@clawos-dev/clawd 0.2.686 → 0.2.689

package/dist/cli.cjs

@@ -43380,7 +43380,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net2 = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes2, createHash: createHash5 } = require("crypto");
+    var { randomBytes: randomBytes2, createHash: createHash6 } = require("crypto");
     var { Duplex, Readable: Readable4 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -44040,7 +44040,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -44407,7 +44407,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter2 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash5 } = require("crypto");
+    var { createHash: createHash6 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -44708,7 +44708,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash5("sha1").update(key + GUID).digest("base64");
+        const digest = createHash6("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -53581,6 +53581,10 @@ async function centralRequest(opts, path111, init) {
   }
   clearTimeout(timer);
   if (res.status === 401) {
+    const detail = await res.json().catch(() => null);
+    if (path111 === "/api/persona-cloud/github/oauth/token" && detail?.errorCode === "GITHUB_REAUTH_REQUIRED") {
+      throw new CentralClientError("API_ERROR", typeof detail.message === "string" ? detail.message : "\u8BF7\u91CD\u65B0\u5173\u8054 GitHub", void 0, 401);
+    }
     throw new CentralClientError("UNAUTHORIZED", "login pass rejected by center");
   }
   if (!res.ok) {
@@ -53759,11 +53763,12 @@ async function centralGithubAuthToken(opts) {
   const body = await centralRequest(opts, "/api/persona-cloud/github/oauth/token", {
     method: "POST",
     bearer: opts.loginPass,
-    body: {}
+    body: { ...opts.rejectedToken ? { rejectedToken: opts.rejectedToken } : {} }
   });
   if (body.token === null || body.token === void 0) return void 0;
   if (typeof body.token !== "string" || !body.token) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed token");
-  return { token: body.token, login: typeof body.login === "string" ? body.login : "" };
+  if (body.expiresAt !== void 0 && (typeof body.expiresAt !== "string" || !Number.isFinite(Date.parse(body.expiresAt)))) throw new CentralClientError("BAD_RESPONSE", "github/oauth/token: malformed expiry");
+  return { token: body.token, login: typeof body.login === "string" ? body.login : "", ...typeof body.expiresAt === "string" ? { expiresAt: body.expiresAt } : {} };
 }
 async function centralClaimPublisher(opts) {
   await centralRequest(opts, `/api/persona-cloud/personas/${encodeURIComponent(opts.personaId)}/publisher`, {
@@ -57519,8 +57524,8 @@ function createGhRunner(defaults) {
   const baseTimeoutMs = defaults?.timeoutMs ?? DEFAULT_TIMEOUT_MS2;
   const spawn17 = defaults?.execFile ?? import_node_child_process9.execFile;
   return {
-    run(args, opts) {
-      const token = defaults?.token?.();
+    async run(args, opts) {
+      const token = await defaults?.token?.();
       return new Promise((resolve9, reject) => {
         spawn17(
           "gh",
@@ -62165,23 +62170,38 @@ function createGithubApi(args) {
   const seal = args.seal ?? sealWithSodium;
   const timeoutMs = args.timeoutMs ?? TIMEOUT_MS;
   const secretsPath = (slug, environment) => `/repos/${slug}/${environment ? `environments/${encodeURIComponent(environment)}` : "actions"}/secrets`;
-  async function request(method, path111, body) {
-    let res;
-    try {
-      res = await doFetch(`${API}${path111}`, {
-        method,
-        headers: {
-          Authorization: `Bearer ${args.token}`,
-          Accept: "application/vnd.github+json",
-          "X-GitHub-Api-Version": "2022-11-28",
-          ...body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
-        signal: AbortSignal.timeout(timeoutMs)
-      });
-    } catch (err) {
-      throw new GithubApiError(0, `\u8FDE\u4E0D\u4E0A GitHub\uFF1A${err instanceof Error ? err.message : String(err)}`);
+  async function authenticatedFetch(path111, init) {
+    let token = args.identity ? (await args.identity.refresh())?.token : args.token;
+    if (!token) throw new GithubApiError(401, "\u8BF7\u5148\u5173\u8054 GitHub");
+    for (let attempt = 0; ; attempt++) {
+      let res;
+      try {
+        res = await doFetch(API + path111, {
+          ...init,
+          headers: { ...init.headers, Authorization: "Bearer " + token },
+          signal: AbortSignal.timeout(timeoutMs)
+        });
+      } catch (err) {
+        throw new GithubApiError(0, "\u8FDE\u4E0D\u4E0A GitHub\uFF1A" + (err instanceof Error ? err.message : String(err)));
+      }
+      if (res.status !== 401 || attempt !== 0 || !args.identity) return res;
+      const renewed = await args.identity.recover(token);
+      if (!renewed || renewed.token === token) return res;
+      await res.body?.cancel();
+      token = renewed.token;
     }
+  }
+  async function request(method, path111, body) {
+    const res = await authenticatedFetch(path111, {
+      method,
+      redirect: "error",
+      headers: {
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+      },
+      ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+    });
     const text = await res.text();
     let json = void 0;
     if (text) {
@@ -62266,8 +62286,8 @@ function createGithubApi(args) {
       const signal = AbortSignal.timeout(timeoutMs);
       let res;
       try {
-        res = await doFetch(`${API}/repos/${slug}/actions/artifacts/${artifactId}/zip`, {
-          headers: { Authorization: `Bearer ${args.token}`, Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" },
+        res = await authenticatedFetch(`/repos/${slug}/actions/artifacts/${artifactId}/zip`, {
+          headers: { Accept: "application/vnd.github+json", "X-GitHub-Api-Version": "2022-11-28" },
           redirect: "manual",
           signal
         });
@@ -62892,7 +62912,8 @@ function networkOptions(auth) {
   return auth?.source === "file" ? { prefix: [...QUIET_GIT_ARGS, "-c", "credential.helper=", "-c", `credential.helper=${INLINE_HELPER}`], env: { ...QUIET_GIT_ENV, CLAWD_GITHUB_TOKEN: auth.token } } : { prefix: [...QUIET_GIT_ARGS], env: QUIET_GIT_ENV };
 }
 async function networkGit(exec, dir, auth, args, what) {
-  const opts = networkOptions(auth);
+  const current = typeof auth === "function" ? await auth() : auth;
+  const opts = networkOptions(current);
   return mustGit(exec, dir, [...opts.prefix, ...args], what, { timeoutMs: 12e4, env: opts.env });
 }
 async function gitPush(exec, dir, auth, refspec = "HEAD:refs/heads/integration") {
@@ -63807,7 +63828,11 @@ function buildDeployHandlers(deps) {
   async function requireGithub() {
     const auth = await deps.githubIdentity.refresh();
     if (!auth) throw new ClawdError(ERROR_CODES.INTERNAL, NO_GITHUB_AUTH);
-    return { auth, api: deps.githubApi(auth.token) };
+    return { auth: async () => {
+      const current = await deps.githubIdentity.refresh();
+      if (!current) throw new ClawdError(ERROR_CODES.INTERNAL, NO_GITHUB_AUTH);
+      return current;
+    }, api: deps.githubApi(auth.token) };
   }
   function mustPersona(personaId2) {
     if (!deps.hasPersona(personaId2)) {
@@ -65032,13 +65057,82 @@ function createGithubIdentity(deps) {
   let pendingOauth = null;
   let staleCenterToken;
   const listeners = /* @__PURE__ */ new Set();
-  async function refresh() {
-    const mine = ++seq;
-    const resolved = await deps.resolve();
-    if (mine === seq) auth = resolved;
-    return resolved;
+  let managedToken;
+  const oauthCandidate = (token) => /^gh[ou]_/.test(token);
+  const oauthManaged = (token) => oauthCandidate(token) && (managedToken === token || deps.isManaged?.(token) === true);
+  let acquisition;
+  let centerFlight;
+  let centerCache;
+  let writes = Promise.resolve();
+  function remember(got) {
+    const expiry = got.expiresAt ? Date.parse(got.expiresAt) - 6e4 : Infinity;
+    centerCache = { token: got.token, until: Math.min(deps.now() + 2e4, expiry) };
+  }
+  function persist(token, generation, managed = false) {
+    const write = writes.catch(() => {
+    }).then(async () => {
+      if (generation !== seq) return;
+      const stored = await deps.store(token);
+      if (generation !== seq) return;
+      deps.markManaged?.(managed ? token : void 0);
+      managedToken = managed ? token : void 0;
+      auth = stored;
+      statusCache.clear();
+      pendingOauth = null;
+      for (const cb of listeners) cb();
+    });
+    writes = write;
+    return write;
+  }
+  async function syncCenter(local, rejectedToken) {
+    if (!oauthCandidate(local.token)) return local;
+    const managed = oauthManaged(local.token);
+    if (!rejectedToken && centerCache?.token === local.token && deps.now() < centerCache.until) return local;
+    if (centerFlight) return centerFlight;
+    const generation = seq;
+    const task = (async () => {
+      let got;
+      try {
+        got = await deps.oauth.token(rejectedToken);
+      } catch (err) {
+        if (managed) throw err;
+        return local;
+      }
+      if (generation !== seq) return auth;
+      if (!got || !managed && got.token !== local.token) {
+        remember({ token: local.token });
+        return local;
+      }
+      if (!managed || got.token !== local.token) await persist(got.token, generation, true);
+      if (generation !== seq) return auth;
+      remember(got);
+      return auth ?? local;
+    })().finally(() => {
+      if (centerFlight === task) centerFlight = void 0;
+    });
+    centerFlight = task;
+    return task;
+  }
+  function refresh() {
+    if (acquisition) return acquisition;
+    const generation = seq;
+    const task = (async () => {
+      const resolved = await deps.resolve();
+      if (generation !== seq) return auth;
+      auth = resolved;
+      return resolved ? syncCenter(resolved) : void 0;
+    })().finally(() => {
+      if (acquisition === task) acquisition = void 0;
+    });
+    acquisition = task;
+    return task;
+  }
+  async function recover(rejectedToken) {
+    const current = await refresh();
+    if (!current || current.token !== rejectedToken || !oauthManaged(current.token)) return current;
+    return syncCenter(current, rejectedToken);
   }
-  async function whoami(a2) {
+  async function whoami(a2, recovering = false) {
     const hit = statusCache.get(a2.token);
     if (hit && deps.now() - hit.at < cacheMs) return hit.status;
     let status2;
@@ -65046,19 +65140,26 @@ function createGithubIdentity(deps) {
       const { login } = await deps.api(a2.token).whoami();
       status2 = { status: "authorized", login, source: a2.source };
     } catch (err) {
+      if (!recovering && err instanceof GithubApiError && err.status === 401 && oauthManaged(a2.token)) {
+        try {
+          const renewed = await recover(a2.token);
+          if (renewed && renewed.token !== a2.token) return whoami(renewed, true);
+        } catch (recoveryError) {
+          return { status: "invalid", message: recoveryError instanceof Error ? recoveryError.message : String(recoveryError) };
+        }
+      }
       status2 = { status: "invalid", message: err instanceof Error ? err.message : String(err) };
     }
     statusCache.set(a2.token, { at: deps.now(), status: status2 });
     return status2;
   }
   async function adopt(token) {
-    auth = await deps.store(token);
-    seq++;
-    statusCache.clear();
-    pendingOauth = null;
-    for (const cb of listeners) cb();
+    const generation = ++seq;
+    centerCache = void 0;
+    await persist(token, generation);
   }
   async function claimCenterToken() {
+    const generation = seq;
     let got;
     try {
       got = await deps.oauth.token();
@@ -65072,7 +65173,9 @@ function createGithubIdentity(deps) {
       if (err instanceof GithubApiError && err.status === 401) staleCenterToken = got.token;
       return false;
     }
-    await adopt(got.token);
+    if (generation !== seq) return false;
+    await persist(got.token, ++seq, true);
+    remember(got);
     return true;
   }
   async function settlePendingOauth() {
@@ -65090,13 +65193,19 @@ function createGithubIdentity(deps) {
   }
   async function status() {
     await settlePendingOauth();
-    const a2 = await refresh();
+    let a2;
+    try {
+      a2 = await refresh();
+    } catch (err) {
+      return { status: "invalid", message: err instanceof Error ? err.message : String(err) };
+    }
     const current = a2 ? await whoami(a2) : { status: "missing" };
     return pendingOauth && current.status !== "authorized" ? { status: "pending", authUrl: pendingOauth.authUrl } : current;
   }
   return {
     cached: () => auth,
     refresh,
+    recover,
     status,
     adopt,
     async authorize(raw) {
@@ -65111,7 +65220,7 @@ function createGithubIdentity(deps) {
     },
     // 已有身份时重新授权；直接返回 pending 链接，不能经 status() 被旧的 authorized 状态遮掉。
     async oauthStart(returnTo) {
-      const local = await refresh();
+      const local = await deps.resolve();
       if (!local && await claimCenterToken()) return status();
       try {
         staleCenterToken = (await deps.oauth.token())?.token;
@@ -75363,7 +75472,7 @@ function computeMethodAccess(args) {
 }
 
 // src/version.ts
-var version = "0.2.686".length > 0 ? "0.2.686" : "dev";
+var version = "0.2.689".length > 0 ? "0.2.689" : "dev";
 
 // src/cli-probe/probe.ts
 var fs86 = __toESM(require("fs"), 1);
@@ -78051,7 +78160,14 @@ async function startDaemon(config) {
   const localSecretsDir = import_node_path89.default.join(config.dataDir, LOCAL_SECRETS_DIRNAME);
   const readSecrets = () => readSecretTable({ bundleRoot: secretsBundleRoot, overrideDir: localSecretsDir, logger });
   const githubTokenFile = import_node_path89.default.join(localSecretsDir, GITHUB_TOKEN_FILE);
+  const managedGithubVar = "CLAWD_GITHUB_MANAGED_TOKEN_SHA256";
+  const githubFingerprint = (token) => (0, import_node_crypto30.createHash)("sha256").update(token).digest("hex");
   const githubIdentity = createGithubIdentity({
+    isManaged: (token) => readEnvFileVar(githubTokenFile, managedGithubVar) === githubFingerprint(token),
+    markManaged: (token) => {
+      if (token) upsertEnvFileVar(githubTokenFile, managedGithubVar, githubFingerprint(token));
+      else removeEnvFileVar(githubTokenFile, managedGithubVar);
+    },
     resolve: () => resolveGithubAuth({ exec: runCommand, fileToken: () => readEnvFileVar(githubTokenFile, GITHUB_TOKEN_VAR) }),
     store: (token) => storeGithubAuth({
       exec: runCommand,
@@ -78073,19 +78189,23 @@ async function startDaemon(config) {
           throw new ClawdError(ERROR_CODES.INTERNAL, `\u5411\u4E2D\u5FC3\u8981 GitHub \u6388\u6743\u94FE\u63A5\u6CA1\u6210\uFF1A${err instanceof Error ? err.message : String(err)}`);
         }
       },
-      token: async () => {
+      token: async (rejectedToken) => {
         const r2 = ownerIdentityStore.read();
         if (!r2) return void 0;
-        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass });
+        return centralGithubAuthToken({ api: config.clawosApi ?? DEFAULT_CLAWOS_API, loginPass: r2.loginPass, ...rejectedToken ? { rejectedToken } : {} });
       }
     },
     now: () => Date.now(),
     logger
   });
-  void githubIdentity.refresh();
+  void githubIdentity.refresh().catch(() => {
+    logger.warn("github.identity.warm-failed");
+  });
   const resolvePersonaMcpConfig = (personaId2) => {
     const secrets = secretsWithGithubIdentity(readSecrets(), githubIdentity.cached());
-    void githubIdentity.refresh();
+    void githubIdentity.refresh().catch(() => {
+      logger.warn("github.identity.sync-failed");
+    });
     return renderPersonaMcpSecrets({
       personaId: personaId2,
       personaDir: import_node_path89.default.join(config.dataDir, "personas", personaId2),
@@ -78913,7 +79033,7 @@ async function startDaemon(config) {
       shiftStore,
       shiftOwnerIdProvider: () => ownerPrincipalId,
       // PR 收件箱：github:* handler spawn 本机 gh CLI，凭据是 clawd 的 GitHub 身份（GH_TOKEN），没有才是 gh 自己的登录态
-      ghRunner: createGhRunner({ token: () => githubIdentity.cached()?.token }),
+      ghRunner: createGhRunner({ token: async () => (await githubIdentity.refresh())?.token }),
       githubIdentity,
       visitorStore
     })
@@ -79023,7 +79143,7 @@ async function startDaemon(config) {
     fetchArtifact: downloadArtifact(runCommand),
     debianPackage: lookupDebianPackage(),
     githubIdentity,
-    githubApi: (token) => createGithubApi({ token }),
+    githubApi: (token) => createGithubApi({ token, identity: githubIdentity }),
     org: PERSONA_REPO_ORG,
     claimPublisher: async (personaId2, environment = "production") => {
       const loginPass = targetLoginPass(environment);