@clawos-dev/clawd 0.2.416 → 0.2.418

package/dist/cli.cjs

@@ -57076,6 +57076,21 @@ async function authenticate(token, deps) {
     if (result.reason === "WRONG_AUDIENCE") return { ok: false, code: "TOKEN_REVOKED" };
     return { ok: false, code: "BAD_TOKEN" };
   }
+  if (deps.checkPrincipalActive) {
+    let active;
+    try {
+      active = await deps.checkPrincipalActive(result.provider, result.subOwner);
+    } catch (e) {
+      deps.onRevokeCheckFailed?.({
+        provider: result.provider,
+        ownerId: result.subOwner,
+        subDevice: result.subDevice,
+        reason: e.message
+      });
+      active = true;
+    }
+    if (!active) return { ok: false, code: "PRINCIPAL_REVOKED" };
+  }
   return {
     ok: true,
     context: connectGuestContext(result.subDevice, result.subOwner, result.provider, result.displayName)
@@ -59859,6 +59874,16 @@ async function centralUpsertDevice(opts) {
   }
   return { ok: true };
 }
+async function centralPrincipalStatus(opts) {
+  const query = `provider=${encodeURIComponent(opts.provider)}&ownerId=${encodeURIComponent(opts.ownerId)}`;
+  const body = await centralRequest(opts, `/api/clawd-identity/principal-status?${query}`, {
+    method: "GET"
+  });
+  if (typeof body.active !== "boolean") {
+    throw new CentralClientError("BAD_RESPONSE", "principal-status: missing active flag");
+  }
+  return { active: body.active };
+}
 async function centralListDevices(opts) {
   const body = await centralRequest(
     opts,
@@ -62287,7 +62312,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.416".length > 0 ? "0.2.416" : "dev";
+var version = "0.2.418".length > 0 ? "0.2.418" : "dev";
 
 // src/cli-probe/probe.ts
 var fs65 = __toESM(require("fs"), 1);
@@ -66217,6 +66242,31 @@ async function startDaemon(config) {
           publicKeyPem,
           expectedDeviceId: authFile.deviceId
         });
+      },
+      // 验票第二段（spec 2026-08-28）：本地验签只证明"票是中心签的"，这一步问中心
+      // "持票人还在职吗"。token 不再过期，撤销全靠它。端点无鉴权——不带本机 ttcJwt，
+      // 否则飞书过期又会牵连互联。
+      checkPrincipalActive: async (provider, ownerId2) => {
+        const r = await centralPrincipalStatus({
+          api: config.clawosApi ?? DEFAULT_CLAWOS_API,
+          provider,
+          ownerId: ownerId2,
+          // 必须短于 AuthGate 的握手 timer（默认 5s，transport/auth.ts）。那个 timer 只看
+          // st.authed、**不看 st.pending**，所以 authenticate 跑太久会被它 1008 关掉——
+          // 那是"连接被关"，不是我们要的 fail-open 放行。centralRequest 默认 15s 远超
+          // 预算，这里压到 3s：中心慢时先抛超时 → 走 fail-open → 放行 + warn。
+          timeoutMs: 3e3
+        });
+        return r.active;
+      },
+      // fail-open 的可观测性出口：连接放行了，但撤销状态这次没查到。
+      onRevokeCheckFailed: (f) => {
+        logger.warn("principal revoke check failed (fail-open: connection allowed)", {
+          provider: f.provider,
+          ownerId: f.ownerId,
+          subDevice: f.subDevice,
+          reason: f.reason
+        });
       }
     } : {}
   });
@@ -66229,7 +66279,8 @@ async function startDaemon(config) {
     // owner 路径 constantTimeEqual 防侧信道；guest 路径走 verifyConnectToken (Ed25519).
     expectedToken: resolvedAuthToken,
     // 纯验票（spec 2026-07-22 双向确认建联）：guest 入站 = 自包含 connect token
-    // **本地验签**（Ed25519 公钥 + aud === 本机 deviceId + 未过期），零网络调用。
+    // 本地验签（Ed25519 公钥 + aud === 本机 deviceId + 未过期）+ 中心撤销查询
+    // （spec 2026-08-28，查不通则 fail-open 放行并 warn）。
     // 反向落库不再挂在验票副作用上——落库唯一路径 = contact:handshake handler。
     authenticate: async (t) => authenticate(t, buildConnectAuthDeps()),
     onAuthed: (h, ctx) => wsServer?.attachClientContext(h.id, ctx),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.416",
+  "version": "0.2.418",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",