@clawos-dev/clawd 0.2.529 → 0.2.531

package/dist/app-builder-plugin/mcp-server.cjs

@@ -21947,6 +21947,11 @@ var AuthApiKeyRegenerateResponseSchema = external_exports.object({
   createdAt: external_exports.string().min(1),
   gatewayUrl: GatewayUrl
 });
+var AuthApiKeyRevokeResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:revoke:ok"),
+  /** 之前有没有那把——没发过也算成功（幂等） */
+  revoked: external_exports.boolean()
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24494,6 +24499,10 @@ var METHOD_DOCS = {
     summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:revoke": {
+    summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS

package/dist/cli.cjs

@@ -6431,7 +6431,7 @@ var init_contact = __esm({
 });
 
 // ../protocol/src/feishu-auth.ts
-var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, GatewayUrl, AuthApiKeyGetResponseSchema, AuthApiKeyRegenerateResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
+var FEISHU_GATED_METHODS, LOGIN_EXPIRED_ERROR_MARKER, DeviceEntrySchema, DeviceListResponseSchema, DeviceConnectArgsSchema, DeviceConnectResponseSchema, FeishuIdentitySchema, AuthLoginStartResponseSchema, AuthGetIdentityResponseSchema, AuthLogoutResponseSchema, GatewayUrl, AuthApiKeyGetResponseSchema, AuthApiKeyRegenerateResponseSchema, AuthApiKeyRevokeResponseSchema, AuthLoginDoneEventSchema, AuthLoginFailedEventSchema;
 var init_feishu_auth = __esm({
   "../protocol/src/feishu-auth.ts"() {
     "use strict";
@@ -6538,6 +6538,11 @@ var init_feishu_auth = __esm({
       createdAt: external_exports.string().min(1),
       gatewayUrl: GatewayUrl
     });
+    AuthApiKeyRevokeResponseSchema = external_exports.object({
+      type: external_exports.literal("auth:apiKey:revoke:ok"),
+      /** 之前有没有那把——没发过也算成功（幂等） */
+      revoked: external_exports.boolean()
+    });
     AuthLoginDoneEventSchema = external_exports.object({
       type: external_exports.literal("auth:login:done"),
       identity: FeishuIdentitySchema
@@ -9311,6 +9316,10 @@ var init_methods = __esm({
         summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
         args: NO_ARGS
       },
+      "auth:apiKey:revoke": {
+        summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+        args: NO_ARGS
+      },
       "device:list": {
         summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
         args: NO_ARGS
@@ -62214,6 +62223,16 @@ async function centralIssueApiKey(opts) {
     gatewayUrl: typeof body.gatewayUrl === "string" ? body.gatewayUrl : null
   };
 }
+async function centralRevokeApiKey(opts) {
+  const body = await centralRequest(opts, "/api/persona-cloud/api-key", {
+    method: "DELETE",
+    bearer: opts.loginPass
+  });
+  if (typeof body.revoked !== "boolean") {
+    throw new CentralClientError("BAD_RESPONSE", "api-key: revoked must be boolean");
+  }
+  return { revoked: body.revoked };
+}
 async function centralListDevices(opts) {
   const body = await centralRequest(opts, "/api/clawd-identity/devices", {
     method: "GET",
@@ -62278,6 +62297,12 @@ var GATEWAY_ROUTES = {
   thread: (threadId) => `/threads/${encodeURIComponent(threadId)}`
 };
 var trimSlash = (u2) => u2.replace(/\/+$/, "");
+var CloudApiKeyRequiredError = class extends Error {
+  constructor() {
+    super("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\u3002\u5230\u300C\u8BBE\u7F6E \u2192 \u8D26\u53F7\u300D\u6216\u8FD9\u4E2A persona \u7684\u5361\u7247\u4E0A\u751F\u6210\u4E00\u628A\uFF0C\u518D\u5F00\u4F1A\u8BDD");
+    this.name = "CloudApiKeyRequiredError";
+  }
+};
 var CLOUD_PERSONA_ID_SUFFIX = "-cloud";
 function cloudPersonaToFile(p3) {
   const at3 = p3.registeredAt ?? 0;
@@ -62300,20 +62325,27 @@ var CloudGatewayClient = class {
   }
   deps;
   fetchImpl;
-  async credentials() {
+  /**
+   * gateway 在哪 + 这个人有没有 key。要登录、要中心配了地址；**不要求有 key**——
+   * 登记表是全局的、/healthz 不看票，列表只需要地址。key 到开会话才要（见 credentials）。
+   * 曾把两样绑在一起：没生成 key 的用户连列表都看不到，也就永远不知道要去设置页生成一把（2026-09-16 修）。
+   */
+  async locate() {
     const loginPass = this.deps.getLoginPass();
     if (!loginPass) throw new ClawdError(ERROR_CODES.FEISHU_LOGIN_REQUIRED, "\u8FD8\u6CA1\u767B\u5F55\u98DE\u4E66\uFF0C\u4E91\u4E0A persona \u7528\u4E0D\u4E86");
     const get = this.deps.getApiKey ?? ((args) => centralGetApiKey({ api: this.deps.centralApi ?? "", fetchImpl: this.fetchImpl, ...args }));
     const { apiKey, gatewayUrl } = await get({ loginPass });
-    if (!apiKey) throw new Error("\u8FD8\u6CA1\u751F\u6210\u4E91 persona \u7684\u8C03\u7528 key\uFF0C\u53BB\u300C\u8BBE\u7F6E \u2192 \u4E91\u4E0A persona\u300D\u751F\u6210\u4E00\u628A");
     if (!gatewayUrl) throw new Error("\u4E2D\u5FC3\u6CA1\u914D\u4E91 gateway \u5730\u5740\uFF08gatewayUrl \u4E3A\u7A7A\uFF09");
     return { apiKey, gatewayUrl: trimSlash(gatewayUrl) };
   }
+  async credentials() {
+    const { apiKey, gatewayUrl } = await this.locate();
+    if (!apiKey) throw new CloudApiKeyRequiredError();
+    return { apiKey, gatewayUrl };
+  }
   async listPersonas() {
-    const { apiKey, gatewayUrl } = await this.credentials();
-    const res = await this.fetchImpl(gatewayUrl + GATEWAY_ROUTES.healthz(), {
-      headers: { authorization: `Bearer ${apiKey}` }
-    });
+    const { gatewayUrl } = await this.locate();
+    const res = await this.fetchImpl(gatewayUrl + GATEWAY_ROUTES.healthz());
     if (!res.ok) throw new Error(`gateway /healthz \u56DE ${res.status}`);
     const body = await res.json();
     const rows = Array.isArray(body.deployments) ? body.deployments : [];
@@ -62428,7 +62460,9 @@ function openHttpLineStream(opts) {
       }
       if (!res.ok) {
         logger?.warn("cloud session send failed", { status: res.status });
-        fail(`\u4E0A\u884C\u53D1\u4E0D\u51FA\u53BB\uFF08gateway \u56DE ${res.status}\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86`);
+        fail(
+          res.status === 401 ? "\u8C03\u7528 key \u5DF2\u5931\u6548\uFF08\u64A4\u9500\u6216\u91CD\u65B0\u751F\u6210\u8FC7\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86\u3002\u5230\u300C\u8BBE\u7F6E \u2192 \u8D26\u53F7\u300D\u6216\u8FD9\u4E2A persona \u7684\u5361\u7247\u4E0A\u751F\u6210\u4E00\u628A\uFF0C\u518D\u5F00\u65B0\u4F1A\u8BDD" : `\u4E0A\u884C\u53D1\u4E0D\u51FA\u53BB\uFF08gateway \u56DE ${res.status}\uFF09\uFF0C\u8FD9\u6761\u4F1A\u8BDD\u65AD\u4E86`
+        );
       }
     }).catch((e) => {
       if (closed) return;
@@ -62719,7 +62753,7 @@ function createCloudCodexSession(ctx, sink, deps) {
       stream.attach(channel);
     },
     (e) => {
-      sink.onError(`\u8FDE\u4E0D\u4E0A\u4E91 gateway\uFF1A${e.message}`);
+      sink.onError(e instanceof CloudApiKeyRequiredError ? e.message : `\u8FDE\u4E0D\u4E0A\u4E91 gateway\uFF1A${e.message}`);
       stream.close();
     }
   );
@@ -69969,12 +70003,19 @@ function buildFeishuAuthHandlers(deps) {
       response: { type: "auth:apiKey:regenerate:ok", apiKey, createdAt, gatewayUrl }
     };
   };
+  const apiKeyRevoke = async () => {
+    const { revoked } = await deps.apiKeyClient.revoke(requireLogin());
+    return {
+      response: { type: "auth:apiKey:revoke:ok", revoked }
+    };
+  };
   return {
     "auth:login:start": loginStart,
     "auth:getIdentity": getIdentity,
     "auth:logout": logout,
     "auth:apiKey:get": apiKeyGet,
-    "auth:apiKey:regenerate": apiKeyRegenerate
+    "auth:apiKey:regenerate": apiKeyRegenerate,
+    "auth:apiKey:revoke": apiKeyRevoke
   };
 }
 
@@ -70274,6 +70315,7 @@ var METHOD_GRANT_MAP = {
   // 云 persona 调用 key：本机主人自己的东西，guest 一律够不着
   "auth:apiKey:get": ADMIN_ANY,
   "auth:apiKey:regenerate": ADMIN_ANY,
+  "auth:apiKey:revoke": ADMIN_ANY,
   // ---- device:* 设备目录 + 连接（决策 #15，owner-only） ----
   // 设备目录 / 连接都是 owner 本机操作（用本机登录票找中心 server），guest 不可调
   "device:list": ADMIN_ANY,
@@ -70328,7 +70370,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.529".length > 0 ? "0.2.529" : "dev";
+var version = "0.2.531".length > 0 ? "0.2.531" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73964,7 +74006,8 @@ async function startDaemon(config) {
         // 凭证不出 ws —— UI 只拿到 key 本身，跟 exchange / listDevices 同一条纪律。
         apiKeyClient: {
           get: (args) => centralGetApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
-          issue: (args) => centralIssueApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
+          issue: (args) => centralIssueApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args }),
+          revoke: (args) => centralRevokeApiKey({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, ...args })
         }
       },
       // 云 persona 卡片上的连接器区（design 2026-09-11-mcp-connector §3.8）：装了什么以 gateway 登记行为真源，

package/dist/dispatch/mcp-server.cjs

@@ -21762,6 +21762,11 @@ var AuthApiKeyRegenerateResponseSchema = external_exports.object({
   createdAt: external_exports.string().min(1),
   gatewayUrl: GatewayUrl
 });
+var AuthApiKeyRevokeResponseSchema = external_exports.object({
+  type: external_exports.literal("auth:apiKey:revoke:ok"),
+  /** 之前有没有那把——没发过也算成功（幂等） */
+  revoked: external_exports.boolean()
+});
 var AuthLoginDoneEventSchema = external_exports.object({
   type: external_exports.literal("auth:login:done"),
   identity: FeishuIdentitySchema
@@ -24309,6 +24314,10 @@ var METHOD_DOCS = {
     summary: "\u6362\u4E00\u628A\u65B0\u7684\u4E91 persona \u8C03\u7528 key\uFF0C**\u65E7\u7684\u5F53\u573A\u5931\u6548**\uFF08\u4E00\u4EBA\u4E00\u628A\uFF0C\u4E2D\u5FC3\u6309 union_id \u8986\u76D6\uFF09\u3002owner-only",
     args: NO_ARGS
   },
+  "auth:apiKey:revoke": {
+    summary: "\u64A4\u9500\u81EA\u5DF1\u7684\u4E91 persona \u8C03\u7528 key\uFF1A\u4E2D\u5FC3\u5220\u6389\u90A3\u4E00\u884C\u3001**\u4E0D\u53D1\u65B0\u7684**\u3002gateway \u53EA\u5728\u5F00\u4F1A\u8BDD\u548C\u6BCF\u6B21\u4E0A\u884C\u65F6\u9A8C key\uFF0C\u6240\u4EE5\u5F00\u7740\u7684\u4E91\u4F1A\u8BDD\u4E0B\u4E00\u6761\u6D88\u606F\u624D\u53D1\u4E0D\u51FA\u53BB\u3001\u6B63\u5728\u8DD1\u7684\u90A3\u4E00\u8F6E\u4F1A\u8DD1\u5B8C\u3002\u6CA1\u53D1\u8FC7\u4E5F\u56DE ok\uFF08revoked:false\uFF09\u3002owner-only",
+    args: NO_ARGS
+  },
   "device:list": {
     summary: "\u5217\u51FA\u516C\u5171\u8BBE\u5907\u76EE\u5F55\u91CC\u53EF\u8FDE\u63A5\u7684\u8BBE\u5907\uFF08daemon \u4EE3\u7406\u4E2D\u5FC3 server\uFF09\u3002owner-only",
     args: NO_ARGS