@clawos-dev/clawd 0.2.415 → 0.2.417

package/dist/cli.cjs

@@ -57076,6 +57076,21 @@ async function authenticate(token, deps) {
     if (result.reason === "WRONG_AUDIENCE") return { ok: false, code: "TOKEN_REVOKED" };
     return { ok: false, code: "BAD_TOKEN" };
   }
+  if (deps.checkPrincipalActive) {
+    let active;
+    try {
+      active = await deps.checkPrincipalActive(result.provider, result.subOwner);
+    } catch (e) {
+      deps.onRevokeCheckFailed?.({
+        provider: result.provider,
+        ownerId: result.subOwner,
+        subDevice: result.subDevice,
+        reason: e.message
+      });
+      active = true;
+    }
+    if (!active) return { ok: false, code: "PRINCIPAL_REVOKED" };
+  }
   return {
     ok: true,
     context: connectGuestContext(result.subDevice, result.subOwner, result.provider, result.displayName)
@@ -59859,6 +59874,16 @@ async function centralUpsertDevice(opts) {
   }
   return { ok: true };
 }
+async function centralPrincipalStatus(opts) {
+  const query = `provider=${encodeURIComponent(opts.provider)}&ownerId=${encodeURIComponent(opts.ownerId)}`;
+  const body = await centralRequest(opts, `/api/clawd-identity/principal-status?${query}`, {
+    method: "GET"
+  });
+  if (typeof body.active !== "boolean") {
+    throw new CentralClientError("BAD_RESPONSE", "principal-status: missing active flag");
+  }
+  return { active: body.active };
+}
 async function centralListDevices(opts) {
   const body = await centralRequest(
     opts,
@@ -60395,8 +60420,16 @@ function buildSessionHandlers(deps) {
       );
     }
   };
+  const assertNotMasterPersona = (personaId2) => {
+    if (personaId2 !== MASTER_PERSONA_ID) return;
+    throw new ClawdError(
+      ERROR_CODES.FORBIDDEN,
+      `${MASTER_PERSONA_ID} \u7684\u4F1A\u8BDD\u7531\u8BDD\u9898\u521B\u5EFA\uFF0C\u4E0D\u80FD\u76F4\u63A5\u5EFA\uFF1A\u8BF7\u5728\u9891\u9053\u91CC\u65B0\u5EFA\u8BDD\u9898`
+    );
+  };
   const create = async (frame, _client, ctx) => {
     const args = SessionCreateArgs.parse(frame);
+    assertNotMasterPersona(args.ownerPersonaId);
     let tool = args.tool;
     let model = args.model;
     let effort = args.effort;
@@ -60436,6 +60469,7 @@ function buildSessionHandlers(deps) {
       );
     }
     const args = SessionImportExternalArgs.parse(frame);
+    assertNotMasterPersona(args.ownerPersonaId);
     if (args.ownerPersonaId) {
       const persona = deps.personaRegistry.get(args.ownerPersonaId);
       if (!persona) {
@@ -62278,7 +62312,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.415".length > 0 ? "0.2.415" : "dev";
+var version = "0.2.417".length > 0 ? "0.2.417" : "dev";
 
 // src/cli-probe/probe.ts
 var fs65 = __toESM(require("fs"), 1);
@@ -66208,6 +66242,31 @@ async function startDaemon(config) {
           publicKeyPem,
           expectedDeviceId: authFile.deviceId
         });
+      },
+      // 验票第二段（spec 2026-08-28）：本地验签只证明"票是中心签的"，这一步问中心
+      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机 ttcJwt，
+      // 否则飞书过期又会牵连互联。
+      checkPrincipalActive: async (provider, ownerId2) => {
+        const r = await centralPrincipalStatus({
+          api: config.clawosApi ?? DEFAULT_CLAWOS_API,
+          provider,
+          ownerId: ownerId2,
+          // 必须短于 AuthGate 的握手 timer（默认 5s，transport/auth.ts）。那个 timer 只看
+          // st.authed、**不看 st.pending**，所以 authenticate 跑太久会被它 1008 关掉——
+          // 那是"连接被关"，不是我们要的 fail-open 放行。centralRequest 默认 15s 远超
+          // 预算，这里压到 3s：中心慢时先抛超时 → 走 fail-open → 放行 + warn。
+          timeoutMs: 3e3
+        });
+        return r.active;
+      },
+      // fail-open 的可观测性出口：连接放行了，但撤销状态这次没查到。
+      onRevokeCheckFailed: (f) => {
+        logger.warn("principal revoke check failed (fail-open: connection allowed)", {
+          provider: f.provider,
+          ownerId: f.ownerId,
+          subDevice: f.subDevice,
+          reason: f.reason
+        });
       }
     } : {}
   });
@@ -66220,7 +66279,8 @@ async function startDaemon(config) {
     // owner 路径 constantTimeEqual 防侧信道；guest 路径走 verifyConnectToken (Ed25519).
     expectedToken: resolvedAuthToken,
     // 纯验票（spec 2026-07-22 双向确认建联）：guest 入站 = 自包含 connect token
-    // **本地验签**（Ed25519 公钥 + aud === 本机 deviceId + 未过期），零网络调用。
+    // 本地验签（Ed25519 公钥 + aud === 本机 deviceId + 未过期）+ 中心撤销查询
+    // （spec 2026-08-28，查不通则 fail-open 放行并 warn）。
     // 反向落库不再挂在验票副作用上——落库唯一路径 = contact:handshake handler。
     authenticate: async (t) => authenticate(t, buildConnectAuthDeps()),
     onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),