@clawos-dev/clawd 0.2.354 → 0.2.356

package/dist/cli.cjs

@@ -5924,12 +5924,13 @@ var init_capability = __esm({
 });
 
 // ../protocol/src/contact-handshake.ts
-var ContactHandshakeArgsSchema, ContactHandshakeOkSchema;
+var PEER_LOGIN_EXPIRED_ERROR_MARKER, ContactHandshakeArgsSchema, ContactHandshakeOkSchema;
 var init_contact_handshake = __esm({
   "../protocol/src/contact-handshake.ts"() {
     "use strict";
     init_zod();
     init_capability();
+    PEER_LOGIN_EXPIRED_ERROR_MARKER = "PEER_LOGIN_EXPIRED";
     ContactHandshakeArgsSchema = external_exports.object({
       selfUrl: external_exports.string().min(1)
     });
@@ -6054,7 +6055,7 @@ var init_contact = __esm({
 });
 
 // ../protocol/src/feishu-auth.ts
-var FEISHU_GATED_METHODS, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
+var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
 var init_feishu_auth = __esm({
   "../protocol/src/feishu-auth.ts"() {
     "use strict";
@@ -6076,6 +6077,7 @@ var init_feishu_auth = __esm({
       // iOS TestFlight 意向登记（需要 owner unionId 上报中心 server）
       "onboarding:iosInterest"
     ];
+    LOGIN_EXPIRED_ERROR_MARKER = "LOGIN_EXPIRED";
     DeviceEntrySchema = external_exports.object({
       /**
        * 设备标识（决策 #15：daemon 本地生成的 dev-<uuid>，与人的身份 unionId 无关）。
@@ -59776,7 +59778,7 @@ function upsertPeerContact(args) {
     provider: args.provider,
     displayName: args.displayName,
     remoteUrl: args.selfUrl,
-    connectToken: "",
+    connectToken: args.connectToken,
     grants,
     addedAt: now(),
     pinnedAt: existing?.pinnedAt ?? null,
@@ -59786,17 +59788,6 @@ function upsertPeerContact(args) {
   args.broadcast({ type: "contact:added", contact: base });
   return base;
 }
-async function backfillConnectToken(args) {
-  try {
-    const token = await args.exchangeToken(args.contact.deviceId);
-    if (!token) return;
-    const upgraded = { ...args.contact, connectToken: token };
-    args.store.upsert(upgraded);
-    args.broadcast({ type: "contact:added", contact: upgraded });
-  } catch {
-    return;
-  }
-}
 
 // src/handlers/contact.ts
 function ensureOwner(ctx) {
@@ -59864,7 +59855,22 @@ function buildContactHandlers(deps) {
       );
     }
     const args = parseArgs2(ContactHandshakeArgsSchema, frame, "contact:handshake");
-    const contact = upsertPeerContact({
+    let token;
+    try {
+      token = await deps.exchangeToken(ctx.principal.id);
+    } catch (e) {
+      throw new ClawdError(
+        ERROR_CODES.INTERNAL,
+        `TOKEN_EXCHANGE_FAILED: \u6362\u7968\u5931\u8D25\uFF08${e.message}\uFF09\uFF0C\u7A0D\u540E\u91CD\u8BD5`
+      );
+    }
+    if (!token) {
+      throw new ClawdError(
+        ERROR_CODES.VALIDATION_ERROR,
+        `${PEER_LOGIN_EXPIRED_ERROR_MARKER}: \u672C\u673A\u767B\u5F55\u6001\u7F3A\u5931\u6216\u5DF2\u8FC7\u671F\uFF0C\u65E0\u6CD5\u5B8C\u6210\u5EFA\u8054`
+      );
+    }
+    upsertPeerContact({
       store: deps.store,
       broadcast: deps.broadcast,
       deviceId: ctx.principal.id,
@@ -59872,14 +59878,9 @@ function buildContactHandlers(deps) {
       provider: ctx.provider ?? "",
       displayName: ctx.principal.displayName ?? ctx.principal.id,
       selfUrl: args.selfUrl,
+      connectToken: token,
       now: deps.now
     });
-    void backfillConnectToken({
-      store: deps.store,
-      broadcast: deps.broadcast,
-      contact,
-      exchangeToken: deps.exchangeToken
-    });
     const identity = deps.getOwnerIdentity();
     return {
       response: {
@@ -60058,7 +60059,7 @@ function rethrowLoginExpired(e) {
   if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") {
     throw new ClawdError(
       ERROR_CODES.VALIDATION_ERROR,
-      "LOGIN_EXPIRED: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u5728\u8054\u7CFB\u4EBA\u9762\u677F\u91CD\u65B0\u767B\u5F55"
+      `${LOGIN_EXPIRED_ERROR_MARKER}: \u767B\u5F55\u51ED\u8BC1\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u767B\u5F55`
     );
   }
   throw e;
@@ -60112,6 +60113,12 @@ function buildDeviceHandlers(deps) {
             "REVERSE_UNSUPPORTED: \u5BF9\u65B9 clawd \u7248\u672C\u8FC7\u65E7\uFF0C\u8BF7\u8BA9\u5BF9\u65B9\u5347\u7EA7\u540E\u91CD\u8BD5"
           );
         }
+        if (msg.includes(PEER_LOGIN_EXPIRED_ERROR_MARKER)) {
+          throw new ClawdError(
+            ERROR_CODES.VALIDATION_ERROR,
+            `${PEER_LOGIN_EXPIRED_ERROR_MARKER}: \u5BF9\u65B9\u8BBE\u5907\u767B\u5F55\u5DF2\u8FC7\u671F\u6216\u672A\u767B\u5F55\uFF0C\u8BF7\u5BF9\u65B9\u5728 clawd \u91CD\u65B0\u767B\u5F55\u540E\u518D\u8BD5`
+          );
+        }
         throw e;
       }
       const existing = deps.store.get(args.deviceId) ?? void 0;
@@ -60428,7 +60435,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.354".length > 0 ? "0.2.354" : "dev";
+var version = "0.2.356".length > 0 ? "0.2.356" : "dev";
 
 // src/cli-probe/probe.ts
 var fs60 = __toESM(require("fs"), 1);
@@ -64612,8 +64619,10 @@ async function startDaemon(config) {
       inboxStore,
       // 联系人列表 store（device:connect 出站 / contact:handshake 入站落同一 store）
       contactStore,
-      // contact:handshake 换票回填（spec 2026-07-22）：用 owner 当前 jwt 换 aud=对方设备 的票。
-      // 现读 ownerIdentityStore（热切换后用新身份）；失败 / 未登录 → null → 保持空票。
+      // contact:handshake 换票（spec 2026-07-22；2026-08-17 起硬失败，不再是回填）：
+      // 用 owner 当前 jwt 换 aud=对方设备 的票，现读 ownerIdentityStore（热切换后用新身份）。
+      // 契约（ContactHandlerDeps.exchangeToken）：null = 本机登录问题（未登录 / JWT 过期），
+      // 其他失败原样抛给 handler——两种都会让握手硬失败，只是给对端的错误文案不同。
       exchangeToken: async (targetDeviceId) => {
         const record = ownerIdentityStore.read();
         if (!record) return null;
@@ -64623,7 +64632,11 @@ async function startDaemon(config) {
             jwt: record.ttcToken,
             provider: record.identity.provider,
             deviceId: targetDeviceId,
-            selfDeviceId: authFile.deviceId
+            selfDeviceId: authFile.deviceId,
+            // 换票在握手关键路径上（硬失败），对端 connect-remote RPC_TIMEOUT_MS=5s：
+            // 必须在其内失败/成功，否则对端先超时不落库、本机后换票成功落库 → 反向半连，
+            // 破坏「两侧都不落库」不变量。4s 留 1s 余量给 ws 往返
+            timeoutMs: 4e3
           });
           return r.token;
         } catch (e) {
@@ -64631,7 +64644,8 @@ async function startDaemon(config) {
             targetDeviceId,
             err: e.message
           });
-          return null;
+          if (e instanceof CentralClientError && e.code === "UNAUTHORIZED") return null;
+          throw e;
         }
       },
       // inbox:sendDm 用：sessionId → session 出身（复用 attachment 同款 findOwnedSessionScope）

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.354",
+  "version": "0.2.356",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",