@shulex/cxclawctl 0.1.7 → 0.1.9

package/README.md

@@ -33,15 +33,12 @@ codex plugin marketplace add SolveaCX/cx_claw_codex --ref marketplace/stable
 codex plugin add cxclaw@cxclaw
 ```
 
-然后完成钉钉登录：
+安装后不需要单独执行登录命令。首次使用任何需要服务端访问的 CXClaw 能力时，CLI 会自动打开钉钉授权页并持续监听授权结果；授权成功后自动继续原命令，不需要再对 Codex 回复“已授权”。
 
-```bash
-npx --yes @shulex/cxclawctl@latest auth login
-```
-
-CLI 固定连接生产授权服务 `https://ai.solvea.cx/api_v2/ticket`，不接受用户指定服务地址或登录环境。CLI 会打开钉钉授权页；一次登录即可访问获准的测试和生产租户。授权完成后，检查登录状态和本地版本：
+CLI 固定连接生产授权服务 `https://ai.solvea.cx/api_v2/ticket`，不接受用户指定服务地址或登录环境。一次登录即可访问获准的测试和生产租户。需要人工诊断授权时，可以执行：
 
 ```bash
+npx --yes @shulex/cxclawctl@latest auth ensure
 npx --yes @shulex/cxclawctl@latest auth status
 npx --yes @shulex/cxclawctl@latest doctor
 ```

package/capabilities.lock.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "plugin": {
-    "pluginVersion": "0.1.7",
-    "cliVersion": "0.1.7",
+    "pluginVersion": "0.1.9",
+    "cliVersion": "0.1.9",
     "toolSchemaVersion": "1",
     "serverApiVersion": "1"
   },
@@ -158,6 +158,7 @@
     }
   ],
   "localCommands": [
+    "node \"<PLUGIN_ROOT>/plugin-cli.mjs\" auth ensure",
     "node \"<PLUGIN_ROOT>/plugin-cli.mjs\" auth status",
     "node \"<PLUGIN_ROOT>/plugin-cli.mjs\" tenant current",
     "node \"<PLUGIN_ROOT>/plugin-cli.mjs\" tenant search",

package/dist/cli.js

@@ -12,7 +12,7 @@ var AUTH_SERVER_URL = "https://ai.solvea.cx/api_v2/ticket";
 // package.json
 var package_default = {
   name: "@shulex/cxclawctl",
-  version: "0.1.7",
+  version: "0.1.9",
   description: "Solvea CXClaw CLI and Codex plugin runtime",
   type: "module",
   bin: {
@@ -67,6 +67,16 @@ var TOOL_SCHEMA_VERSION = "1";
 var SERVER_API_VERSION = "1";
 
 // src/http.ts
+var HttpError = class extends Error {
+  constructor(status, responseBody) {
+    super(`server returned ${status}: ${responseBody}`);
+    this.status = status;
+    this.responseBody = responseBody;
+    this.name = "HttpError";
+  }
+  status;
+  responseBody;
+};
 function unwrap(value) {
   if (value && typeof value === "object" && Object.keys(value).length === 1 && "data" in value) return value.data;
   return value;
@@ -86,10 +96,11 @@ async function request(session, path, init = {}, tenant = false) {
       const response = await fetch(`${AUTH_SERVER_URL}${path}`, { ...init, headers, signal: AbortSignal.timeout(3e4) });
       const text = await response.text();
       const value = text ? JSON.parse(text) : void 0;
-      if (!response.ok) throw new Error(`server returned ${response.status}: ${text}`);
+      if (!response.ok) throw new HttpError(response.status, text);
       return unwrap(value);
     } catch (error) {
       last = error;
+      if (error instanceof HttpError && error.status < 500) break;
       if (attempt < 2) await new Promise((r) => setTimeout(r, 200 * 2 ** attempt));
     }
   }
@@ -101,9 +112,15 @@ var post = (session, path, body, tenant = false) => request(session, path, { met
 import { AsyncEntry } from "@napi-rs/keyring";
 var options = process.platform === "linux" ? { linux: { store: "secret-service" } } : void 0;
 var entry = () => new AsyncEntry("com.solvea.cxclaw", "session", options);
+var SessionNotFoundError = class extends Error {
+  constructor() {
+    super("\u672A\u767B\u5F55");
+    this.name = "SessionNotFoundError";
+  }
+};
 async function loadSession() {
   const raw = await entry().getPassword();
-  if (!raw) throw new Error("\u672A\u767B\u5F55\uFF0C\u8BF7\u5148\u8FD0\u884C cxclawctl auth login");
+  if (!raw) throw new SessionNotFoundError();
   return JSON.parse(raw);
 }
 async function saveSession(session) {
@@ -116,7 +133,11 @@ async function deleteSession() {
 
 // src/auth.ts
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function login(channel) {
+var loginInFlight;
+function publicAuthStatus(session) {
+  return { ok: true, loggedIn: true, email: session.email, channel: session.channel, accessExpiresAt: session.accessExpiry };
+}
+async function runLogin(channel) {
   const session = { channel, accessToken: "", refreshToken: "", accessExpiry: 0, employeeId: "", email: "" };
   const start = await post(session, "/auth/device/start", { clientVersion: VERSION });
   console.error(`\u8BF7\u5728\u6D4F\u89C8\u5668\u6253\u5F00\u4EE5\u4E0B\u5730\u5740\u5B8C\u6210\u9489\u9489\u6388\u6743\uFF1A
@@ -124,19 +145,32 @@ ${start.verificationUriComplete}
 \u8BBE\u5907\u7801\uFF1A${start.userCode}`);
   await open(start.verificationUriComplete).catch(() => void 0);
   const deadline = Date.now() + start.expiresIn * 1e3;
+  console.error("\u6B63\u5728\u7B49\u5F85\u9489\u9489\u6388\u6743\uFF0C\u6388\u6743\u5B8C\u6210\u540E\u5F53\u524D\u547D\u4EE4\u4F1A\u81EA\u52A8\u7EE7\u7EED\uFF0C\u65E0\u9700\u56DE\u590D Codex\u3002");
+  let nextProgressAt = Date.now() + 15e3;
   while (Date.now() < deadline) {
     await sleep(Math.max(2, start.interval) * 1e3);
     try {
       const token = await post(session, "/auth/device/token", { deviceCode: start.deviceCode, clientVersion: VERSION });
       Object.assign(session, { accessToken: token.accessToken, refreshToken: token.refreshToken, accessExpiry: Math.floor(Date.now() / 1e3) + token.expiresIn, employeeId: token.employee.id, email: token.employee.email });
       await saveSession(session);
+      console.error("\u9489\u9489\u6388\u6743\u6210\u529F\uFF0C\u7EE7\u7EED\u6267\u884C\u5F53\u524D\u547D\u4EE4\u3002");
       return session;
     } catch (error) {
-      if (!String(error).includes("428")) throw error;
+      if (!(error instanceof HttpError) || error.status !== 428) throw error;
+      if (Date.now() >= nextProgressAt) {
+        console.error("\u4ECD\u5728\u7B49\u5F85\u9489\u9489\u6388\u6743\u2026\u2026");
+        nextProgressAt = Date.now() + 15e3;
+      }
     }
   }
   throw new Error("device authorization expired");
 }
+function login(channel) {
+  if (!loginInFlight) loginInFlight = runLogin(channel).finally(() => {
+    loginInFlight = void 0;
+  });
+  return loginInFlight;
+}
 async function ensureAccess(session) {
   if (session.accessToken && Date.now() / 1e3 + 30 < session.accessExpiry) return session;
   const token = await post(session, "/auth/refresh", { refreshToken: session.refreshToken, clientVersion: VERSION });
@@ -144,8 +178,24 @@ async function ensureAccess(session) {
   await saveSession(session);
   return session;
 }
-async function authenticated() {
-  return ensureAccess(await loadSession());
+async function resolveAuthenticated(runtime) {
+  try {
+    return await runtime.refresh(await runtime.load());
+  } catch (error) {
+    if (error instanceof SessionNotFoundError) {
+      console.error("CXClaw \u5C1A\u672A\u6388\u6743\uFF0C\u6B63\u5728\u81EA\u52A8\u53D1\u8D77\u9489\u9489\u6388\u6743\u3002");
+      return runtime.authorize();
+    }
+    if (error instanceof HttpError && error.status === 401) {
+      console.error("CXClaw \u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u6B63\u5728\u91CD\u65B0\u53D1\u8D77\u9489\u9489\u6388\u6743\u3002");
+      await runtime.remove().catch(() => void 0);
+      return runtime.authorize();
+    }
+    throw error;
+  }
+}
+function authenticated() {
+  return resolveAuthenticated({ load: loadSession, refresh: ensureAccess, remove: deleteSession, authorize: () => login("stable") });
 }
 async function logout() {
   let session;
@@ -2829,8 +2879,10 @@ var usage = () => [
 async function runAuth(action2, args) {
   if (action2 === "login") {
     if (flag(args, "--server") || flag(args, "--env")) throw new Error("auth login \u56FA\u5B9A\u4F7F\u7528\u751F\u4EA7\u6388\u6743\u670D\u52A1\uFF0C\u4E0D\u652F\u6301 --server \u6216 --env");
-    return print(await login(option(args, "--channel") ?? "stable"));
+    const session = await login(option(args, "--channel") ?? "stable");
+    return print(publicAuthStatus(session));
   }
+  if (action2 === "ensure") return print(publicAuthStatus(await authenticated()));
   if (action2 === "logout") {
     await logout();
     return print({ ok: true, loggedOut: true });
@@ -2838,16 +2890,15 @@ async function runAuth(action2, args) {
   if (action2 === "status") {
     try {
       const session = await loadSession();
-      return print({ ok: true, loggedIn: true, email: session.email, channel: session.channel, accessExpiresAt: session.accessExpiry });
+      return print(publicAuthStatus(session));
     } catch {
       return print({ ok: true, loggedIn: false });
     }
   }
   if (action2 === "refresh") {
-    const session = await authenticated();
-    return print({ ok: true, accessExpiresAt: session.accessExpiry });
+    return print(publicAuthStatus(await authenticated()));
   }
-  throw new Error("auth action must be login, logout, status, or refresh");
+  throw new Error("auth action must be login, ensure, logout, status, or refresh");
 }
 async function runTenant(action2, args) {
   const session = await authenticated();