@clawos-dev/clawd 0.2.533 → 0.2.535

package/dist/cli.cjs

@@ -54624,6 +54624,32 @@ function upsertEnvFileVar(file, key, value) {
   import_node_fs28.default.writeFileSync(file, `${out.join("\n")}
 `, { encoding: "utf8", mode: 384 });
 }
+function readEnvFileVar(file, key) {
+  try {
+    return parseEnvFile(import_node_fs28.default.readFileSync(file, "utf8"))[key];
+  } catch {
+    return void 0;
+  }
+}
+function removeEnvFileVar(file, key) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) throw new Error(`invalid env name: ${key}`);
+  let lines;
+  try {
+    lines = import_node_fs28.default.readFileSync(file, "utf8").split("\n");
+  } catch {
+    return;
+  }
+  if (lines[lines.length - 1] === "") lines.pop();
+  const re2 = new RegExp(`^\\s*(?:export\\s+)?${key}=`);
+  const out = lines.filter((l2) => !re2.test(l2));
+  if (out.length === lines.length) return;
+  if (out.every((l2) => l2.trim() === "" || l2.trim().startsWith("#"))) {
+    import_node_fs28.default.rmSync(file, { force: true });
+    return;
+  }
+  import_node_fs28.default.writeFileSync(file, `${out.join("\n")}
+`, { encoding: "utf8", mode: 384 });
+}
 function readSecretTable(args) {
   return {
     ...args.bundleRoot ? readDir(args.bundleRoot, args.logger) : {},
@@ -59010,13 +59036,16 @@ async function storeGitCredential(exec, token) {
   return back?.token === token;
 }
 async function resolveGithubAuth(args) {
-  const fromGit = await readGitCredential(args.exec);
-  if (fromGit) return { token: fromGit.token, source: "git" };
   const fromFile = args.fileToken();
-  return fromFile ? { token: fromFile, source: "file" } : void 0;
+  if (fromFile) return { token: fromFile, source: "file" };
+  const fromGit = await readGitCredential(args.exec);
+  return fromGit ? { token: fromGit.token, source: "git" } : void 0;
 }
 async function storeGithubAuth(args) {
-  if (await storeGitCredential(args.exec, args.token)) return { token: args.token, source: "git" };
+  if (await storeGitCredential(args.exec, args.token)) {
+    args.clearFileToken();
+    return { token: args.token, source: "git" };
+  }
   args.writeFileToken(args.token);
   return { token: args.token, source: "file" };
 }
@@ -60004,6 +60033,10 @@ function createGithubIdentity(deps) {
      * 本机还没有身份时先问中心有没有本人现成的 token（换台机器授权过 / 上次跳回来了但 daemon 没轮到）：
      * 有且 GitHub 认就直接领、不跳 GitHub。本机已有身份（能用的 = 用户要换一个；失效的 = 要重新授权，而中心那份就是这把死的）
      * 一律跳 GitHub 重来。进 pending 之后每次 status() 顺手问一次中心领没领到。
+     *
+     * 跳 GitHub 的那一次**直接回 pending 带链接**，不经 status()：页面只在拿到 pending 时才开授权页
+     * （ui hooks/useGithubAuth.ts），而 status() 在本机身份还能用时会照常显示它——「换一个」走 status() 就把链接吞了，
+     * 用户点了没跳 GitHub、卡片直接显示已关联，中心那把死 token 永远换不掉（2026-09-17 实测）。之后的轮询仍走 status()。
      */
     async oauthStart(returnTo) {
       const local = await refresh();
@@ -60014,7 +60047,7 @@ function createGithubIdentity(deps) {
       }
       const { authUrl } = await deps.oauth.start(returnTo);
       pendingOauth = { authUrl, expiresAt: deps.now() + OAUTH_PENDING_MS };
-      return status();
+      return { status: "pending", authUrl };
     },
     onChange(cb) {
       listeners.add(cb);
@@ -70414,7 +70447,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.533".length > 0 ? "0.2.533" : "dev";
+var version = "0.2.535".length > 0 ? "0.2.535" : "dev";
 
 // src/cli-probe/probe.ts
 var fs77 = __toESM(require("fs"), 1);
@@ -73210,15 +73243,17 @@ async function startDaemon(config) {
   const secretsBundleRoot = findSecretsBundleRoot(logger);
   const localSecretsDir = import_node_path79.default.join(config.dataDir, LOCAL_SECRETS_DIRNAME);
   const readSecrets = () => readSecretTable({ bundleRoot: secretsBundleRoot, overrideDir: localSecretsDir, logger });
+  const githubTokenFile = import_node_path79.default.join(localSecretsDir, GITHUB_TOKEN_FILE);
   const githubIdentity = createGithubIdentity({
-    resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readSecrets()[GITHUB_TOKEN_VAR] }),
+    resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readEnvFileVar(githubTokenFile, GITHUB_TOKEN_VAR) }),
     store: (token) => storeGithubAuth({
       exec: runCommand,
       token,
       writeFileToken: (t2) => {
-        upsertEnvFileVar(import_node_path79.default.join(localSecretsDir, GITHUB_TOKEN_FILE), GITHUB_TOKEN_VAR, t2);
-        logger.warn("github.identity.token-in-file", { reason: "git \u6CA1\u914D credential helper\uFF0Ctoken \u843D\u672C\u673A\u51ED\u636E\u8868", file: GITHUB_TOKEN_FILE });
-      }
+        upsertEnvFileVar(githubTokenFile, GITHUB_TOKEN_VAR, t2);
+        logger.warn("github.identity.token-in-file", { reason: "git \u4E0D\u6536\uFF08\u6CA1\u914D credential helper\uFF0C\u6216\u53EA\u6709 gh \u90A3\u4E2A\u53EA\u8BFB\u7684\uFF09\uFF0Ctoken \u843D\u672C\u673A\u51ED\u636E\u8868", file: GITHUB_TOKEN_FILE });
+      },
+      clearFileToken: () => removeEnvFileVar(githubTokenFile, GITHUB_TOKEN_VAR)
     }),
     api: (token) => createGithubApi({ token }),
     oauth: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.533",
+  "version": "0.2.535",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",