@clawos-dev/clawd 0.2.258 → 0.2.260

package/dist/cli.cjs

@@ -46528,8 +46528,9 @@ var import_node_crypto4 = __toESM(require("crypto"), 1);
 init_runtime();
 
 // src/visitor/visitor-token.ts
+var DOMAIN_PREFIX = "clawd-visitor-v1|";
 function hmac(secret, body) {
-  return import_node_crypto4.default.createHmac("sha256", secret).update(body).digest("base64url");
+  return import_node_crypto4.default.createHmac("sha256", secret).update(`${DOMAIN_PREFIX}${body}`).digest("base64url");
 }
 function signVisitorToken(secret, payload) {
   const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
@@ -51966,8 +51967,9 @@ function encodeAbsPathForUrl(absPath) {
 function decodeAbsPathFromUrl(encoded) {
   return encoded.split("/").map(decodeURIComponent).join("/");
 }
+var DOMAIN_PREFIX2 = "clawd-attach-v1|";
 function computeSig(secret, absPath, e) {
-  const msg = e === null ? absPath : `${absPath}|${e}`;
+  const msg = e === null ? `${DOMAIN_PREFIX2}${absPath}` : `${DOMAIN_PREFIX2}${absPath}|${e}`;
   return import_node_crypto7.default.createHmac(HMAC_ALGO, secret).update(msg).digest();
 }
 function signUrlParts(secret, absPath, ttlSeconds, now = Date.now) {
@@ -53667,23 +53669,19 @@ function loadOrCreateAuthFile(opts) {
   const genId = opts.genOwnerPrincipalId ?? defaultGenerateOwnerPrincipalId;
   const now = opts.now ?? (() => /* @__PURE__ */ new Date());
   const existing = readAuthFile(file);
-  if (existing && existing.token && existing.signSecret && existing.visitorTokenSecret && existing.ownerPrincipalId && existing.deviceId && existing.deviceId === existing.ownerPrincipalId) {
+  if (existing && existing.token && existing.ownerPrincipalId && existing.deviceId && existing.deviceId === existing.ownerPrincipalId && !existing.hasLegacySecrets) {
     return {
       token: existing.token,
-      signSecret: existing.signSecret,
-      visitorTokenSecret: existing.visitorTokenSecret,
       ownerPrincipalId: existing.ownerPrincipalId,
       deviceId: existing.deviceId,
       createdAt: existing.createdAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
     };
   }
   const token = existing?.token || generate();
-  const signSecret = existing?.signSecret || generate();
-  const visitorTokenSecret = existing?.visitorTokenSecret || generate();
   const ownerPrincipalId = existing?.ownerPrincipalId || genId();
   const deviceId = ownerPrincipalId;
   const createdAt = existing?.createdAt || now().toISOString();
-  const next = { token, signSecret, visitorTokenSecret, ownerPrincipalId, deviceId, createdAt };
+  const next = { token, ownerPrincipalId, deviceId, createdAt };
   writeAuthFile(file, next);
   return next;
 }
@@ -53702,11 +53700,11 @@ function readAuthFile(file) {
     }
     return {
       token: parsed.token,
-      signSecret: typeof parsed.signSecret === "string" && parsed.signSecret.length > 0 ? parsed.signSecret : void 0,
-      visitorTokenSecret: typeof parsed.visitorTokenSecret === "string" && parsed.visitorTokenSecret.length > 0 ? parsed.visitorTokenSecret : void 0,
       ownerPrincipalId: typeof parsed.ownerPrincipalId === "string" && parsed.ownerPrincipalId.length > 0 ? parsed.ownerPrincipalId : void 0,
       deviceId: typeof parsed.deviceId === "string" && parsed.deviceId.length > 0 ? parsed.deviceId : void 0,
-      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0
+      createdAt: typeof parsed.createdAt === "string" ? parsed.createdAt : void 0,
+      // 单 secret 合并前的旧字段：出现即触发清理写回（值无所谓，硬切不再使用）
+      hasLegacySecrets: "signSecret" in parsed || "visitorTokenSecret" in parsed
     };
   } catch (err) {
     const code = err?.code;
@@ -54787,7 +54785,7 @@ function buildHistoryHandlers(deps) {
   };
   const list = async (frame, _client, ctx) => {
     const args = HistoryListArgs.parse(frame);
-    assertGuestPath(ctx, path57.resolve(args.projectPath), personaRoot, "history:list");
+    assertGuestPath(ctx, path57.resolve(args.projectPath), personaRoot, "history:list", usersRoot);
     const sessions = await history.listSessions(args);
     return { response: { type: "history:list", sessions } };
   };
@@ -59056,7 +59054,7 @@ async function startDaemon(config) {
     // persona web 分享：访客 visitor token = daemon 自签 HMAC（无 aud），独立于飞书 connect token
     // 基建——secret 恒存在（auth-store backfill），故无条件注入。验签 ok → guest ctx（persona wildcard）。
     verifyVisitorToken: (t) => {
-      const r = verifyVisitorToken(authFile.visitorTokenSecret, t, Math.floor(Date.now() / 1e3));
+      const r = verifyVisitorToken(authFile.token, t, Math.floor(Date.now() / 1e3));
       return r.ok ? { ok: true, payload: r.payload } : { ok: false };
     },
     ...feishuActive ? {
@@ -59543,7 +59541,7 @@ async function startDaemon(config) {
   });
   const visitorStore = createVisitorStore({ dir: config.dataDir });
   const exchangeVisitorToken = buildVisitorLogin({
-    getSecret: () => authFile.visitorTokenSecret,
+    getSecret: () => authFile.token,
     fetchUserInfo: (ttcToken) => fetchTtcUserInfo({ apiBase: TTC_HOSTS.api, token: ttcToken }),
     visitorStore,
     now: () => Date.now(),
@@ -59599,9 +59597,8 @@ async function startDaemon(config) {
       groupFileStore,
       sessionStore: { read: (sid) => manager.findOwnedSession(sid) },
       getHttpBaseUrl,
-      // HMAC sign secret：~/.clawd/auth.json signSecret 字段（与 WS Bearer token 独立）。
-      // --auth-token CLI 模式 / noAuth 模式 authFile 为 null → handler 自己返 NOT_IMPLEMENTED。
-      getSignSecret: () => authFile?.signSecret ?? "",
+      // HMAC sign secret = auth.json 唯一 token（authFile 恒非空，startDaemon 开头加载）。
+      getSignSecret: () => authFile.token,
       // group RPC + sign 都用：根据 sessionId 反查 scope。owner-mode persona session 走
       // 'persona/<pid>/owner'，default 走 'default'。
       getSessionScope: (sid) => manager.findOwnedSessionScope(sid),
@@ -59888,11 +59885,10 @@ async function startDaemon(config) {
     // persona web 分享：访客换 token（POST /share/exchange）+ guest SPA serve（GET /s）
     visitorExchange: exchangeVisitorToken,
     ...shareUiAssetLoader ? { shareUiAssetLoader } : {},
-    // /files HMAC verify 用 auth.json 的 signSecret 字段（与 attachment.signUrl 同源）。
-    // --auth-token CLI 模式没 signSecret → 路由返 501，sign URL 功能整体禁用。
-    getSignSecret: () => authFile?.signSecret ?? null,
+    // /files HMAC verify 用 auth.json token（与 attachment.signUrl 同源）。
+    getSignSecret: () => authFile.token,
     // chatinput 附件上传（POST /attachments/upload，spec §6.1）。upload pipeline
-    // 在 session.cwd 下的 .attachments/ 落盘；signSecret 与 /files HMAC 同源；
+    // 在 session.cwd 下的 .attachments/ 落盘；签名 secret 与 /files HMAC 同源；
     // tunnel 未启时返 503 TUNNEL_NOT_READY 让前端显式提示。
     attachmentUpload: {
       groupFileStore,
@@ -59973,7 +59969,7 @@ async function startDaemon(config) {
     // （非 persona-web 场景静默 return null；tunnel 模式走 AuthGate 不经此路）。参数名
     // tryVerifyCapabilityToken 不再准确，跨 local-ws-server 改名属 followup 清理。
     tryVerifyCapabilityToken: (token) => {
-      const vis = verifyVisitorToken(authFile.visitorTokenSecret, token, Math.floor(Date.now() / 1e3));
+      const vis = verifyVisitorToken(authFile.token, token, Math.floor(Date.now() / 1e3));
       if (vis.ok) return visitorGuestContext(vis.payload);
       return null;
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.258",
+  "version": "0.2.260",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",