@clawos-dev/clawd 0.2.523 → 0.2.525

package/dist/cli.cjs

@@ -60156,8 +60156,7 @@ function buildLarkBotHandlers(deps) {
     const { personaId: personaId2 } = parseArgs2(LarkBotProvisionArgs, frame, "larkBot:provision");
     const tunnelUrl = deps.getTunnelUrl();
     if (!tunnelUrl) throw new Error("larkBot provision requires tunnel to be up");
-    const ownerId = deps.getOwnerId();
-    if (!ownerId) throw new Error("larkBot provision requires feishu login (owner identity)");
+    if (!deps.getOwnerId()) throw new Error("larkBot provision requires feishu login (owner identity)");
     if (deps.store.read(personaId2)) throw new Error(`larkBot already bound: ${personaId2}`);
     if (inFlight.has(personaId2)) throw new Error(`larkBot provision already in flight: ${personaId2}`);
     const botName = deps.getPersonaName(personaId2) ?? personaId2;
@@ -60166,12 +60165,7 @@ function buildLarkBotHandlers(deps) {
     let qrUrl;
     try {
       ;
-      ({ provisionId, qrUrl } = await deps.cloud.provisionBegin({
-        personaId: personaId2,
-        botName,
-        tunnelUrl,
-        ownerId
-      }));
+      ({ provisionId, qrUrl } = await deps.cloud.provisionBegin({ personaId: personaId2, botName, tunnelUrl }));
     } catch (err) {
       inFlight.delete(personaId2);
       throw err;
@@ -60340,11 +60334,10 @@ function buildLarkBotHandlers(deps) {
     if (inFlight.has(personaId2)) throw new Error(`larkBot provision already in flight: ${personaId2}`);
     const tunnelUrl = deps.getTunnelUrl();
     if (!tunnelUrl) throw new Error("larkBot bind requires tunnel to be up");
-    const ownerId = deps.getOwnerId();
-    if (!ownerId) throw new Error("larkBot bind requires feishu login (owner identity)");
+    if (!deps.getOwnerId()) throw new Error("larkBot bind requires feishu login (owner identity)");
     const name = botName ?? deps.getPersonaName(personaId2) ?? personaId2;
     upgradeInFlight.delete(personaId2);
-    await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl, ownerId });
+    await deps.cloud.bind({ personaId: personaId2, appId, appSecret, botName: name, tunnelUrl });
     deps.store.write(personaId2, { appId, botName: name, boundAt: now() });
     emit(personaId2, { state: "bound", appId, botName: name, groups: groupsOf(personaId2) });
     return { response: { type: "larkBot:bindManual:ok" } };
@@ -60510,21 +60503,22 @@ function createLarkBotCloudClient(opts) {
   const f2 = opts.fetchImpl ?? globalThis.fetch;
   if (!f2) throw new Error("fetch is not available (Node >= 18 required)");
   const base = opts.api.replace(/\/+$/, "");
+  function authHeaders() {
+    const pass = opts.getLoginPass();
+    if (!pass) throw new LarkBotCloudError("lark-bot cloud: no login pass (login / restart to obtain one)", 401);
+    return { authorization: `Bearer ${pass}` };
+  }
   async function request(method, pathname, body) {
+    const headers = authHeaders();
+    const url = `${base}${pathname}`;
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
     let res;
     try {
-      res = await f2(`${base}${pathname}`, {
+      res = await f2(url, {
         method,
         signal: ac.signal,
-        headers: {
-          authorization: `Bearer ${opts.apiKey}`,
-          "x-did": encodeURIComponent(opts.deviceId),
-          "x-name": encodeURIComponent(opts.displayName),
-          "x-scene": "daemon",
-          "content-type": "application/json"
-        },
+        headers: { ...headers, "content-type": "application/json" },
         body: body ? JSON.stringify(body) : void 0
       });
     } catch (err) {
@@ -60606,8 +60600,6 @@ function createLarkBotCloudClient(opts) {
       });
     },
     async fetchResource(appId, messageId, fileKey, maxBytes, type) {
-      const ac = new AbortController();
-      const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
       const qs = new URLSearchParams({
         appId,
         messageId,
@@ -60615,18 +60607,13 @@ function createLarkBotCloudClient(opts) {
         ...maxBytes ? { maxBytes: String(maxBytes) } : {},
         ...type ? { type } : {}
       }).toString();
+      const headers = authHeaders();
+      const url = `${base}/api/lark-bot/resource?${qs}`;
+      const ac = new AbortController();
+      const timer = setTimeout(() => ac.abort(), opts.timeoutMs ?? 15e3);
       let res;
       try {
-        res = await f2(`${base}/api/lark-bot/resource?${qs}`, {
-          method: "GET",
-          signal: ac.signal,
-          headers: {
-            authorization: `Bearer ${opts.apiKey}`,
-            "x-did": encodeURIComponent(opts.deviceId),
-            "x-name": encodeURIComponent(opts.displayName),
-            "x-scene": "daemon"
-          }
-        });
+        res = await f2(url, { method: "GET", signal: ac.signal, headers });
       } catch (err) {
         throw new LarkBotCloudError(`lark-bot cloud resource fetch failed: ${err.message}`);
       } finally {
@@ -62213,7 +62200,10 @@ async function centralUpsertDevice(opts) {
   if (body.ok !== true) {
     throw new CentralClientError("BAD_RESPONSE", "upsertDevice: server did not ack ok");
   }
-  return { ok: true };
+  return {
+    ok: true,
+    ...typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {}
+  };
 }
 async function centralPrincipalStatus(opts) {
   const query = `provider=${encodeURIComponent(opts.provider)}&ownerId=${encodeURIComponent(opts.ownerId)}`;
@@ -67581,7 +67571,8 @@ var OwnerIdentityStore = class {
       },
       ttcToken: r2.ttcToken,
       ttcTokenExpiresAt: typeof r2.ttcTokenExpiresAt === "number" ? r2.ttcTokenExpiresAt : null,
-      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString()
+      loginAt: typeof r2.loginAt === "string" ? r2.loginAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+      ...typeof r2.loginPass === "string" && r2.loginPass.length > 0 ? { loginPass: r2.loginPass } : {}
     };
   }
   write(record4) {
@@ -67644,12 +67635,14 @@ var LoginFlow = class {
     if (!identity.unionId) {
       return { ok: false, reason: "union_id missing from TTC user_info" };
     }
+    let loginPass;
     try {
-      await this.deps.upsertBinding({
+      ;
+      ({ loginPass } = await this.deps.upsertBinding({
         deviceId: this.deps.getDeviceId(),
         ttcToken: params.token,
         identity
-      });
+      }));
     } catch (err) {
       return {
         ok: false,
@@ -67661,7 +67654,8 @@ var LoginFlow = class {
       identity,
       ttcToken: params.token,
       ttcTokenExpiresAt: Number.isFinite(expiresAtNum) ? expiresAtNum : null,
-      loginAt: new Date(now).toISOString()
+      loginAt: new Date(now).toISOString(),
+      ...loginPass ? { loginPass } : {}
     });
     return { ok: true, identity };
   }
@@ -67766,6 +67760,12 @@ async function upsertDeviceBinding(opts) {
     }
     throw new DeviceBindingClientError("API_ERROR", `HTTP ${res.status}: ${detail}`);
   }
+  let body = {};
+  try {
+    body = await res.json();
+  } catch {
+  }
+  return typeof body.loginPass === "string" && body.loginPass.length > 0 ? { loginPass: body.loginPass } : {};
 }
 
 // src/contact/org-mesh.ts
@@ -67789,12 +67789,7 @@ async function fetchOrgPeers(opts) {
     res = await doFetch(`${opts.apiUrl}/api/device-bindings/org-peers`, {
       method: "GET",
       signal: ac.signal,
-      headers: {
-        authorization: `Bearer ${opts.apiKey}`,
-        "x-did": encodeURIComponent(opts.deviceId),
-        "x-name": encodeURIComponent(opts.displayName),
-        "x-scene": "daemon"
-      }
+      headers: { authorization: `Bearer ${opts.loginPass}` }
     });
   } catch (err) {
     throw new OrgMeshClientError("NETWORK", `network error: ${err.message}`, err);
@@ -70376,7 +70371,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.523".length > 0 ? "0.2.523" : "dev";
+var version = "0.2.525".length > 0 ? "0.2.525" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -72458,14 +72453,7 @@ async function submitIosInterest(opts) {
     res = await doFetch(`${opts.apiUrl}/api/ios-interest`, {
       method: "POST",
       signal: ac.signal,
-      headers: {
-        authorization: `Bearer ${opts.apiKey}`,
-        "x-did": encodeURIComponent(opts.deviceId),
-        "x-name": encodeURIComponent(opts.displayName),
-        "x-scene": "daemon",
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({ unionId: opts.unionId, displayName: opts.displayName })
+      headers: { authorization: `Bearer ${opts.loginPass}` }
     });
   } catch (err) {
     clearTimeout(timer);
@@ -72500,16 +72488,13 @@ function buildOnboardingHandlers(deps) {
   };
   const iosInterest = async (frame) => {
     parseArgs2(OnboardingIosInterestArgs, frame, "onboarding:iosInterest args");
-    const identity = deps.getOwnerIdentity();
-    if (!identity) {
-      throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "onboarding:iosInterest \u9700\u8981\u98DE\u4E66\u767B\u5F55");
+    const loginPass = deps.getLoginPass();
+    if (!loginPass) {
+      throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "onboarding:iosInterest \u9700\u8981\u98DE\u4E66\u767B\u5F55\uFF08\u5DF2\u767B\u5F55\u7684\u8BDD\u91CD\u542F\u4E00\u6B21 clawd \u9886\u767B\u5F55\u7968\uFF09");
     }
     await submitIosInterest({
       apiUrl: deps.apiUrl,
-      apiKey: deps.apiKey,
-      deviceId: deps.deviceId,
-      unionId: identity.unionId,
-      displayName: identity.displayName,
+      loginPass,
       ...deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}
     });
     return { response: { registered: true } };
@@ -73716,7 +73701,7 @@ async function startDaemon(config) {
     const record4 = ownerIdentityStore.read();
     if (!record4) return;
     try {
-      await centralUpsertDevice({
+      const r2 = await centralUpsertDevice({
         api: config.clawosApi ?? DEFAULT_CLAWOS_API,
         ttcJwt: record4.ttcToken,
         provider: record4.identity.provider,
@@ -73724,9 +73709,16 @@ async function startDaemon(config) {
         url: currentTunnelUrl ?? void 0,
         name: ownerDisplayName
       });
+      if (r2.loginPass) {
+        const latest = ownerIdentityStore.read();
+        if (latest && latest.ttcToken === record4.ttcToken && latest.loginPass !== r2.loginPass) {
+          ownerIdentityStore.write({ ...latest, loginPass: r2.loginPass });
+        }
+      }
       logger.info("device registered to central server", {
         deviceId: authFile.deviceId,
-        url: currentTunnelUrl ?? "(none)"
+        url: currentTunnelUrl ?? "(none)",
+        loginPass: r2.loginPass ? "issued" : "absent"
       });
     } catch (err) {
       logger.warn("device register failed (best-effort)", { err: err.message });
@@ -73736,16 +73728,15 @@ async function startDaemon(config) {
   const runOrgMesh = async () => {
     if (!feishuActive || orgMeshInFlight) return;
     const record4 = ownerIdentityStore.read();
-    if (!record4) return;
+    if (!record4?.loginPass) return;
+    const loginPass = record4.loginPass;
     orgMeshInFlight = true;
     try {
       await syncOrgMesh({
         store: contactStore,
         fetchPeers: () => fetchOrgPeers({
           apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
-          apiKey: resolveClawdTicketsApiKey(),
-          deviceId: authFile.deviceId,
-          displayName: record4.identity.displayName || authFile.deviceId
+          loginPass
         }),
         connectToDevice: createConnectToDevice(feishuDeviceDeps),
         log: (msg, meta) => logger.info(msg, meta),
@@ -73816,13 +73807,13 @@ async function startDaemon(config) {
     fetchUserInfo: (ttcToken) => fetchTtcUserInfo({ apiBase: TTC_HOSTS.api, token: ttcToken }),
     ttcAuthBase: TTC_HOSTS.auth,
     getCallbackUrl: () => `http://127.0.0.1:${config.port}/auth/callback`,
-    // device_bindings upsert（did ↔ 飞书 unionId 映射）：
-    // deviceId 从 auth.json 稳定读；apiUrl 走同一份 clawosApi；鉴权 = 刚登录拿到的 TTC JWT。
+    // 登录换票（design 2026-09-15-api-auth-tiers §2）：device_bindings upsert（did ↔ 飞书 unionId 映射）
+    // + 领登录票。deviceId 从 auth.json 稳定读；apiUrl 走同一份 clawosApi；鉴权 = 刚登录拿到的 TTC JWT。
     // 失败即登录失败（fail-hard，login-flow.spec §upsert 失败）。
     getDeviceId: () => authFile.deviceId,
     upsertBinding: async (opts) => {
       try {
-        await upsertDeviceBinding({
+        const r2 = await upsertDeviceBinding({
           apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
           ttcToken: opts.ttcToken,
           provider: opts.identity.provider,
@@ -73830,8 +73821,10 @@ async function startDaemon(config) {
         });
         logger.info("device-binding upsert succeeded", {
           deviceId: opts.deviceId,
-          unionId: opts.identity.unionId
+          unionId: opts.identity.unionId,
+          loginPass: r2.loginPass ? "issued" : "absent"
         });
+        return r2;
       } catch (err) {
         logger.warn("device-binding upsert failed", {
           deviceId: opts.deviceId,
@@ -74238,9 +74231,7 @@ async function startDaemon(config) {
   const larkBotStore = createLarkBotBindingStore(import_node_path79.default.join(config.dataDir, "personas"));
   const larkBotCloud = createLarkBotCloudClient({
     api: config.clawosApi ?? DEFAULT_CLAWOS_API,
-    apiKey: resolveClawdTicketsApiKey(),
-    deviceId: authFile.deviceId,
-    displayName: ownerDisplayName
+    getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null
   });
   let larkDraining = false;
   const larkChatRouter = createLarkChatRouter({
@@ -74280,17 +74271,8 @@ async function startDaemon(config) {
     buildOnboardingHandlers({
       dataDir: config.dataDir,
       // 现读（登录/登出热切换）；unionId 缺失时回落 ownerId（老登录记录无 unionId）
-      getOwnerIdentity: () => {
-        const rec5 = ownerIdentityStore.read();
-        if (!rec5) return null;
-        return {
-          unionId: rec5.identity.unionId ?? rec5.identity.ownerId,
-          displayName: rec5.identity.displayName
-        };
-      },
-      apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API,
-      apiKey: resolveClawdTicketsApiKey(),
-      deviceId: authFile.deviceId
+      getLoginPass: () => ownerIdentityStore.read()?.loginPass ?? null,
+      apiUrl: config.clawosApi ?? DEFAULT_CLAWOS_API
     })
   );
   const authResolver = new AuthContextResolver({
@@ -74533,21 +74515,6 @@ async function startDaemon(config) {
       stateMgr.write(stateSnapshot);
       currentTunnelUrl = r2.url;
       wss.broadcastAll({ type: "tunnel:ready", url: r2.url, subdomain: r2.subdomain });
-      void refreshTunnelUrlOnStartup(larkBotDeps);
-      void (async () => {
-        if (larkBotDeps.listBoundPersonaIds().length === 0) return;
-        try {
-          const items = await larkBotCloud.claimEvents();
-          routeClaimedEvents(items, {
-            router: larkChatRouter,
-            dedupe: larkEventDedupe,
-            nowSec: Math.floor(Date.now() / 1e3)
-          });
-          if (items.length > 0) logger.info("larkBot pending events claimed", { count: items.length });
-        } catch (err) {
-          logger.warn("larkBot pending events claim failed", { err: err.message });
-        }
-      })();
       const connectUrl = resolvedAuthToken ? `${r2.url}#token=${resolvedAuthToken}` : r2.url;
       const lines = [
         `Tunnel:      ${r2.url}`,
@@ -74592,9 +74559,23 @@ ${bar}
       logger.warn("tunnel unavailable, degraded to local mode", { reason: tunnelError });
     }
   }
-  void reportDevice();
+  void reportDevice().then(async () => {
+    void runOrgMesh();
+    if (!currentTunnelUrl || larkBotDeps.listBoundPersonaIds().length === 0) return;
+    void refreshTunnelUrlOnStartup(larkBotDeps);
+    try {
+      const items = await larkBotCloud.claimEvents();
+      routeClaimedEvents(items, {
+        router: larkChatRouter,
+        dedupe: larkEventDedupe,
+        nowSec: Math.floor(Date.now() / 1e3)
+      });
+      if (items.length > 0) logger.info("larkBot pending events claimed", { count: items.length });
+    } catch (err) {
+      logger.warn("larkBot pending events claim failed", { err: err.message });
+    }
+  });
   void fetchServerKey();
-  void runOrgMesh();
   const tickAttachmentGc = () => {
     try {
       runAttachmentGc({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.523",
+  "version": "0.2.525",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",