GenarrativeAI/Genarrative

本地 dev 不再信任默认 CLI 配置里的远程 token #526

Closed

suzmii wants to merge 1 commits from fix/dev-loopback-token-trust into master

Author	SHA1	Message	Date
suzmii	ea03c2b5c8	本地 dev 不再把默认 CLI 配置里的远程 token 当作本地发布凭据 Project CI / AI game creator shell Rust smoke (pull_request) Successful in 1m15s Details Project CI / AI game creator shell Rust crates (pull_request) Successful in 56s Details Project CI / Backend tests (pull_request) Failing after 14s Details Project CI / Frontend tests (pull_request) Successful in 1m57s Details Project CI / Repository checks (pull_request) Failing after 16s Details Project CI / AI game creator shell web tests (pull_request) Successful in 1m23s Details Project CI / AI game creator shell Rust lane 2/2 (pull_request) Successful in 8m1s Details Project CI / Native shell tests (pull_request) Successful in 5m45s Details Project CI / AI game creator shell Rust lane 1/2 (pull_request) Successful in 8m37s Details - shouldTrustExistingSpacetimeToken：本地（loopback）服务器额外要求 token 由本机签发（JWT iss 为 localhost/127.0.0.1/::1）；默认 CLI 配置里的远程账号 token 形如有效但验签必然失败，会在 pre-publish check 抛 401 InvalidSignature - 显式 shell 覆盖 GENARRATIVE_SPACETIME_TOKEN 的语义保持不变，仍然优先 - 单测：远程签发 token 在本地服务器上不被信任、本机签发 token 被信任 - 验证：scripts/dev.test.ts 70 passed - 未覆盖（后续）：本机签发但已失效的旧 token（数据目录重建后签名失效，iss 仍为 localhost）仍需手工清理 dev-cli/cli.toml 与 dev-api-identities/local-node.json；自动自愈需要把发布调用改成非致命，因为当前 runForeground 失败会直接结束进程，调用层 catch 拿不到	2026-09-28 11:52:02 +08:00