@clawos-dev/clawd 0.2.158-beta.332.393cc6b → 0.2.159-beta.333.770f863

package/dist/cli.cjs

@@ -40408,6 +40408,28 @@ async function handleRpcRequest(input) {
 // src/transport/http-router.ts
 var RPC_ROUTE_PREFIX = "/api/rpc/";
 var RPC_BODY_MAX_BYTES = 1 * 1024 * 1024;
+var AUTHED_RPC_ROUTE_PREFIX = "/rpc/";
+var AUTHED_RPC_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Authorization, Content-Type",
+  "Access-Control-Max-Age": "86400"
+};
+function authedRpcErrorStatus(code) {
+  switch (code) {
+    case "UNAUTHORIZED":
+    case "FORBIDDEN":
+    case "FEISHU_LOGIN_REQUIRED":
+      return 403;
+    case "METHOD_NOT_ALLOWED":
+    case "METHOD_NOT_IMPLEMENTED":
+      return 404;
+    case "INTERNAL":
+      return 500;
+    default:
+      return 400;
+  }
+}
 function isLoopbackAddress(addr) {
   if (!addr) return false;
   return addr === "127.0.0.1" || addr === "::1" || addr === "::ffff:127.0.0.1" || addr.startsWith("127.");
@@ -40502,6 +40524,52 @@ function createHttpRouter(deps) {
       res.end(html);
       return true;
     }
+    if (url.pathname.startsWith(AUTHED_RPC_ROUTE_PREFIX)) {
+      if (req.method === "OPTIONS") {
+        res.writeHead(204, AUTHED_RPC_CORS_HEADERS);
+        res.end();
+        return true;
+      }
+      if (!deps.authedRpc) {
+        sendJson(res, 501, { ok: false, error: "NOT_IMPLEMENTED", message: "HTTP RPC not wired" }, AUTHED_RPC_CORS_HEADERS);
+        return true;
+      }
+      if (req.method !== "POST") {
+        sendJson(res, 405, { ok: false, error: "METHOD_NOT_ALLOWED", message: "POST only" }, AUTHED_RPC_CORS_HEADERS);
+        return true;
+      }
+      const token = parseBearer(req.headers.authorization);
+      if (!token) {
+        sendJson(res, 401, { ok: false, error: "NO_TOKEN", message: "missing bearer token" }, AUTHED_RPC_CORS_HEADERS);
+        return true;
+      }
+      const auth = await deps.authedRpc.authenticate(token);
+      if (!auth.ok) {
+        sendJson(res, 401, { ok: false, error: auth.code, message: "invalid token" }, AUTHED_RPC_CORS_HEADERS);
+        return true;
+      }
+      const method = url.pathname.slice(AUTHED_RPC_ROUTE_PREFIX.length).split("?")[0] ?? "";
+      let body;
+      try {
+        body = await readJsonBody(req, RPC_BODY_MAX_BYTES);
+      } catch (err) {
+        sendJson(res, 400, { ok: false, error: "INVALID_BODY", message: err instanceof Error ? err.message : String(err) }, AUTHED_RPC_CORS_HEADERS);
+        return true;
+      }
+      try {
+        const result = await deps.authedRpc.dispatch(
+          method,
+          typeof body === "object" && body != null ? body : {},
+          auth.context
+        );
+        sendJson(res, 200, { ok: true, result: result.response }, AUTHED_RPC_CORS_HEADERS);
+      } catch (err) {
+        const e = err;
+        const code = e?.code ?? "INTERNAL";
+        sendJson(res, authedRpcErrorStatus(code), { ok: false, error: code, message: e?.message ?? String(err) }, AUTHED_RPC_CORS_HEADERS);
+      }
+      return true;
+    }
     if (url.pathname.startsWith(RPC_ROUTE_PREFIX)) {
       if (!deps.rpcDispatcher) {
         sendJson(res, 501, { code: "NOT_IMPLEMENTED", message: "HTTP RPC adapter not wired" });
@@ -45838,6 +45906,9 @@ var DevServerSupervisor = class extends import_node_events2.EventEmitter {
   }
 };
 
+// src/handlers/dispatch-rpc.ts
+init_protocol();
+
 // src/handlers/method-grants.ts
 var ADMIN_ANY = {
   kind: "fixed",
@@ -46013,6 +46084,32 @@ function computeGrantForFrame(method, frame) {
   return { kind: "check", resource: picked.resource, action: picked.action };
 }
 
+// src/handlers/dispatch-rpc.ts
+async function dispatchRpc(method, frame, client, ctx, deps) {
+  if (!METHOD_NAMES.includes(method)) {
+    throw new ClawdError(ERROR_CODES.METHOD_NOT_ALLOWED, `unknown method: ${method}`);
+  }
+  const handler = deps.handlers[method];
+  if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${method}`);
+  if (!deps.feishuActive() && FEISHU_GATED_METHODS.includes(method)) {
+    throw new ClawdError(
+      ERROR_CODES.FEISHU_LOGIN_REQUIRED,
+      `${method} requires feishu login (People/remote identity)`
+    );
+  }
+  const verdict = computeGrantForFrame(method, frame);
+  if (verdict.kind === "check") {
+    const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
+    if (!ok) {
+      throw new ClawdError(
+        ERROR_CODES.UNAUTHORIZED,
+        `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
+      );
+    }
+  }
+  return handler(frame, client, ctx);
+}
+
 // src/extension/runtime.ts
 var import_node_child_process15 = require("child_process");
 var import_node_path45 = __toESM(require("path"), 1);
@@ -46419,6 +46516,22 @@ async function startDaemon(config) {
   const contactStore = new ContactStore(config.dataDir);
   contactStore.load();
   const serverKeyStore = new ServerKeyStore(config.dataDir);
+  const buildConnectAuthDeps = () => ({
+    isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
+    ownerPrincipalId,
+    ownerDisplayName,
+    ...feishuActive ? {
+      verifyConnectToken: (token) => {
+        const publicKeyPem = serverKeyStore.read();
+        if (!publicKeyPem) return { ok: false, reason: "BAD_SIGNATURE" };
+        return verifyConnectToken({
+          token,
+          publicKeyPem,
+          expectedDeviceId: authFile.deviceId
+        });
+      }
+    } : {}
+  });
   const capabilityStore = new CapabilityStore(config.dataDir);
   const capabilityRegistry = new CapabilityRegistry(capabilityStore);
   const capabilityManager = new CapabilityManager(capabilityRegistry, {
@@ -46447,25 +46560,7 @@ async function startDaemon(config) {
     // owner 路径 constantTimeEqual 防侧信道；guest 路径走 capabilityRegistry.
     expectedToken: resolvedAuthToken,
     authenticate: async (t, selfUrl) => {
-      const result = await authenticate(t, {
-        isOwnerToken: (x) => resolvedAuthToken != null && constantTimeEqual(x, resolvedAuthToken),
-        ownerPrincipalId,
-        ownerDisplayName,
-        // 飞书 gate（spec 决策 #9）：未激活飞书身份时不接受 guest 入站（不注入验签函数
-        // → 一律 BAD_TOKEN）。已激活时用缓存的 server 公钥本地验签；
-        // 公钥缓存缺失（登录后拉取失败）→ fail-closed 拒绝 guest。
-        ...feishuActive ? {
-          verifyConnectToken: (token) => {
-            const publicKeyPem = serverKeyStore.read();
-            if (!publicKeyPem) return { ok: false, reason: "BAD_SIGNATURE" };
-            return verifyConnectToken({
-              token,
-              publicKeyPem,
-              expectedDeviceId: authFile.deviceId
-            });
-          }
-        } : {}
-      });
+      const result = await authenticate(t, buildConnectAuthDeps());
       if (result.ok && result.context.principal.kind === "guest") {
         void autoReverseContact({
           store: contactStore,
@@ -47019,6 +47114,23 @@ async function startDaemon(config) {
       return result.response;
     }
   };
+  const authedRpc = {
+    authenticate: (token) => authenticate(token, buildConnectAuthDeps()),
+    dispatch: (method, body, ctx) => {
+      const client = {
+        id: "http-rpc",
+        subscribedSessions: /* @__PURE__ */ new Map(),
+        send() {
+        },
+        close() {
+        }
+      };
+      return dispatchRpc(method, body, client, ctx, {
+        handlers,
+        feishuActive: () => feishuActive
+      });
+    }
+  };
   const viewerAssetLoader = tryLoadViewerAssets(logger);
   const httpRouter = createHttpRouter({
     authResolver,
@@ -47026,6 +47138,7 @@ async function startDaemon(config) {
     logger,
     sessionStore: store,
     rpcDispatcher,
+    authedRpc,
     ...viewerAssetLoader ? { viewerAssetLoader } : {},
     // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
     // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
@@ -47149,30 +47262,12 @@ async function startDaemon(config) {
   const wss = wsServer;
   wss.onFrame(async (client, frame) => {
     const type = frame.type;
-    if (!METHOD_NAMES.includes(type)) {
-      throw new ClawdError(ERROR_CODES.METHOD_NOT_ALLOWED, `unknown method: ${type}`);
-    }
     const requestId = typeof frame.requestId === "string" ? frame.requestId : void 0;
-    const handler = handlers[type];
-    if (!handler) throw new ClawdError(ERROR_CODES.METHOD_NOT_IMPLEMENTED, `not implemented: ${type}`);
-    if (!feishuActive && FEISHU_GATED_METHODS.includes(type)) {
-      throw new ClawdError(
-        ERROR_CODES.FEISHU_LOGIN_REQUIRED,
-        `${type} requires feishu login (People/remote identity)`
-      );
-    }
     const ctx = wsServer.getClientContext(client.id) ?? ownerContext(ownerPrincipalId, ownerDisplayName);
-    const verdict = computeGrantForFrame(type, frame);
-    if (verdict.kind === "check") {
-      const ok = assertGrant(ctx.grants, verdict.resource, verdict.action);
-      if (!ok) {
-        throw new ClawdError(
-          ERROR_CODES.UNAUTHORIZED,
-          `principal ${ctx.principal.kind}:${ctx.principal.id} cannot ${verdict.action} on ${verdict.resource.type}${"id" in verdict.resource ? ":" + verdict.resource.id : ""}`
-        );
-      }
-    }
-    const result = await handler(frame, client, ctx);
+    const result = await dispatchRpc(type, frame, client, ctx, {
+      handlers,
+      feishuActive: () => feishuActive
+    });
     if (requestId && result.response) {
       client.send({ ...result.response, requestId });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.158-beta.332.393cc6b",
+  "version": "0.2.159-beta.333.770f863",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",