answer42 0.4.1__tar.gz → 0.4.2__tar.gz

{answer42-0.4.1 → answer42-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: answer42
-Version: 0.4.1
+Version: 0.4.2
 Summary: Answer42 — The Answer to Life, Universe, and 1C — UI Driver. MCP-powered 1C:Enterprise UI automation: click, fill, navigate, test, and introspect managed forms through the test-client API
 Author: Marvin (AI Assistant), 42Clouds, and contributors
 Author-email: "Kosolapov Stanislav (proDOOMman)" <prodoomman@gmail.com>
@@ -221,7 +221,7 @@ credentials_remove(url="<TARGET_INFOBASE_URL>")
 credentials_check(base_url="<TARGET_INFOBASE_URL>")
 ```
 
-Ответы этих tools содержат только факт наличия/изменения/удаления записи и URL; логины и пароли не возвращаются. Tool `credentials_list()` оставлен в коде для локальной диагностики, но в OpenClaw-конфигурации его рекомендуется скрывать через `toolFilter.exclude`, чтобы агент не мог получить список URL-шаблонов.
+Ответы этих tools содержат только факт наличия/изменения/удаления записи и URL; логины и пароли не возвращаются. `credentials_list()` дополнительно показывает статус проверки (`verified` / `verification_status`): новые или изменённые записи сохраняются как `unverified`, после успешного `start_session` с этой учёткой помечаются как `verified`, а `unverified` запись удаляется при ошибке авторизации. Tool `credentials_list()` оставлен в коде для локальной диагностики, но в OpenClaw-конфигурации его рекомендуется скрывать через `toolFilter.exclude`, чтобы агент не мог получить список URL-шаблонов.
 
 Остановка сессии:
 

{answer42-0.4.1 → answer42-0.4.2}/README.md

@@ -187,7 +187,7 @@ credentials_remove(url="<TARGET_INFOBASE_URL>")
 credentials_check(base_url="<TARGET_INFOBASE_URL>")
 ```
 
-Ответы этих tools содержат только факт наличия/изменения/удаления записи и URL; логины и пароли не возвращаются. Tool `credentials_list()` оставлен в коде для локальной диагностики, но в OpenClaw-конфигурации его рекомендуется скрывать через `toolFilter.exclude`, чтобы агент не мог получить список URL-шаблонов.
+Ответы этих tools содержат только факт наличия/изменения/удаления записи и URL; логины и пароли не возвращаются. `credentials_list()` дополнительно показывает статус проверки (`verified` / `verification_status`): новые или изменённые записи сохраняются как `unverified`, после успешного `start_session` с этой учёткой помечаются как `verified`, а `unverified` запись удаляется при ошибке авторизации. Tool `credentials_list()` оставлен в коде для локальной диагностики, но в OpenClaw-конфигурации его рекомендуется скрывать через `toolFilter.exclude`, чтобы агент не мог получить список URL-шаблонов.
 
 Остановка сессии:
 

{answer42-0.4.1 → answer42-0.4.2}/credentials.example.json

@@ -6,12 +6,14 @@
         {
           "url": "https://example.invalid/infobase",
           "username": "<USERNAME>",
-          "password": "<PASSWORD>"
+          "password": "<PASSWORD>",
+          "verified": false
         },
         {
           "url": "https://*.example.invalid/*",
           "username": "<WILDCARD_USERNAME>",
           "password": "<WILDCARD_PASSWORD>",
+          "verified": true,
           "title": "wildcard-example",
           "aliases": ["we"]
         }

{answer42-0.4.1 → answer42-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "answer42"
-version = "0.4.1"
+version = "0.4.2"
 description = "Answer42 — The Answer to Life, Universe, and 1C — UI Driver. MCP-powered 1C:Enterprise UI automation: click, fill, navigate, test, and introspect managed forms through the test-client API"
 readme = "README.md"
 requires-python = ">=3.11"

{answer42-0.4.1 → answer42-0.4.2}/src/cf/DataProcessors/MCPTestManager/Forms//320/244/320/276/321/200/320/274/320/260/Ext/Form/Module.bsl

@@ -1451,7 +1451,7 @@
 	КонецЕсли;
 
 	Попытка
-		АктивноеОкно = ТестируемоеПриложение.ПолуоитьАктивноеОкно();
+		АктивноеОкно = ТестируемоеПриложение.ПолучитьАктивноеОкно();
 		Форма = НайтиОбъектРекурсивно(АктивноеОкно, "", "", "ТестируемаяФорма", 0, 8);
 		Если Форма <> Неопределено Тогда
 			Форма.ПерейтиКСледующемуЭлементу();

{answer42-0.4.1 → answer42-0.4.2}/src/mcp_1c/credentials.py

@@ -62,7 +62,7 @@ class CredentialsStore:
     def __init__(self, path: Path | str | None = None) -> None:
         self._path = Path(path or DEFAULT_CREDENTIALS_PATH)
         self._version = 2
-        self._accounts: dict[str, dict[str, list[dict[str, str]]]] = {}
+        self._accounts: dict[str, dict[str, list[dict[str, object]]]] = {}
         self._load()
 
     # ------------------------------------------------------------------
@@ -114,10 +114,14 @@ class CredentialsStore:
         self,
         account_id: str | None = None,
     ) -> list[dict[str, object]]:
-        """Return credential titles and URL patterns without secrets."""
+        """Return credential titles, URL patterns and verification status without secrets."""
         result: list[dict[str, object]] = []
         for entry in self._account_entries(account_id):
-            public: dict[str, object] = {"url": entry.get("url", "")}
+            public: dict[str, object] = {
+                "url": entry.get("url", ""),
+                "verified": bool(entry.get("verified", False)),
+                "verification_status": "verified" if entry.get("verified", False) else "unverified",
+            }
             if entry.get("title"):
                 public["title"] = entry["title"]
             if entry.get("aliases"):
@@ -158,22 +162,32 @@ class CredentialsStore:
         for entry in entries:
             entry_url = str(entry.get("url", "")).rstrip("/")
             entry_title = str(entry.get("title", "")).strip()
-            if entry_url == url or (title and entry_title == title):
-                entry["url"] = url
+            same_url_or_title = entry_url == url or (title and entry_title == title)
+            same_credentials = entry.get("username") == username and entry.get("password") == password
+            duplicate_match = same_credentials and self._credential_url_matches(entry_url, url)
+            if same_url_or_title or duplicate_match:
+                # Do not create a second exact URL when an existing wildcard already
+                # covers it (or vice versa) for the same username/password.  Merge
+                # user-facing labels into the existing entry instead.
+                if not duplicate_match or not entry_url:
+                    entry["url"] = url
                 entry["username"] = username
                 entry["password"] = password
+                entry["verified"] = False
                 if title:
                     entry["title"] = title
-                else:
+                elif not duplicate_match:
                     entry.pop("title", None)
                 if aliases:
-                    entry["aliases"] = aliases
-                else:
+                    existing_aliases = [str(a).strip() for a in entry.get("aliases", []) if str(a).strip()]
+                    merged_aliases = list(dict.fromkeys(existing_aliases + aliases)) if duplicate_match else aliases
+                    entry["aliases"] = merged_aliases
+                elif not duplicate_match:
                     entry.pop("aliases", None)
                 updated = True
                 break
         else:
-            entry = {"url": url, "username": username, "password": password}
+            entry = {"url": url, "username": username, "password": password, "verified": False}
             if title:
                 entry["title"] = title
             if aliases:
@@ -199,6 +213,45 @@ class CredentialsStore:
                 return True
         return False
 
+    def mark_verified(
+        self,
+        url: str,
+        username: str,
+        password: str,
+        account_id: str | None = None,
+    ) -> bool:
+        """Mark a matching credential as successfully verified."""
+        entry = self._find_entry(url, username, password, account_id)
+        if entry is None:
+            return False
+        if entry.get("verified") is True:
+            return True
+        entry["verified"] = True
+        self._save()
+        return True
+
+    def remove_matching(
+        self,
+        url: str,
+        username: str,
+        password: str,
+        account_id: str | None = None,
+    ) -> bool:
+        """Remove a credential entry matching URL/pattern and username/password."""
+        entries = self._account_entries(account_id)
+        url = str(url or "").rstrip("/")
+        for i, entry in enumerate(entries):
+            entry_url = str(entry.get("url", "")).rstrip("/")
+            if (
+                entry.get("username") == username
+                and entry.get("password") == password
+                and self._credential_url_matches(entry_url, url)
+            ):
+                del entries[i]
+                self._save()
+                return True
+        return False
+
     def reload(self) -> None:
         """Re-read the credentials file (useful after external edits)."""
         self._load()
@@ -211,16 +264,52 @@ class CredentialsStore:
     # internal
     # ------------------------------------------------------------------
 
-    def _ensure_account(self, account_id: str) -> list[dict[str, str]]:
+    def _ensure_account(self, account_id: str) -> list[dict[str, object]]:
         account_id = _normalize_account(account_id)
         if account_id not in self._accounts:
             self._accounts[account_id] = {"entries": []}
         return self._accounts[account_id]["entries"]
 
-    def _account_entries(self, account_id: str | None) -> list[dict[str, str]]:
+    def _account_entries(self, account_id: str | None) -> list[dict[str, object]]:
         account_id = _normalize_account(account_id)
         return self._accounts.get(account_id, {}).get("entries", [])
 
+    @staticmethod
+    def _has_wildcards(value: str) -> bool:
+        return any(ch in value for ch in "*?[")
+
+    @classmethod
+    def _credential_url_matches(cls, stored_url: str, candidate_url: str) -> bool:
+        stored_url = str(stored_url or "").rstrip("/")
+        candidate_url = str(candidate_url or "").rstrip("/")
+        if not stored_url or not candidate_url:
+            return False
+        if stored_url == candidate_url:
+            return True
+        if cls._has_wildcards(stored_url) and fnmatch.fnmatch(candidate_url, stored_url):
+            return True
+        if cls._has_wildcards(candidate_url) and fnmatch.fnmatch(stored_url, candidate_url):
+            return True
+        return False
+
+    def _find_entry(
+        self,
+        url: str,
+        username: str,
+        password: str,
+        account_id: str | None = None,
+    ) -> dict[str, object] | None:
+        url = str(url or "").rstrip("/")
+        for entry in self._account_entries(account_id):
+            entry_url = str(entry.get("url", "")).rstrip("/")
+            if (
+                entry.get("username") == username
+                and entry.get("password") == password
+                and self._credential_url_matches(entry_url, url)
+            ):
+                return entry
+        return None
+
     def _save(self) -> None:
         """Persist entries to the JSON file atomically."""
         self._path.parent.mkdir(parents=True, exist_ok=True)

{answer42-0.4.1 → answer42-0.4.2}/src/mcp_1c/server.py

@@ -1792,6 +1792,131 @@ async def _bridge_call_recorded(
     return _record_tool(session_id, method, params, result)
 
 
+_TOOL_LOG_MAX_VALUE = int(os.getenv("ONEC_MCP_TOOL_LOG_MAX_VALUE", "4096"))
+_TOOL_LOG_REDACT_KEYS = {
+    "password", "token", "api_token", "secret", "api_key", "auth",
+    "authorization", "bearer", "access_token", "refresh_token",
+}
+
+
+def _redact_value(value: Any) -> Any:
+    if isinstance(value, str) and len(value) > 6 and (
+        any(kw in value.lower() for kw in ("password", "token", "secret", "api_key"))
+    ):
+        return "***"
+    if isinstance(value, dict):
+        return {k: "***" if k.lower() in _TOOL_LOG_REDACT_KEYS else _redact_value(v) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_redact_value(v) for v in value]
+    return value
+
+
+def _truncate_value(value: Any) -> str:
+    try:
+        text = json.dumps(value, ensure_ascii=False, default=str)
+    except Exception:
+        text = str(value)
+    if len(text) > _TOOL_LOG_MAX_VALUE:
+        return text[:_TOOL_LOG_MAX_VALUE] + f"... [truncated, total {len(text)}]"
+    return text
+
+
+def _log_tool_call(
+    session_id: str,
+    method: str,
+    params: dict[str, Any],
+    result: Any,
+    error: str | None,
+    duration: float,
+) -> None:
+    logger = logging.getLogger("mcp_1c.tools")
+    if not logger.isEnabledFor(logging.DEBUG) and not logger.handlers:
+        return
+    status = "error" if error else "ok"
+    message = (
+        f"tool={method} status={status} duration_ms={duration * 1000:.2f} "
+        f"params={_truncate_value(_redact_value(params))} "
+        f"result={_truncate_value(_redact_value(result)) if error is None else '<none>'} "
+        f"error={error or '<none>'}"
+    )
+    logger.debug(message, extra={"session_id": session_id, "tool_name": method})
+
+
+_TOOL_LOGGER_CONFIGURED_PATH: str | None = None
+
+
+def _configure_tool_logging(log_path: str | Path) -> None:
+    """Enable per-call logging of every tool invocation to a rotating file."""
+    global _TOOL_LOGGER_CONFIGURED_PATH
+    if not log_path:
+        return
+    path_str = str(log_path)
+    if _TOOL_LOGGER_CONFIGURED_PATH == path_str:
+        return
+    path = Path(log_path)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    logger = logging.getLogger("mcp_1c.tools")
+    logger.setLevel(logging.DEBUG)
+    logger.propagate = False
+    for handler in list(logger.handlers):
+        if isinstance(handler, logging.handlers.RotatingFileHandler):
+            logger.removeHandler(handler)
+            handler.close()
+    handler = logging.handlers.RotatingFileHandler(
+        path, maxBytes=10 * 1024 * 1024, backupCount=5, encoding="utf-8"
+    )
+    handler.setFormatter(
+        logging.Formatter(
+            "%(asctime)s [%(levelname)s] [session=%(session_id)s] [tool=%(tool_name)s] %(message)s"
+        )
+    )
+    logger.addHandler(handler)
+    _TOOL_LOGGER_CONFIGURED_PATH = path_str
+    logger.info("Tool call logging enabled: %s", path, extra={"session_id": "-", "tool_name": "-"})
+
+
+_TOOL_CALL_WRAPPER_INSTALLED = False
+
+
+def _install_tool_call_logger() -> None:
+    """Wrap mcp.call_tool so every MCP tool invocation is logged."""
+    global _TOOL_CALL_WRAPPER_INSTALLED
+    if _TOOL_CALL_WRAPPER_INSTALLED:
+        return
+    original = mcp.call_tool
+
+    async def _logged_call_tool(*args: Any, **kwargs: Any) -> Any:
+        # The SDK may call call_tool(name, arguments) or (ctx, name, arguments).
+        # Extract tool name and arguments robustly.
+        name = ""
+        arguments: dict[str, Any] | None = None
+        if len(args) >= 2 and isinstance(args[0], str):
+            name = args[0]
+            arguments = args[1]
+        elif len(args) >= 3:
+            name = args[1]
+            arguments = args[2]
+        else:
+            name = kwargs.get("name", "")
+            arguments = kwargs.get("arguments")
+
+        params = arguments or {}
+        session_id = DEFAULT_SESSION
+        if isinstance(params, dict):
+            session_id = params.get("session_id", DEFAULT_SESSION)
+        start = time.monotonic()
+        try:
+            result = await original(*args, **kwargs)
+            _log_tool_call(session_id, name, params, result, None, time.monotonic() - start)
+            return result
+        except Exception as exc:
+            _log_tool_call(session_id, name, params, None, str(exc), time.monotonic() - start)
+            raise
+
+    mcp.call_tool = _logged_call_tool
+    _TOOL_CALL_WRAPPER_INSTALLED = True
+
+
 def _screenshot_for_recorder(
     path: str,
     window: bool,
@@ -2535,6 +2660,9 @@ async def start_session(
 ) -> dict[str, Any]:
     """One-shot session factory: detect version, start infrastructure and connect the 1C test client."""
     credential_ref = _resolve_credential_reference(base_url)
+    credential_account_id = _current_account_id()
+    saved_credentials_used = False
+    saved_credentials_unverified = False
     input_looks_like_url = bool(re.match(r"^[A-Za-z][A-Za-z0-9+.-]*://", str(base_url or "")))
     if credential_ref is not None:
         # For saved titles/aliases, replace title -> real URL.  For URL/wildcard matches,
@@ -2542,10 +2670,17 @@ async def start_session(
         # would make the 1C client fail with invalid connection parameters.
         if credential_ref.get("url") and not input_looks_like_url:
             base_url = str(credential_ref["url"])
+        original_username = username
+        original_password = password
         if not username:
             username = str(credential_ref.get("username", ""))
         if not password:
             password = str(credential_ref.get("password", ""))
+        saved_credentials_used = (
+            (not original_username or original_username == credential_ref.get("username"))
+            and (not original_password or original_password == credential_ref.get("password"))
+        )
+        saved_credentials_unverified = not bool(credential_ref.get("verified", False))
     base_url = _platform.normalize_infobase_url(base_url)
     connection_mode = "auto"
     connection_value = ""
@@ -2773,8 +2908,12 @@ async def start_session(
                 connect_connection_mode, connect_connection_value or connect_base_url, connect_base_url,
             )
             diagnostic_error = _client_failure_diagnostics(sess, enriched, target_mode)
+            if saved_credentials_used and saved_credentials_unverified and _looks_like_auth_failure(str(diagnostic_error)):
+                _discard_unverified_credentials(connect_base_url or connect_connection_value, username, password, credential_account_id)
             await _cleanup_failed_start_session(sess, "test-client startup failure")
             raise diagnostic_error from exc
+        if saved_credentials_used:
+            _mark_credentials_verified(connect_base_url or connect_connection_value, username, password, credential_account_id)
         _auto_maximize_test_client_result(connect_result, sess.client_display or sess.display)
 
     if sess.idle_timeout_seconds > 0:
@@ -2975,6 +3114,26 @@ def _resolve_credential_reference(value: str) -> dict[str, str] | None:
     return _credentials_store().resolve(value, account_id=_current_account_id())
 
 
+def _mark_credentials_verified(url: str, username: str, password: str, account_id: str | None) -> None:
+    if not _CREDENTIAL_STORE_ENABLED or not url or not username:
+        return
+    try:
+        _credentials_store().mark_verified(url, username, password, account_id=account_id)
+    except Exception:
+        logging.exception("Failed to mark credentials as verified for %s", url)
+
+
+def _discard_unverified_credentials(url: str, username: str, password: str, account_id: str | None) -> None:
+    if not _CREDENTIAL_STORE_ENABLED or not url or not username:
+        return
+    try:
+        removed = _credentials_store().remove_matching(url, username, password, account_id=account_id)
+        if removed:
+            logging.warning("Removed unverified credentials after authentication failure for %s", url)
+    except Exception:
+        logging.exception("Failed to remove unverified credentials for %s", url)
+
+
 @mcp.tool()
 def credentials_check(base_url: str) -> dict[str, object]:
     """Check whether credentials exist for a base URL or saved title without returning secrets."""
@@ -5984,6 +6143,11 @@ def main(argv: list[str] | None = None) -> None:
         default=os.getenv("ONEC_MCP_TOOL_PROFILE", "full"),
         help="comma-separated tool profile groups: core, ui, sessions, windows, forms, tables, tabular, dynamic, rag, recording, full, all",
     )
+    parser.add_argument(
+        "--tool-log",
+        default=os.getenv("ONEC_MCP_TOOL_LOG", ""),
+        help="path to a rotating log file for every MCP tool call (env: ONEC_MCP_TOOL_LOG).",
+    )
     parser.add_argument(
         "--http",
         action="store_true",
@@ -6024,6 +6188,8 @@ def main(argv: list[str] | None = None) -> None:
     )
     args = parser.parse_args(argv)
 
+    _configure_tool_logging(args.tool_log)
+
     _RAG_ENABLED = not args.disable_rag
     _CREDENTIAL_STORE_ENABLED = not args.disable_credential_store
     _DEV_TOOLS_ENABLED = bool(args.dev_tools)
@@ -6048,5 +6214,8 @@ def main(argv: list[str] | None = None) -> None:
         asyncio.run(_run(stale))
 
 
+_install_tool_call_logger()
+
+
 if __name__ == "__main__":
     main()