOptionalInt, TRUNCATE_DEFAULTS, } from "../utils/truncate.js";
+export function emitToolResult(result, opts, toolName) {
+    if (result.isError) {
+        const errText = extractText(result) || "未知业务错误";
+        console.error(errText);
+        process.exit(1);
+    }
+    const text = extractText(result);
+    if (text === null) {
+        console.error("tools/call 返回无可解析内容");
+        process.exit(1);
+    }
+    let payload;
+    try {
+        payload = JSON.parse(text);
+    }
+    catch {
+        emitWithTruncation(text.endsWith("\n") ? text.slice(0, -1) : text, opts);
+        return;
+    }
+    let rendered;
+    if (opts.md) {
+        rendered = jsonToMarkdown(payload, toolName);
+    }
+    else if (opts.compact) {
+        rendered = JSON.stringify(payload);
+    }
+    else {
+        rendered = JSON.stringify(payload, null, 2);
+    }
+    emitWithTruncation(rendered, opts);
+}
+function emitWithTruncation(rendered, opts) {
+    const head = resolveOptionalInt(opts.head, TRUNCATE_DEFAULTS.HEAD);
+    const tail = resolveOptionalInt(opts.tail, TRUNCATE_DEFAULTS.TAIL);
+    const threshold = resolveOptionalInt(opts.threshold, TRUNCATE_DEFAULTS.THRESHOLD);
+    const outputFile = typeof opts.outputFile === "string" && opts.outputFile.length > 0
+        ? opts.outputFile
+        : undefined;
+    const r = applyTruncation(rendered, {
+        full: !!opts.full,
+        head,
+        tail,
+        threshold,
+        outputFile,
+    });
+    console.log(r.rendered);
+    for (const n of r.notices) {
+        process.stderr.write(n + "\n");
+    }
+}
+function extractText(result) {
+    const content = result.content || [];
+    for (const c of content) {
+        if (typeof c.text === "string" && c.text.length > 0)
+            return c.text;
+    }
+    return null;
+}

package/dist/config.js

@@ -1,17 +1,17 @@
 // ~/.tyc/config.json 读写
 //
-// 配置文件格式与通用 MCP 客户端保持一致：
+// 配置文件格式：
 //   { "url": "https://mcp.tianyancha.com/mcp",
 //     "headers": { "Authorization": "xxxx" },
-//     "transport": "core",
 //     "coreUrl": "https://mcp.tianyancha.com/v1/core/tools/call" }
 //
-// 默认端点指向天眼查公网 MCP Server 的 canonical 入口 /mcp（/v1 是兼容别名，
-// coreUrl 的 REST 端点仍只挂在 /v1/core 下）；连接本地或私有环境可通过
+// 默认端点指向天眼查公网 MCP Server 的 canonical 入口 /mcp，CLI 实际调用
+// shared core REST 端点；连接本地或私有环境可通过
 //   tyc init --url http://localhost:8080/mcp 或 TYC_MCP_ENDPOINT 环境变量覆盖。
 import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { exchangeRefreshToken } from "./oauth.js";
 const CONFIG_DIR = join(homedir(), ".tyc");
 const CONFIG_FILE = join(CONFIG_DIR, "config.json");
 export const DEFAULT_MCP_URL = "https://mcp.tianyancha.com/mcp";
@@ -35,11 +35,57 @@ export function saveConfig(config) {
     }
     catch { /* best effort */ }
 }
-function normalizeTransport(raw) {
-    const v = (raw || "").trim().toLowerCase();
-    if (v === "mcp")
-        return "mcp";
-    return "core";
+const OAUTH_REFRESH_SKEW_MS = 60 * 1000;
+function normalizeTokenType(raw) {
+    if (!raw)
+        return "Bearer";
+    return raw.toLowerCase() === "bearer" ? "Bearer" : raw;
+}
+function jwtExpiresAt(accessToken) {
+    const parts = accessToken.split(".");
+    if (parts.length < 2)
+        return undefined;
+    try {
+        const normalized = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+        const padded = normalized + "=".repeat((4 - (normalized.length % 4)) % 4);
+        const payload = JSON.parse(Buffer.from(padded, "base64").toString("utf-8"));
+        if (typeof payload.exp === "number" && Number.isFinite(payload.exp)) {
+            return payload.exp * 1000;
+        }
+    }
+    catch {
+        // Non-JWT access tokens are valid OAuth responses too; expires_in remains authoritative.
+    }
+    return undefined;
+}
+export function inferAccessTokenExpiresAt(token, now = Date.now()) {
+    if (typeof token.expires_in === "number" && Number.isFinite(token.expires_in) && token.expires_in > 0) {
+        return now + token.expires_in * 1000;
+    }
+    return jwtExpiresAt(token.access_token);
+}
+export function applyOAuthTokenToConfig(config, token, opts) {
+    const now = opts.now ?? Date.now();
+    const tokenType = normalizeTokenType(token.token_type);
+    const refreshToken = token.refresh_token || opts.refreshToken;
+    if (!config.headers)
+        config.headers = {};
+    config.headers.Authorization = `${tokenType} ${token.access_token}`;
+    if (!refreshToken) {
+        delete config.oauth;
+        return;
+    }
+    config.oauth = {
+        tokenEndpoint: opts.tokenEndpoint,
+        clientId: opts.clientId,
+        clientSecret: opts.clientSecret,
+        refreshToken,
+        resource: opts.resource,
+        scope: token.scope || opts.scope,
+        tokenType,
+        accessTokenExpiresAt: inferAccessTokenExpiresAt(token, now),
+        updatedAt: now,
+    };
 }
 export function defaultCoreURL(mcpURL) {
     const u = new URL(mcpURL);
@@ -57,7 +103,6 @@ export function defaultCoreURL(mcpURL) {
 export function resolveConfig() {
     const cfg = loadConfig() || {};
     const url = process.env.TYC_MCP_ENDPOINT || cfg.url || DEFAULT_MCP_URL;
-    const transport = normalizeTransport(process.env.TYC_TRANSPORT || cfg.transport);
     const coreUrl = process.env.TYC_CORE_ENDPOINT || cfg.coreUrl || defaultCoreURL(url);
     const headers = { ...(cfg.headers || {}) };
     if (!headers.Authorization && process.env.TYC_AUTHORIZATION) {
@@ -67,5 +112,60 @@ export function resolveConfig() {
         console.error("未配置 Authorization。请先运行：tyc init --authorization YOUR_API_KEY");
         process.exit(1);
     }
-    return { url, coreUrl, transport, headers };
+    return { url, coreUrl, headers, oauth: cfg.oauth ? { ...cfg.oauth } : undefined };
+}
+function hasBearerAuthorization(config) {
+    return /^Bearer\s+\S+/i.test(config.headers.Authorization || "");
+}
+function shouldRefreshOAuth(oauth, opts) {
+    if (opts.force)
+        return true;
+    if (!oauth.accessTokenExpiresAt)
+        return false;
+    const skewMs = opts.skewMs ?? OAUTH_REFRESH_SKEW_MS;
+    return oauth.accessTokenExpiresAt <= Date.now() + skewMs;
+}
+export async function refreshResolvedConfigOAuth(resolved, opts = {}) {
+    const stored = loadConfig() || {};
+    const oauth = stored.oauth;
+    if (!oauth?.refreshToken || !oauth.tokenEndpoint || !oauth.clientId) {
+        return { config: resolved, refreshed: false };
+    }
+    if (!hasBearerAuthorization(resolved)) {
+        return { config: resolved, refreshed: false };
+    }
+    if (!shouldRefreshOAuth(oauth, opts)) {
+        return { config: resolved, refreshed: false };
+    }
+    let token;
+    try {
+        token = await exchangeRefreshToken({
+            tokenEndpoint: oauth.tokenEndpoint,
+            clientId: oauth.clientId,
+            clientSecret: oauth.clientSecret,
+            refreshToken: oauth.refreshToken,
+            resource: oauth.resource,
+        });
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`OAuth refresh token 刷新失败，请重新运行 tyc login：${msg}`);
+    }
+    applyOAuthTokenToConfig(stored, token, {
+        tokenEndpoint: oauth.tokenEndpoint,
+        clientId: oauth.clientId,
+        clientSecret: oauth.clientSecret,
+        refreshToken: oauth.refreshToken,
+        resource: oauth.resource,
+        scope: oauth.scope,
+    });
+    saveConfig(stored);
+    if (opts.verbose) {
+        console.error("> OAuth access token refreshed");
+    }
+    return { config: resolveConfig(), refreshed: true };
+}
+export async function resolveConfigWithFreshOAuth(opts = {}) {
+    const resolved = resolveConfig();
+    return refreshResolvedConfigOAuth(resolved, opts);
 }

package/dist/coreClient.js

@@ -72,6 +72,7 @@ export async function verifyCoreAuthEndpoint(cfg, verbose = false) {
 }
 export async function callCoreTool(cfg, name, args, opts) {
     const verbose = !!opts?.verbose;
+    const format = opts?.format || "json";
     const headers = {
         "Content-Type": "application/json",
         Accept: "application/json",
@@ -80,7 +81,7 @@ export async function callCoreTool(cfg, name, args, opts) {
     const body = {
         tool_name: name,
         arguments: args,
-        format: "json",
+        format,
     };
     if (verbose) {
         const masked = {};
@@ -88,7 +89,6 @@ export async function callCoreTool(cfg, name, args, opts) {
             masked[k] = k.toLowerCase() === "authorization" ? maskToken(v) : v;
         }
         console.error(`> POST ${cfg.coreUrl}`);
-        console.error(`> transport: core`);
         console.error(`> headers: ${JSON.stringify(masked)}`);
         console.error(`> body: ${JSON.stringify(body)}`);
     }