@follenfang/fupload 0.0.15 → 0.0.16

package/fupload/SKILL.md

@@ -2,7 +2,7 @@
 name: fupload
 description: Explicit author-publishing workflow for World of Warcraft plugins, configuration shares, and WA/strings on NewBeeBox, NetEase DD, CurseForge, Heybox Workshop, and ModUs.Creator, including local Creator login reuse and plugin ZIP publishing. Use only when the user explicitly invokes `$fupload`, explicitly asks to use the Fupload Skill, or loads this Skill by path. Do not trigger from ordinary mentions of publishing, NewBeeBox, DD, CurseForge, Heybox, ModUs, plugins, configurations, or WA.
 metadata:
-  version: "0.0.15"
+  version: "0.0.16"
 ---
 
 # Fupload
@@ -54,6 +54,8 @@ For NewBeeBox, prefer an existing official `ncc login`, then a caller-provided `
 
 For CurseForge, use `~/.fupload/curseforge.env`, created idempotently by npm install/update, with `CURSEFORGE_AUTHOR_ID`, `CURSEFORGE_API_KEY`, and `CURSEFORGE_UPLOAD_TOKEN`. The author ID is non-secret: if absent, proactively ask for its numeric value or offer `--author-id`. The API key and upload token are secrets: never ask the user to paste either into the conversation; direct them to fill the local env file in their own editor or terminal, then run `curseforge session doctor`. Never print file contents or secret values. Process environment values may override the file without being shown.
 
+For DD, reuse only the official client's local auto account and credential through `dd session start`. Never request or accept an email address, mobile number, password, token, credential value, or account-type override. Account and credential values must not appear in CLI output, plans, logs, tests, or analysis evidence; only the safe credential kind may be retained for diagnosis and verification.
+
 For ModUs, authentication comes only from `%LOCALAPPDATA%\ModUs.Creator\auth\token.dat` under the current Windows user. `modus session doctor` reports only token presence, DPAPI decryption, nonempty plaintext, and authenticated API readiness. Never print, copy, hash, or persist the token, ciphertext, Bearer header, or signed upload URL.
 
 If a token is pasted into the conversation, do not repeat or use it. Tell the user to revoke or regenerate it at its provider and configure the replacement locally. Check only whether the expected field is present, never its length, prefix, hash, or value.
@@ -107,8 +109,12 @@ For ModUs, require all four `modus session doctor` booleans to be true before an
 
 Before any DD live GET or write, run `dd session doctor`. If it reports `gui_running=true`, tell the user that continuing will close the listed official DD GUI instances and ask for explicit consent. Without consent, do not run start, do not close a process, and do not issue a native login. After consent, run `dd session start --confirm-close-gui`; when no GUI is running, run `dd session start` without that flag.
 
+`dd session start` automatically selects the native relogin flow from the official `Account.method`, `Cred.type`, and `Cred.modifier` enums. `urs + urs_token + normal` uses `UrsReLoginFlow` for an email session; `mobile + urs_mobile_token + mobile_password|mobile_uplink` uses `MobileReLoginFlow` for a mobile session. Missing, unknown, or contradictory combinations fail before any flow runs. Never infer the account kind from its text, coerce an enum, or try the other flow after a failure.
+
 Keep the returned opaque `session_id` only in task memory and pass it as `--session <id>` to every DD GET, write, readback, status, and delete. Reuse this one session for the complete task, serialize all commands, stop on the first failure, and never start one session per item in a batch. In a `finally` path, always run `dd session stop --session <id>` and require `cleanup_complete=true`; the ten-minute idle timeout is only an abnormal-exit fallback.
 
+Email and mobile differ only during native relogin. After a matching flow succeeds, both reuse the same JWT refresh, author API client, GET, upload, mutation, readback, logout, and cleanup path through that one task session.
+
 For every DD configuration, first list backups, select `backup_sn`, then run `dd config backup-get --sn <backup>`. Select a WTF account/server/role before presenting that account's known/unknown WA choices. For a retail configuration, present the safe edit-mode and cooldown selector metadata. Send only stable IDs and returned selectors; never request, display, store, or reconstruct raw backup objects or retail import strings.
 
 For a configuration, require a cloud backup already uploaded by the matching desktop client. If none exists, ask the user to upload one in the client and stop before writing.
@@ -147,6 +153,10 @@ For a Python delete, first run the resource `get` command, show the exact name a
 
 Run writes serially. For official `ncc`, always request `-o json`, parse stdout as JSON, and treat stderr only as progress diagnostics. For Python, parse its stable JSON output. Never scrape human text. After each successful step, immediately run the corresponding info/get/list/versions/history command and compare the intended fields in the same DD session when applicable. DD performs a bounded GET-only readback poll and never resends a mutation during verification. For DD plugin update, use a nonempty `/addon/addon_versions` result only as a pre-upload duplicate guard; the matching author-list item's `latest_version` is the primary success confirmation and `detail_v2` is supplementary. Plugin edit also uses the same-SN author projection when detail remains stale. An empty history is diagnostic-only. Treat “submitted for review” and “under review” as distinct from “approved” or “publicly visible.”
 
+When validating a DD authentication change, automated dispatch and constructor tests must cover every supported email and mobile enum combination, select exactly one matching flow with the correct arguments, and reject missing, unknown, or contradictory combinations without fallback. Exercise the shared JWT refresh, author API, resource, broker, sidecar, and logout path once through unified tests; do not require that common path to be repeated per credential kind.
+
+Run the full isolated live matrix only with the official client's currently persisted account and record its safe credential kind; do not switch the persisted account merely to repeat the matrix. For every current non-exploration seasonal build, read the dependency graph and complete plugin and WA create, update, edit, readback, binary upload, delete, and final cleanup. Complete the same configuration matrix, including image upload, only for builds where `/backup/list` and `/backup/detail` provide a usable cloud backup. Record an explicit safe `N/A` reason for every build without one; never silently skip it or fabricate a backup selector. Evidence must record the executed commands, exit status, readback, `N/A` items, implementation commit, DD version, resource hashes, and cleanup result while redacting account names, credential values, tokens, Cookies, JWTs, signed URLs, `clientNo`, raw WA strings, and raw backup content. Cleanup may touch only objects created by that test run, and the run must finish with no sidecar, task broker, or live broker state.
+
 For CurseForge, treat the Upload API's returned file ID as upload acceptance only. Record the ID and command result, then report that moderation, processing, manual release, and public visibility are separate states. On an interrupted or ambiguous upload, do not resend automatically because that can create a duplicate file; inspect the Authors project page or public file list before deciding on a new attempt. Follow the HTTP/error handling table in the CurseForge reference.
 
 In the third-party Python NewBeeBox channel, public plugin publication is three atomic writes: create privately, upload and verify the first version, then edit to public with explicit review intent. Never send a public `share_state` during Python create. In the official channel, follow the installed `ncc docs` sequence for create, init, push, and visibility instead of applying Python wire rules.

package/fupload/references/dd.md

@@ -2,11 +2,26 @@
 
 ## Task session
 
-Run `dd session doctor` first. Doctor only discovers the installation, verifies the Authenticode publisher, reports official DD processes and reads local broker state; it does not login. When `gui_running=true`, explain that the official DD GUI must close and obtain explicit user consent. Only then run `dd session start --confirm-close-gui`. When `gui_running=false`, run `dd session start` without the confirmation flag.
+Run `dd session doctor` first. Doctor only discovers the installation, verifies the Authenticode publisher, reports official DD processes and reads local broker state; it does not login or run either native relogin flow. When `gui_running=true`, explain that the official DD GUI must close and obtain explicit user consent. Only then run `dd session start --confirm-close-gui`. When `gui_running=false`, run `dd session start` without the confirmation flag.
 
-`start` closes only identity- and signature-verified official GUI processes, starts one task broker and returns an opaque `session_id`. Pass that value through `--session` to every DD read and write. All operations are serialized through one native login. Run `dd session status --session <id>` for a local status check and always run `dd session stop --session <id>` in `finally`; successful stop reports `cleanup_complete=true`. The ten-minute idle timeout is only a crash fallback.
+`start` closes only identity- and signature-verified official GUI processes, starts one task broker, and reads the official `AccountCredStorage` auto account and credential. It selects the native relogin flow only from this strict enum matrix:
 
-Do not request or expose token, Cookie, JWT, credential database, signed URL, `clientNo`, raw WA content, or raw backup objects. The device state remains under Windows Known Folder Roaming AppData at `CCVoiceHub/Fupload/sidecar-device.json`.
+- `Account.method=urs`, `Cred.type=urs_token`, `Cred.modifier=normal`: run `UrsReLoginFlow(controller, sdk, token, username)` for the email login state.
+- `Account.method=mobile`, `Cred.type=urs_mobile_token`, `Cred.modifier=mobile_password|mobile_uplink`: run `MobileReLoginFlow(controller, sdk, cgi, netconfig, token, isPassword, username)` for the mobile login state. `isPassword` is true only for `mobile_password`.
+
+Missing, unknown, or contradictory enum combinations fail before either flow is called. Do not infer account kind from the account string, coerce a value, or fall back to the other flow after a login failure. Do not request or accept manual account names, passwords, tokens, credential values, or account-type overrides.
+
+After the selected flow succeeds, both credential kinds use the same JWT refresh, author API client, GET, parser, upload, mutation, readback, logout, and cleanup path. `start` returns an opaque `session_id`; pass it through `--session` to every DD read and write. All operations are serialized through this one task session and one native login. Run `dd session status --session <id>` for a local status check and always run `dd session stop --session <id>` in `finally`; successful stop reports `cleanup_complete=true`. The ten-minute idle timeout is only a crash fallback.
+
+Do not request or expose account names, credential values, tokens, Cookies, JWTs, the credential database, signed URLs, `clientNo`, raw WA content, or raw backup objects. The safe credential kind may be reported without its account identity or value. The device state remains under Windows Known Folder Roaming AppData at `CCVoiceHub/Fupload/sidecar-device.json`.
+
+## Authentication compatibility verification
+
+Any change to DD authentication or session dispatch requires automated tests for every supported email and mobile enum combination. Each case must select exactly one matching flow, verify its constructor arguments, and reject missing, unknown, or contradictory combinations before login without fallback. Unified tests cover the common JWT refresh, author API client, resource operations, single broker/sidecar/login lifecycle, and explicit logout path after dispatch; this common path does not need to be repeated per credential kind.
+
+Run the full isolated live matrix only under the account currently persisted by the official DD client, and record its safe credential kind. Do not switch that account merely to repeat the matrix for another credential kind. In one task session, read the live dependency graph for every current non-exploration seasonal build, then cover plugin and WA create, update, edit, readback, binary upload, delete, and final cleanup. For configuration, run the same CRUD, image-upload, readback, and cleanup matrix on every build where `/backup/list` returns a cloud backup whose `/backup/detail` supports valid selections. When a build has no usable cloud backup, record an explicit safe `N/A` reason; never silently skip it or fabricate a backup selector.
+
+Verification evidence may contain only the safe credential kind, executed command, exit status, readback result, `N/A` items, implementation commit, DD version, resource hashes, and cleanup result. Redact account names, credential values, passwords, tokens, Cookies, JWTs, signed URLs, `clientNo`, signatures, device proofs, raw WA strings, and raw configuration backup content. Cleanup may remove only the isolated objects recorded as created by that run; do not modify pre-existing remote resources. A completed, failed, or timed-out run must verify that no DD sidecar, task broker, or live broker state remains.
 
 ## GET before one final JSON
 

package/fupload/scripts/fupload_cli/__init__.py

@@ -1,3 +1,3 @@
 """Fupload Python CLI."""
 
-__version__ = "0.0.15"
+__version__ = "0.0.16"

package/fupload/scripts/fupload_cli/dd.py

@@ -245,6 +245,7 @@ class Sidecar:
         self.dd_dir, self.signature = discover_dd_info()
         self.process: Optional[subprocess.Popen[str]] = None
         self.counter = 0
+        self.credential_kind: Optional[str] = None
         self.lock_handle = None
         self.responses: queue.Queue[Any] = queue.Queue()
         self.reader_thread: Optional[threading.Thread] = None
@@ -276,6 +277,15 @@ class Sidecar:
                 kind="authentication_error",
                 stage="session",
             )
+        credential_kind = ready.get("credential_kind")
+        if credential_kind not in ("email", "mobile"):
+            self.close()
+            raise FuploadError(
+                "DD sidecar returned an invalid credential kind",
+                kind="sidecar_error",
+                stage="session",
+            )
+        self.credential_kind = credential_kind
         return self
 
     def _lock(self) -> None:
@@ -1781,6 +1791,13 @@ def config_readback_projection(value: Any) -> Mapping[str, Any]:
     projected = dict(value)
     if "need_buy" in projected:
         projected["need_buy"] = 1 if projected["need_buy"] else 0
+    for name in ("known_addon", "unknown_addon", "material", "font", "known_wa", "unknown_wa"):
+        if projected.get(name) is None:
+            projected[name] = {"items": [], "inner_version": {}}
+    if projected.get("wtf") is None:
+        projected["wtf"] = {"accounts": []}
+    if projected.get("vip_levels") is None:
+        projected["vip_levels"] = []
     return projected
 
 

package/fupload/scripts/fupload_cli/dd_broker.py

@@ -415,6 +415,10 @@ def start(confirm_close_gui: bool) -> Dict[str, Any]:
             "running": True,
             "reused": True,
             "login_count": active.get("login_count", 1),
+            "broker_count": active.get("broker_count", 1),
+            "sidecar_count": active.get("sidecar_count", 1),
+            "native_login_count": active.get("native_login_count", 1),
+            "credential_kind": active.get("credential_kind"),
         }
     processes = running_dd_processes()
     if processes and not confirm_close_gui:
@@ -452,6 +456,10 @@ def start(confirm_close_gui: bool) -> Dict[str, Any]:
                 "running": True,
                 "reused": False,
                 "login_count": 1,
+                "broker_count": state.get("broker_count", 1),
+                "sidecar_count": state.get("sidecar_count", 1),
+                "native_login_count": state.get("native_login_count", 1),
+                "credential_kind": state.get("credential_kind"),
                 "closed_gui_processes": len(processes),
             }
         if startup.exists():
@@ -575,6 +583,10 @@ def _serve(startup_id: str) -> int:
         sidecar = _dd_module().Sidecar().__enter__()
         state["dd_dir"] = str(sidecar.dd_dir)
         state["signature"] = sidecar.signature
+        state["credential_kind"] = sidecar.credential_kind
+        state["broker_count"] = 1
+        state["sidecar_count"] = 1
+        state["native_login_count"] = 1
         _atomic_json(state_path, state)
         try:
             startup_path.unlink()
@@ -603,6 +615,10 @@ def _serve(startup_id: str) -> int:
                             "started_at": started_at,
                             "last_activity": last_activity,
                             "login_count": 1,
+                            "broker_count": state.get("broker_count", 1),
+                            "sidecar_count": state.get("sidecar_count", 1),
+                            "native_login_count": state.get("native_login_count", 1),
+                            "credential_kind": state.get("credential_kind"),
                             "dd_dir": state.get("dd_dir"),
                             "signature": state.get("signature"),
                         }

package/fupload/scripts/fupload_cli/dd_sidecar.py

@@ -551,10 +551,52 @@ def wait_until(qt, predicate, timeout):
     return bool(predicate())
 
 
+def _enum_name(value):
+    name = getattr(value, "name", None)
+    return name if isinstance(name, str) else None
+
+
+def _create_relogin_flow(
+    account, credential, controller, sdk, cgi, netconfig,
+    urs_flow_class, mobile_flow_class,
+):
+    method = _enum_name(getattr(account, "method", None))
+    credential_type = _enum_name(getattr(credential, "type", None))
+    modifier = _enum_name(getattr(credential, "modifier", None))
+
+    if (method, credential_type, modifier) == ("urs", "urs_token", "normal"):
+        return urs_flow_class(controller, sdk, credential.value, account.name)
+    if (
+        method == "mobile"
+        and credential_type == "urs_mobile_token"
+        and modifier in ("mobile_password", "mobile_uplink")
+    ):
+        return mobile_flow_class(
+            controller, sdk, cgi, netconfig, credential.value,
+            modifier == "mobile_password", account.name,
+        )
+    raise RuntimeError("DD persisted login state uses an unsupported credential combination")
+
+
+def _credential_kind(account, credential):
+    method = _enum_name(getattr(account, "method", None))
+    credential_type = _enum_name(getattr(credential, "type", None))
+    modifier = _enum_name(getattr(credential, "modifier", None))
+    if (method, credential_type, modifier) == ("urs", "urs_token", "normal"):
+        return "email"
+    if (
+        method == "mobile"
+        and credential_type == "urs_mobile_token"
+        and modifier in ("mobile_password", "mobile_uplink")
+    ):
+        return "mobile"
+    raise RuntimeError("DD persisted login state uses an unsupported credential combination")
+
+
 def open_session(timeout=45):
     from cli_anything.ccvoicehub.core.container import ContainerManager
     from cli_anything.ccvoicehub.core.qt_runtime import QtRuntime
-    from components.login.flow import MobileReLoginFlow
+    from components.login.flow import MobileReLoginFlow, UrsReLoginFlow
     import components.login.login_controller as login_controller_module
     import logger.cclogger as cclogger
 
@@ -562,7 +604,7 @@ def open_session(timeout=45):
     container = ContainerManager.get_container()
     storage = container.get_instance("AccountCredStorage")
     account = storage.getAutoAccount()
-    credential = storage.getCred(account)
+    credential = storage.getCred(account) if account else None
     if not account or not credential:
         raise RuntimeError("DD has no persisted credential; sign in with the desktop client first")
     cclogger.renameLogAfterLogin = lambda *_args, **_kwargs: None
@@ -581,11 +623,12 @@ def open_session(timeout=45):
         state["jwt"] = True
 
     jwt_helper.sigJwtUpdated.connect(jwt_result)
-    flow = MobileReLoginFlow(
-        controller, container.get_instance("UrsSDK"), container.get_instance("CgiHelper"),
-        container.get_instance("NetConfig"), credential.value,
-        credential.modifier.name == "mobile_password", account.name,
+    flow = _create_relogin_flow(
+        account, credential, controller,
+        container.get_instance("UrsSDK"), container.get_instance("CgiHelper"),
+        container.get_instance("NetConfig"), UrsReLoginFlow, MobileReLoginFlow,
     )
+    flow._fupload_credential_kind = _credential_kind(account, credential)
     flow.sigResult.connect(login_result)
     flow.start()
     if not wait_until(qt, lambda: state["done"], timeout) or not state["ok"]:
@@ -610,6 +653,12 @@ def api_result(payload):
     return payload.get("result") if isinstance(payload, dict) else None
 
 
+def _retryable_get_signature_rejection(payload):
+    if not isinstance(payload, dict) or payload.get("code") != 409:
+        return False
+    return str(payload.get("msg") or payload.get("message") or "").strip() == "签名无效"
+
+
 def _native_json(value):
     to_json = getattr(value, "toJson", None)
     if callable(to_json):
@@ -673,7 +722,13 @@ def run_command(session, command):
             method = command.get("method", "GET").upper()
             path = command["path"]
             params = command.get("payload") or {}
-            response_payload = client.get(path, params) if method == "GET" else client.post(path, params)
+            if method == "GET":
+                response_payload = client.get(path, params)
+                if _retryable_get_signature_rejection(response_payload):
+                    client._fupload_last_response_error = None
+                    response_payload = client.get(path, params)
+            else:
+                response_payload = client.post(path, params)
             if isinstance(response_payload, dict) and response_payload.get("code") not in (None, 0):
                 rejected_payload = response_payload
                 response_probe = getattr(client, "_fupload_last_response_error", None)
@@ -831,7 +886,11 @@ def main():
     session = None
     try:
         session = open_session()
-        output({"ready": True, "device_state_created": created})
+        output({
+            "ready": True,
+            "device_state_created": created,
+            "credential_kind": getattr(session[2], "_fupload_credential_kind", None),
+        })
         for line in sys.stdin:
             if not line.strip():
                 continue

package/fupload/scripts/fupload_cli/io.py

@@ -93,7 +93,9 @@ def sanitize_output(value: Any) -> Any:
         result: Dict[str, Any] = {}
         for key, item in value.items():
             normalized = str(key).replace("-", "_").lower()
-            if normalized in {"token_present", "token_decrypted", "token_nonempty", "api_ready"} and isinstance(item, bool):
+            if normalized == "credential_kind" and item in {"email", "mobile"}:
+                result[key] = item
+            elif normalized in {"token_present", "token_decrypted", "token_nonempty", "api_ready"} and isinstance(item, bool):
                 result[key] = item
             elif normalized in _SENSITIVE_KEYS or any(
                 marker in normalized

package/npm/skill-manifest.json

@@ -1,9 +1,9 @@
 {
   "schema": "fupload.npm-skill-manifest.v1",
   "package_name": "@follenfang/fupload",
-  "package_version": "0.0.15",
-  "skill_version": "0.0.15",
-  "tree_sha256": "cfccc3347d2013188a37b120b94282c839ad81eb4fa92f8617e0cfa12dfbbaef",
+  "package_version": "0.0.16",
+  "skill_version": "0.0.16",
+  "tree_sha256": "aba774b14679854ac01a09711aa10b2f7266af2c43e8220cc67c64b9559bfb51",
   "files": [
     {
       "path": "agents/openai.yaml",
@@ -87,8 +87,8 @@
     },
     {
       "path": "references/dd.md",
-      "bytes": 16543,
-      "sha256": "782d7c89d865df545fb6ffe4d7ee4492e6e5b192a3f71e4aef6424183a6a4f24"
+      "bytes": 19727,
+      "sha256": "2804e4b77c000d0bd12ca3f69bbcd5720f759fd4e84b4127ea3461093bf5da7c"
     },
     {
       "path": "references/modus.md",
@@ -113,7 +113,7 @@
     {
       "path": "scripts/fupload_cli/__init__.py",
       "bytes": 50,
-      "sha256": "9159fa55aa8ef07864abf206b64aabd44ea78c2e987ead8b51ec9384b5d1cebf"
+      "sha256": "f0d2cbd76206a61d5fd78eef58ad808108f9538963da2c0ea67df79c8a41e104"
     },
     {
       "path": "scripts/fupload_cli/blackbox_web.py",
@@ -137,18 +137,18 @@
     },
     {
       "path": "scripts/fupload_cli/dd_broker.py",
-      "bytes": 26638,
-      "sha256": "a23fb486dd1ca9d0a1d2f2ca642690535a28e05051ce828ce066cdbc67b37b37"
+      "bytes": 27637,
+      "sha256": "1ba00dcaea80905769bb2e00a6e965f2a1e9bb46a33534d1e77a6564158605a8"
     },
     {
       "path": "scripts/fupload_cli/dd_sidecar.py",
-      "bytes": 35279,
-      "sha256": "255b9cb5af61b0dc6ecdda53ed3139068f5747b63909071f75ee9a5f29277be6"
+      "bytes": 37603,
+      "sha256": "6ad1ab9e2145757f44b410d87d554485566812d9584820180ff3bb7b5bc7763a"
     },
     {
       "path": "scripts/fupload_cli/dd.py",
-      "bytes": 113135,
-      "sha256": "e89538e64f408aa17db212d68d0e7473d9071678e5c8b46eda5b3d5a3f73e9bd"
+      "bytes": 113914,
+      "sha256": "31e349cfee243c1ae8afefd74acfe3f5d79771a1c23ed1892aaf9d8e9b416922"
     },
     {
       "path": "scripts/fupload_cli/errors.py",
@@ -157,8 +157,8 @@
     },
     {
       "path": "scripts/fupload_cli/io.py",
-      "bytes": 5319,
-      "sha256": "57af3921d016815ed5747788881f86c8a6ce04a939e9f6f6571bd6a3f7383a4d"
+      "bytes": 5436,
+      "sha256": "4e5929f80223493057244613caf23575275c5838bf6505da0f3b01c5bae791da"
     },
     {
       "path": "scripts/fupload_cli/modus_zip.py",
@@ -207,8 +207,8 @@
     },
     {
       "path": "SKILL.md",
-      "bytes": 25720,
-      "sha256": "fae17edc0a59ea74dc70a5744b5aef46a057c23a9056e6d6b1e60990fa54782f"
+      "bytes": 28383,
+      "sha256": "2477e603ca826b9bd31533995f2217bfd9239c070adbaa2aa4b829fb6a89fb7f"
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@follenfang/fupload",
-  "version": "0.0.15",
+  "version": "0.0.16",
   "description": "Install and run the Fuploader Agent Skill and Python CLI.",
   "type": "module",
   "bin": {