Agent Board
bc6f8488ee
Land password-vault dedicated workbench and mnote-vault-core/CLI, agent token read path design, vault transport split, and retire obsolete filetree smokes. Ignore local vault reimport scripts that trip secret scanners.
245 lines
7.4 KiB
JavaScript
245 lines
7.4 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* Multi-agent CLI for the shared AI password book (unique strategy).
|
|
*
|
|
* Same backend as Pi tools / HTTP:
|
|
* list | get | resolve
|
|
*
|
|
* Auth: cookie session to mnote-web (default http://127.0.0.1:3000).
|
|
* export MNOTE_BASE_URL=http://127.0.0.1:3000
|
|
* export MNOTE_COOKIE='mnote_session=...' # or paste from browser
|
|
*
|
|
* Examples:
|
|
* node scripts/mnote-vault-cli.js list
|
|
* node scripts/mnote-vault-cli.js get --id cred_xxx
|
|
* node scripts/mnote-vault-cli.js resolve --id cred_xxx --field password
|
|
* node scripts/mnote-vault-cli.js resolve --id cred_xxx --field password --account-id acc_xxx
|
|
*
|
|
* Never print secrets to logs other than resolve stdout value line when --raw.
|
|
* Default resolve prints JSON including value for tool piping; use --raw for plain value only.
|
|
*/
|
|
|
|
const BASE = (process.env.MNOTE_BASE_URL || process.env.MNOTE_URL || 'http://127.0.0.1:3000').replace(
|
|
/\/$/,
|
|
''
|
|
);
|
|
const COOKIE = process.env.MNOTE_COOKIE || process.env.MNOTE_SESSION_COOKIE || '';
|
|
|
|
function usage() {
|
|
console.error(`Usage:
|
|
mnote-vault-cli.js auth-e2e # print export MNOTE_COOKIE=... for local mnote-web
|
|
mnote-vault-cli.js list [--status active|deleted]
|
|
mnote-vault-cli.js get --id <credentialId>
|
|
mnote-vault-cli.js resolve --id <credentialId> --field password|apikey|token|username|email \\
|
|
[--account-id <accountId>] [--secret-id <secretId>] [--raw]
|
|
mnote-vault-cli.js login --id <credentialId> [--force]
|
|
mnote-vault-cli.js session --id <credentialId> --cookie <CookieHeader> [--source human_bridge]
|
|
|
|
Env: MNOTE_BASE_URL, MNOTE_COOKIE
|
|
auth-e2e uses MNOTE_E2E_EMAIL / MNOTE_E2E_PASSWORD (defaults: mnote.e2e@example.com / MnoteE2E123!)
|
|
|
|
Steady-state: auth-e2e once → list (optional) → login (reuse session).
|
|
Multi-account: get item → pick accounts[].id → resolve --account-id …
|
|
Human Cloudflare: browser then "session" write-back.`);
|
|
process.exit(2);
|
|
}
|
|
|
|
function parseArgs(argv) {
|
|
const out = { _: [] };
|
|
for (let i = 0; i < argv.length; i++) {
|
|
const a = argv[i];
|
|
if (
|
|
a === '--id' ||
|
|
a === '--field' ||
|
|
a === '--status' ||
|
|
a === '--cookie' ||
|
|
a === '--source' ||
|
|
a === '--expires' ||
|
|
a === '--account-id' ||
|
|
a === '--secret-id'
|
|
) {
|
|
out[a.slice(2)] = argv[++i];
|
|
} else if (a === '--raw' || a === '--force') {
|
|
out[a.slice(2)] = true;
|
|
} else if (a.startsWith('--')) {
|
|
console.error('Unknown flag', a);
|
|
usage();
|
|
} else {
|
|
out._.push(a);
|
|
}
|
|
}
|
|
return out;
|
|
}
|
|
|
|
async function api(method, path, body) {
|
|
const headers = {
|
|
Accept: 'application/json',
|
|
};
|
|
if (COOKIE) headers.Cookie = COOKIE;
|
|
if (body != null) {
|
|
headers['Content-Type'] = 'application/json';
|
|
}
|
|
const res = await fetch(BASE + path, {
|
|
method,
|
|
headers,
|
|
body: body != null ? JSON.stringify(body) : undefined,
|
|
});
|
|
let data = null;
|
|
try {
|
|
data = await res.json();
|
|
} catch {
|
|
data = null;
|
|
}
|
|
if (!res.ok || (data && data.ok === false)) {
|
|
const msg =
|
|
(data && (data.message || (data.error && data.error.message))) ||
|
|
`HTTP ${res.status}`;
|
|
const code = (data && data.code) || res.status;
|
|
const err = new Error(String(msg));
|
|
err.code = code;
|
|
err.payload = data;
|
|
throw err;
|
|
}
|
|
return data && data.result != null ? data.result : data;
|
|
}
|
|
|
|
async function authE2e() {
|
|
const email =
|
|
process.env.MNOTE_E2E_EMAIL || 'mnote.e2e@example.com';
|
|
const password = process.env.MNOTE_E2E_PASSWORD || 'MnoteE2E123!';
|
|
const body = {
|
|
action: 'auth:signIn',
|
|
args: {
|
|
provider: 'password',
|
|
params: {
|
|
password,
|
|
flow: 'signIn',
|
|
account: email,
|
|
email,
|
|
name: email.includes('@') ? email.split('@')[0] : email,
|
|
},
|
|
},
|
|
};
|
|
const res = await fetch(BASE + '/api/auth', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
|
|
body: JSON.stringify(body),
|
|
});
|
|
const setCookies = res.headers.getSetCookie
|
|
? res.headers.getSetCookie()
|
|
: [];
|
|
// Node <18 fallback: raw get may only return one
|
|
const raw = res.headers.raw ? res.headers.raw()['set-cookie'] || [] : setCookies;
|
|
const parts = [];
|
|
for (const sc of raw) {
|
|
const first = String(sc).split(';')[0].trim();
|
|
if (first) parts.push(first);
|
|
}
|
|
if (!parts.length) {
|
|
const text = await res.text();
|
|
throw new Error(
|
|
`auth-e2e failed HTTP ${res.status}: no Set-Cookie (${text.slice(0, 120)})`
|
|
);
|
|
}
|
|
const cookieHeader = parts.join('; ');
|
|
// Print only export line for eval/source
|
|
console.log(`export MNOTE_COOKIE=${JSON.stringify(cookieHeader)}`);
|
|
console.error('[mnote-vault-cli] auth-e2e ok; eval the export line (do not paste cookie into chat)');
|
|
}
|
|
|
|
async function main() {
|
|
const args = parseArgs(process.argv.slice(2));
|
|
const cmd = args._[0];
|
|
if (!cmd) usage();
|
|
|
|
if (cmd === 'auth-e2e') {
|
|
await authE2e();
|
|
return;
|
|
}
|
|
|
|
if (!COOKIE) {
|
|
console.error(
|
|
'Warning: MNOTE_COOKIE empty — run: eval $(node scripts/mnote-vault-cli.js auth-e2e)'
|
|
);
|
|
}
|
|
|
|
if (cmd === 'list') {
|
|
const status = args.status || 'active';
|
|
const q = new URLSearchParams({ status });
|
|
const result = await api('GET', `/api/vault/ai/list?${q}`);
|
|
console.log(JSON.stringify(result, null, 2));
|
|
return;
|
|
}
|
|
if (cmd === 'get') {
|
|
if (!args.id) usage();
|
|
const result = await api('GET', `/api/vault/ai/items/${encodeURIComponent(args.id)}`);
|
|
console.log(JSON.stringify(result, null, 2));
|
|
return;
|
|
}
|
|
if (cmd === 'resolve') {
|
|
if (!args.id || !args.field) usage();
|
|
const body = { field: args.field };
|
|
if (args['account-id']) body.accountId = args['account-id'];
|
|
if (args['secret-id']) body.secretId = args['secret-id'];
|
|
const result = await api(
|
|
'POST',
|
|
`/api/vault/ai/items/${encodeURIComponent(args.id)}/resolve`,
|
|
body
|
|
);
|
|
if (args.raw) {
|
|
if (result && result.resolved && result.value != null) {
|
|
process.stdout.write(String(result.value));
|
|
if (!String(result.value).endsWith('\n')) process.stdout.write('\n');
|
|
} else {
|
|
console.error(
|
|
result && result.transcriptHint
|
|
? result.transcriptHint
|
|
: 'not resolved'
|
|
);
|
|
process.exit(1);
|
|
}
|
|
return;
|
|
}
|
|
console.log(JSON.stringify(result, null, 2));
|
|
return;
|
|
}
|
|
if (cmd === 'login') {
|
|
if (!args.id) usage();
|
|
const result = await api(
|
|
'POST',
|
|
`/api/vault/ai/items/${encodeURIComponent(args.id)}/login`,
|
|
{ forceRefresh: !!args.force }
|
|
);
|
|
// Redact cookie in default print? Agent needs cookie — print full JSON; warn stderr.
|
|
if (result && result.cookieHeader) {
|
|
console.error('[mnote-vault-cli] cookieHeader present (do not paste into chat)');
|
|
}
|
|
console.log(JSON.stringify(result, null, 2));
|
|
if (result && result.ok === false && result.code === 'vault_login_human_required') {
|
|
process.exit(3);
|
|
}
|
|
return;
|
|
}
|
|
if (cmd === 'session') {
|
|
if (!args.id || !args.cookie) usage();
|
|
const result = await api(
|
|
'POST',
|
|
`/api/vault/ai/items/${encodeURIComponent(args.id)}/session`,
|
|
{
|
|
cookieHeader: args.cookie,
|
|
expiresAt: args.expires || undefined,
|
|
source: args.source || 'human_bridge',
|
|
}
|
|
);
|
|
console.log(JSON.stringify(result, null, 2));
|
|
return;
|
|
}
|
|
usage();
|
|
}
|
|
|
|
main().catch((err) => {
|
|
console.error(err.message || String(err));
|
|
if (err.code) console.error('code:', err.code);
|
|
process.exit(1);
|
|
});
|