@playcraft/cli 0.0.39 → 0.0.40

package/dist/commands/fix-ids.js

@@ -2,15 +2,29 @@
  * fix-ids 命令：修复已导入项目的 ID 映射（将 Sandbox 中的 PlayCanvas ID 转换为 PlayCraft numericId）
  */
 import pc from 'picocolors';
+import { loadGlobalConfig } from '../config.js';
+import { DEFAULT_PLAYCRAFT_CLOUD_BASE } from './login.js';
 export async function fixIdsCommand(options) {
     const { projectId, apiUrl, token } = options;
-    const baseUrl = (apiUrl || process.env.BACKEND_API_URL || process.env.PLAYCRAFT_URL || 'http://localhost:3001').replace(/\/+$/, '');
+    const globalConfig = loadGlobalConfig();
+    // 优先级：CLI 参数 → 环境变量 → login 保存的全局配置 → 默认云端地址
+    const resolvedUrl = (apiUrl ||
+        process.env.BACKEND_API_URL ||
+        process.env.PLAYCRAFT_URL ||
+        globalConfig.backendUrl ||
+        globalConfig.url ||
+        DEFAULT_PLAYCRAFT_CLOUD_BASE).replace(/\/+$/, '');
+    const baseUrl = resolvedUrl;
     const url = `${baseUrl}/api/projects/${encodeURIComponent(projectId)}/fix-ids`;
+    // 优先级：CLI 参数 → 环境变量 → login 保存的全局 token
+    const resolvedToken = token ||
+        process.env.PLAYCRAFT_TOKEN ||
+        globalConfig.token;
     const headers = {
         'Content-Type': 'application/json',
     };
-    if (token || process.env.PLAYCRAFT_TOKEN) {
-        headers['Authorization'] = `Bearer ${token || process.env.PLAYCRAFT_TOKEN}`;
+    if (resolvedToken) {
+        headers['Authorization'] = `Bearer ${resolvedToken}`;
     }
     if (process.env.NEXT_PUBLIC_LOCAL_AUTH_BYPASS === 'true' && process.env.NEXT_PUBLIC_LOCAL_USER) {
         headers['X-Local-User'] = process.env.NEXT_PUBLIC_LOCAL_USER;

package/dist/commands/fix-ids.test.js

@@ -0,0 +1,264 @@
+/**
+ * fix-ids 命令测试
+ *
+ * 覆盖：
+ * - URL 优先级：CLI 参数 → BACKEND_API_URL → PLAYCRAFT_URL → globalConfig.backendUrl →
+ *               globalConfig.url → DEFAULT_PLAYCRAFT_CLOUD_BASE
+ * - Token 优先级：CLI 参数 → PLAYCRAFT_TOKEN → globalConfig.token
+ * - 成功/失败分支
+ * - 本地开发鉴权绕过（X-Local-User）
+ */
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi, } from 'vitest';
+import http from 'node:http';
+// ─── Mock loadGlobalConfig ────────────────────────────────────────────────────
+vi.mock('../config.js', () => ({
+    loadGlobalConfig: vi.fn(() => ({})),
+    saveGlobalConfig: vi.fn(),
+    loadConfig: vi.fn(),
+}));
+import { loadGlobalConfig } from '../config.js';
+import { fixIdsCommand } from './fix-ids.js';
+import { DEFAULT_PLAYCRAFT_CLOUD_BASE } from './login.js';
+let server;
+let baseUrl;
+let lastRequest;
+let responseStatus = 200;
+let responseBody = { success: true };
+beforeAll(async () => {
+    server = http.createServer((req, res) => {
+        lastRequest = {
+            url: req.url ?? '',
+            method: req.method ?? '',
+            headers: req.headers,
+        };
+        res.writeHead(responseStatus, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify(responseBody));
+    });
+    await new Promise((resolve) => {
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const addr = server.address();
+    baseUrl = `http://127.0.0.1:${addr.port}`;
+});
+afterAll(async () => {
+    await new Promise((resolve) => server.close(() => resolve()));
+});
+beforeEach(() => {
+    lastRequest = null;
+    responseStatus = 200;
+    responseBody = { success: true };
+    vi.mocked(loadGlobalConfig).mockReturnValue({});
+    // 清理鉴权绕过相关环境变量
+    delete process.env.BACKEND_API_URL;
+    delete process.env.PLAYCRAFT_URL;
+    delete process.env.PLAYCRAFT_TOKEN;
+    delete process.env.NEXT_PUBLIC_LOCAL_AUTH_BYPASS;
+    delete process.env.NEXT_PUBLIC_LOCAL_USER;
+});
+afterEach(() => {
+    delete process.env.BACKEND_API_URL;
+    delete process.env.PLAYCRAFT_URL;
+    delete process.env.PLAYCRAFT_TOKEN;
+    delete process.env.NEXT_PUBLIC_LOCAL_AUTH_BYPASS;
+    delete process.env.NEXT_PUBLIC_LOCAL_USER;
+});
+// ─── URL resolution tests ─────────────────────────────────────────────────────
+describe('URL 优先级', () => {
+    it('明确传入 --api-url 时优先使用 CLI 参数', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            backendUrl: 'http://should-not-use.example.com',
+        });
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+        // 确保确实打到了我们的测试服务器
+        expect(lastRequest?.method).toBe('POST');
+    });
+    it('无 CLI 参数时从 BACKEND_API_URL 环境变量读取 URL', async () => {
+        process.env.BACKEND_API_URL = baseUrl;
+        await fixIdsCommand({ projectId: '123' });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('无 BACKEND_API_URL 时从 PLAYCRAFT_URL 环境变量读取 URL', async () => {
+        process.env.PLAYCRAFT_URL = baseUrl;
+        await fixIdsCommand({ projectId: '123' });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('环境变量均未设置时，从全局配置 backendUrl 读取', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({ backendUrl: baseUrl });
+        await fixIdsCommand({ projectId: '123' });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('backendUrl 未设置时，从全局配置 url 读取', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({ url: baseUrl });
+        await fixIdsCommand({ projectId: '123' });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('所有来源均未设置时，回退到 DEFAULT_PLAYCRAFT_CLOUD_BASE（不打本地服务器）', async () => {
+        // 确认默认地址指向公有云，不含 localhost
+        expect(DEFAULT_PLAYCRAFT_CLOUD_BASE).toMatch(/^https:\/\//);
+        expect(DEFAULT_PLAYCRAFT_CLOUD_BASE).not.toContain('localhost');
+        expect(DEFAULT_PLAYCRAFT_CLOUD_BASE).not.toContain('127.0.0.1');
+        expect(DEFAULT_PLAYCRAFT_CLOUD_BASE).not.toContain(':3001');
+    });
+    it('CLI 参数 > 环境变量 > 全局配置（优先级链路）', async () => {
+        process.env.BACKEND_API_URL = 'http://should-not-use-env.example.com';
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            backendUrl: 'http://should-not-use-config.example.com',
+        });
+        // CLI 参数最高优先级：打到我们的测试服务器
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('URL 尾部 slash 会被正确去除', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({ url: `${baseUrl}/` });
+        await fixIdsCommand({ projectId: '123' });
+        expect(lastRequest?.url).toBe('/api/projects/123/fix-ids');
+    });
+    it('projectId 含特殊字符时被正确 encodeURIComponent', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({ url: baseUrl });
+        await fixIdsCommand({ projectId: 'abc/def' });
+        expect(lastRequest?.url).toBe('/api/projects/abc%2Fdef/fix-ids');
+    });
+});
+// ─── Token / auth tests ───────────────────────────────────────────────────────
+describe('Token 优先级', () => {
+    it('明确传入 --token 时优先使用 CLI 参数', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            url: baseUrl,
+            token: 'global-token',
+        });
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl, token: 'cli-token' });
+        expect(lastRequest?.headers['authorization']).toBe('Bearer cli-token');
+    });
+    it('CLI 未传 token，从 PLAYCRAFT_TOKEN 环境变量读取', async () => {
+        process.env.PLAYCRAFT_TOKEN = 'env-token';
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            url: baseUrl,
+            token: 'global-token-should-not-use',
+        });
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['authorization']).toBe('Bearer env-token');
+    });
+    it('环境变量未设置时，从全局配置 token 读取（login 保存的 PAT）', async () => {
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            url: baseUrl,
+            token: 'playcraft_pat_from_login',
+        });
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['authorization']).toBe('Bearer playcraft_pat_from_login');
+    });
+    it('三者均未设置时不带 Authorization header', async () => {
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['authorization']).toBeUndefined();
+    });
+    it('CLI 参数 > 环境变量 > 全局配置（token 优先级链路）', async () => {
+        process.env.PLAYCRAFT_TOKEN = 'env-token-should-not-use';
+        vi.mocked(loadGlobalConfig).mockReturnValue({
+            url: baseUrl,
+            token: 'global-token-should-not-use',
+        });
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl, token: 'cli-wins' });
+        expect(lastRequest?.headers['authorization']).toBe('Bearer cli-wins');
+    });
+});
+// ─── 本地开发鉴权绕过 ────────────────────────────────────────────────────────
+describe('本地开发鉴权绕过（X-Local-User）', () => {
+    it('NEXT_PUBLIC_LOCAL_AUTH_BYPASS=true 时附加 X-Local-User header', async () => {
+        process.env.NEXT_PUBLIC_LOCAL_AUTH_BYPASS = 'true';
+        process.env.NEXT_PUBLIC_LOCAL_USER = 'admin@example.com';
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['x-local-user']).toBe('admin@example.com');
+    });
+    it('NEXT_PUBLIC_LOCAL_AUTH_BYPASS 未设置时不附加 X-Local-User', async () => {
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['x-local-user']).toBeUndefined();
+    });
+    it('NEXT_PUBLIC_LOCAL_AUTH_BYPASS=false 时不附加 X-Local-User', async () => {
+        process.env.NEXT_PUBLIC_LOCAL_AUTH_BYPASS = 'false';
+        process.env.NEXT_PUBLIC_LOCAL_USER = 'user@example.com';
+        await fixIdsCommand({ projectId: '123', apiUrl: baseUrl });
+        expect(lastRequest?.headers['x-local-user']).toBeUndefined();
+    });
+});
+// ─── 成功 / 失败分支 ─────────────────────────────────────────────────────────
+describe('成功/失败响应处理', () => {
+    it('成功时不抛出异常', async () => {
+        responseBody = { success: true };
+        await expect(fixIdsCommand({ projectId: '123', apiUrl: baseUrl })).resolves.toBeUndefined();
+    });
+    it('HTTP 4xx 时调用 process.exit(1)', async () => {
+        responseStatus = 401;
+        responseBody = { message: 'Unauthorized' };
+        const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {
+            throw new Error('process.exit called');
+        }));
+        await expect(fixIdsCommand({ projectId: '123', apiUrl: baseUrl })).rejects.toThrow('process.exit called');
+        expect(mockExit).toHaveBeenCalledWith(1);
+        mockExit.mockRestore();
+    });
+    it('HTTP 500 时调用 process.exit(1)', async () => {
+        responseStatus = 500;
+        responseBody = { message: 'Internal Server Error' };
+        const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {
+            throw new Error('process.exit called');
+        }));
+        await expect(fixIdsCommand({ projectId: '123', apiUrl: baseUrl })).rejects.toThrow('process.exit called');
+        expect(mockExit).toHaveBeenCalledWith(1);
+        mockExit.mockRestore();
+    });
+    it('响应 success 字段为 false 时调用 process.exit(1)', async () => {
+        responseStatus = 200;
+        responseBody = { success: false };
+        const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {
+            throw new Error('process.exit called');
+        }));
+        await expect(fixIdsCommand({ projectId: '123', apiUrl: baseUrl })).rejects.toThrow('process.exit called');
+        expect(mockExit).toHaveBeenCalledWith(1);
+        mockExit.mockRestore();
+    });
+    it('网络错误时调用 process.exit(1)', async () => {
+        const mockExit = vi.spyOn(process, 'exit').mockImplementation((() => {
+            throw new Error('process.exit called');
+        }));
+        // 使用一个必定拒绝连接的地址
+        await expect(fixIdsCommand({ projectId: '123', apiUrl: 'http://127.0.0.1:1' })).rejects.toThrow('process.exit called');
+        expect(mockExit).toHaveBeenCalledWith(1);
+        mockExit.mockRestore();
+    });
+});
+// ─── AgentApiClient 凭证验证（无 localhost 默认）────────────────────────────
+describe('AgentApiClient 凭证行为', () => {
+    it('PLAYCRAFT_API_URL / PLAYCRAFT_SANDBOX_TOKEN 均未设置时抛出 Missing credentials 错误', async () => {
+        const origApiUrl = process.env.PLAYCRAFT_API_URL;
+        const origSandboxToken = process.env.PLAYCRAFT_SANDBOX_TOKEN;
+        delete process.env.PLAYCRAFT_API_URL;
+        delete process.env.PLAYCRAFT_SANDBOX_TOKEN;
+        const { AgentApiClient } = await import('../utils/agent-api-client.js');
+        expect(() => new AgentApiClient()).toThrow(/Missing PlayCraft API credentials/);
+        if (origApiUrl !== undefined)
+            process.env.PLAYCRAFT_API_URL = origApiUrl;
+        if (origSandboxToken !== undefined)
+            process.env.PLAYCRAFT_SANDBOX_TOKEN = origSandboxToken;
+    });
+    it('AgentApiClient 不使用 localhost:3001 作为默认地址', async () => {
+        const origApiUrl = process.env.PLAYCRAFT_API_URL;
+        const origSandboxToken = process.env.PLAYCRAFT_SANDBOX_TOKEN;
+        delete process.env.PLAYCRAFT_API_URL;
+        delete process.env.PLAYCRAFT_SANDBOX_TOKEN;
+        const { AgentApiClient } = await import('../utils/agent-api-client.js');
+        let errorMessage = '';
+        try {
+            new AgentApiClient();
+        }
+        catch (e) {
+            errorMessage = e instanceof Error ? e.message : String(e);
+        }
+        // 错误信息不应包含 localhost 地址 —— 不存在隐式降级到本地
+        expect(errorMessage).not.toContain('localhost');
+        expect(errorMessage).not.toContain('127.0.0.1');
+        if (origApiUrl !== undefined)
+            process.env.PLAYCRAFT_API_URL = origApiUrl;
+        if (origSandboxToken !== undefined)
+            process.env.PLAYCRAFT_SANDBOX_TOKEN = origSandboxToken;
+    });
+});

package/dist/commands/login.js

@@ -6,6 +6,7 @@ import { saveGlobalConfig, loadGlobalConfig } from '../config.js';
 export const DEFAULT_PLAYCRAFT_CLOUD_BASE = 'https://playcraft.aix.intlgame.com';
 const CALLBACK_PORT = 3456;
 const TIMEOUT_MS = 5 * 60 * 1000;
+const PAT_PREFIX = 'playcraft_pat_';
 function escapeHtml(text) {
     return text
         .replace(/&/g, '&')
@@ -45,8 +46,54 @@ function resolveLoginBaseUrl(options) {
         DEFAULT_PLAYCRAFT_CLOUD_BASE;
     return raw.replace(/\/+$/, '');
 }
+export function createTokenHash(token) {
+    return crypto.createHash('sha256').update(token).digest('hex');
+}
+export function buildCliAuthUrl(options) {
+    const url = new URL('/cli-auth', options.backendUrl);
+    url.searchParams.set('callback', options.callbackUrl);
+    url.searchParams.set('state', options.state);
+    if (options.existingToken?.startsWith(PAT_PREFIX)) {
+        url.searchParams.set('existingTokenHash', createTokenHash(options.existingToken));
+    }
+    return url.toString();
+}
+export async function renewExistingToken(options) {
+    if (!options.token.startsWith(PAT_PREFIX)) {
+        return false;
+    }
+    const fetchFn = options.fetchFn ?? fetch;
+    try {
+        const res = await fetchFn(`${options.backendUrl}/api/settings/personal-access-tokens/current/renew`, {
+            method: 'PATCH',
+            headers: {
+                Authorization: `Bearer ${options.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ expiresIn: '365d' }),
+        });
+        return res.ok;
+    }
+    catch {
+        return false;
+    }
+}
 export async function loginCommand(options) {
     const backendUrl = resolveLoginBaseUrl(options);
+    const globalConfig = loadGlobalConfig();
+    const existingToken = typeof globalConfig.token === 'string' ? globalConfig.token : undefined;
+    if (existingToken) {
+        const renewed = await renewExistingToken({ backendUrl, token: existingToken });
+        if (renewed) {
+            saveGlobalConfig({
+                token: existingToken,
+                url: backendUrl,
+                backendUrl,
+            });
+            console.log('Existing CLI token renewed. Token saved to ~/.playcraft/config.json');
+            return;
+        }
+    }
     const state = crypto.randomBytes(16).toString('hex');
     return new Promise((resolve, reject) => {
         const server = http.createServer((req, res) => {
@@ -72,8 +119,14 @@ export async function loginCommand(options) {
                             });
                             return;
                         }
+                        const callbackToken = typeof data.token === 'string' ? data.token : undefined;
+                        const renewedToken = data.renewed === true ? existingToken : undefined;
+                        const tokenToSave = callbackToken || renewedToken;
+                        if (!tokenToSave) {
+                            throw new Error('Login callback did not include a token');
+                        }
                         saveGlobalConfig({
-                            token: data.token,
+                            token: tokenToSave,
                             url: backendUrl,
                             backendUrl,
                         });
@@ -124,7 +177,12 @@ export async function loginCommand(options) {
         try {
             server.listen(CALLBACK_PORT, () => {
                 const callbackUrl = `http://localhost:${CALLBACK_PORT}/callback`;
-                const authUrl = `${backendUrl}/cli-auth?callback=${encodeURIComponent(callbackUrl)}&state=${state}`;
+                const authUrl = buildCliAuthUrl({
+                    backendUrl,
+                    callbackUrl,
+                    state,
+                    existingToken,
+                });
                 console.log('Opening browser for login...');
                 console.log(`If the browser does not open, visit this URL manually:\n  ${authUrl}\n`);
                 openBrowser(authUrl);

package/dist/index.js

@@ -127,7 +127,7 @@ program
     .command('fix-ids')
     .description('修复已导入项目的 ID 映射（PlayCanvas ID → PlayCraft numericId）')
     .argument('<project-id>', '项目 ID（numericId 或 UUID）')
-    .option('--api-url <url>', '后端 API 地址', process.env.BACKEND_API_URL || 'http://localhost:3001')
+    .option('--api-url <url>', '后端 API 地址（默认从 login 配置读取，未登录时使用 https://playcraft.aix.intlgame.com）')
     .option('--token <token>', '认证令牌（可选）')
     .action(async (projectId, options) => {
     await fixIdsCommand({

package/dist/utils/agent-api-client.js

@@ -1,27 +1,59 @@
 import { readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
+import { loadGlobalConfig } from '../config.js';
+import { DEFAULT_PLAYCRAFT_CLOUD_BASE } from '../commands/login.js';
 /**
- * Lightweight HTTP client for calling PlayCraft backend APIs from inside a sandbox.
- * Reads credentials from environment variables or .playcraft.json.
+ * 判断 token 是否为用户 PAT（Personal Access Token）。
+ * PAT 以 "playcraft_pat_" 开头；沙箱 JWT 为三段式 base64。
+ */
+function isPatToken(token) {
+    return token.startsWith('playcraft_pat_');
+}
+/**
+ * Lightweight HTTP client for calling PlayCraft backend APIs from inside a sandbox
+ * or from the CLI after `playcraft login`.
+ *
+ * 凭证解析优先级：
+ *   API URL : PLAYCRAFT_API_URL → .playcraft.json → ~/.playcraft/config.json → DEFAULT_PLAYCRAFT_CLOUD_BASE
+ *   Token   : PLAYCRAFT_SANDBOX_TOKEN → .playcraft.json token → ~/.playcraft/config.json token (PAT)
+ *
+ * 鉴权 header 自动选择：
+ *   - 沙箱 JWT (非 PAT) → X-Sandbox-Token: <token>（后端 @SandboxToken 路由的沙箱分支）
+ *   - 用户 PAT           → Authorization: Bearer <token>（后端 @SandboxToken 路由的回退 PAT 分支）
  */
 export class AgentApiClient {
     apiUrl;
     token;
+    isPat;
     constructor() {
-        let apiUrl = process.env.PLAYCRAFT_API_URL || '';
-        let token = process.env.PLAYCRAFT_SANDBOX_TOKEN || '';
-        if (!apiUrl || !token) {
-            const config = AgentApiClient.loadConfig();
-            apiUrl = apiUrl || config.apiUrl;
-            token = token || config.token;
+        const localConfig = AgentApiClient.loadLocalConfig();
+        const globalConfig = loadGlobalConfig();
+        // URL: 环境变量 → 本地 .playcraft.json → 全局 login 配置 → 公有云默认地址
+        const apiUrl = (process.env.PLAYCRAFT_API_URL ||
+            localConfig.apiUrl ||
+            globalConfig.backendUrl ||
+            globalConfig.url ||
+            DEFAULT_PLAYCRAFT_CLOUD_BASE).replace(/\/+$/, '');
+        // Token: 沙箱 token 环境变量 → 本地 .playcraft.json → 全局 login 配置（PAT）
+        const token = process.env.PLAYCRAFT_SANDBOX_TOKEN ||
+            localConfig.token ||
+            globalConfig.token ||
+            '';
+        if (!token) {
+            throw new Error('Missing PlayCraft API credentials. ' +
+                'Run `playcraft login` to authenticate, or set PLAYCRAFT_SANDBOX_TOKEN / create a .playcraft.json file.');
         }
-        if (!apiUrl || !token) {
-            throw new Error('Missing PlayCraft API credentials. Set PLAYCRAFT_API_URL and PLAYCRAFT_SANDBOX_TOKEN, ' +
-                'or create a .playcraft.json file.');
-        }
-        this.apiUrl = apiUrl.replace(/\/+$/, '');
+        this.apiUrl = apiUrl;
         this.token = token;
+        this.isPat = isPatToken(token);
+    }
+    /** 根据 token 类型构造鉴权 headers */
+    authHeaders() {
+        if (this.isPat) {
+            return { 'Authorization': `Bearer ${this.token}` };
+        }
+        return { 'X-Sandbox-Token': this.token };
     }
     /** Absolute pathname under /api/agent/tools (path may omit leading slash). */
     toolsRequestUrl(path) {
@@ -34,7 +66,7 @@ export class AgentApiClient {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                'X-Sandbox-Token': this.token,
+                ...this.authHeaders(),
             },
             body: JSON.stringify(body),
         });
@@ -53,7 +85,7 @@ export class AgentApiClient {
             }
         }
         const res = await fetch(url, {
-            headers: { 'X-Sandbox-Token': this.token },
+            headers: this.authHeaders(),
         });
         if (!res.ok) {
             const text = await res.text().catch(() => res.statusText);
@@ -61,7 +93,11 @@ export class AgentApiClient {
         }
         return res.json();
     }
-    static loadConfig() {
+    /**
+     * 按顺序搜索本地 .playcraft.json 文件（沙箱内或项目目录）。
+     * 与全局 login 配置（~/.playcraft/config.json）不同，前者专用于沙箱 token。
+     */
+    static loadLocalConfig() {
         const searchPaths = [
             join(process.cwd(), '.playcraft.json'),
             '/project/.playcraft.json',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@playcraft/cli",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "private": false,
   "type": "module",
   "bin": {
@@ -23,8 +23,8 @@
     "release": "node scripts/release.js"
   },
   "dependencies": {
-    "@playcraft/build": "^0.0.39",
-    "@playcraft/common": "^0.0.27",
+    "@playcraft/build": "^0.0.41",
+    "@playcraft/common": "^0.0.29",
     "chokidar": "^4.0.3",
     "commander": "^13.1.0",
     "cors": "^2.8.6",