cclawd 1.0.7 → 1.0.8

package/dist/{whatsapp-actions-B0u0ZAme.js → whatsapp-actions-CYEzUMBI.js}

@@ -1,20 +1,20 @@
-import "./paths-C0HLtPu0.js";
-import "./paths-hfkBoC7i.js";
-import "./subsystem-C8z6w6xC.js";
-import "./workspace-CWDYHR27.js";
-import "./logger-ChbX1G7s.js";
-import { Dr as normalizeWhatsAppTarget, Er as isWhatsAppGroupJid, dr as resolveWhatsAppAccount } from "./model-selection-wf3OY5DX.js";
-import "./github-copilot-token-CQmATy5E.js";
+import "./paths-CehYKFsO.js";
+import "./paths-DkxwiA8g.js";
+import "./subsystem-DfXy5gUB.js";
+import "./workspace-DGIcKCCW.js";
+import "./logger-CbUVl62f.js";
+import { Dr as normalizeWhatsAppTarget, Er as isWhatsAppGroupJid, dr as resolveWhatsAppAccount } from "./model-selection-Cv2Puf5z.js";
+import "./github-copilot-token-8N63GdbE.js";
 import "./boolean-C7Ct_klp.js";
-import "./env-aYXLHjfZ.js";
-import "./frontmatter-DjZuS525.js";
-import "./fetch-DCTUdr1U.js";
-import "./fetch-guard-CqpEmMQ2.js";
-import "./ir-CzM3SxId.js";
+import "./env-lw2hsIUY.js";
+import "./frontmatter-C_obXuTp.js";
+import "./fetch-D9NUULbj.js";
+import "./fetch-guard-B5ZMnGaN.js";
+import "./ir-CsgNUpOU.js";
 import "./render-IRnn-2gt.js";
-import { f as readReactionParams, h as readStringParam, i as ToolAuthorizationError, l as jsonResult, n as missingTargetError, o as createActionGate } from "./target-errors-CfavnC9U.js";
-import "./tables-DQusRhkD.js";
-import { r as sendReactionWhatsApp } from "./outbound-Bw0dOVS7.js";
+import { f as readReactionParams, h as readStringParam, i as ToolAuthorizationError, l as jsonResult, n as missingTargetError, o as createActionGate } from "./target-errors-BZE1mc-W.js";
+import "./tables-CjQqTOdD.js";
+import { r as sendReactionWhatsApp } from "./outbound-Chpiwybe.js";
 //#region src/whatsapp/resolve-outbound-target.ts
 function resolveWhatsAppOutboundTarget(params) {
 	const trimmed = params.to?.trim() ?? "";

package/dist/{workspace-CWDYHR27.js → workspace-DGIcKCCW.js}

@@ -1,10 +1,10 @@
-import { d as resolveRequiredHomeDir } from "./paths-hfkBoC7i.js";
-import { l as danger, m as shouldLogVerbose } from "./subsystem-C8z6w6xC.js";
-import { g as pathExists$1, n as logError, t as logDebug, y as resolveUserPath } from "./logger-ChbX1G7s.js";
+import { d as resolveRequiredHomeDir } from "./paths-DkxwiA8g.js";
+import { l as danger, m as shouldLogVerbose } from "./subsystem-DfXy5gUB.js";
+import { g as pathExists$1, n as logError, t as logDebug, y as resolveUserPath } from "./logger-CbUVl62f.js";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import fs$1 from "node:fs";
+import syncFs from "node:fs";
 import { promisify } from "node:util";
 import { execFile, spawn } from "node:child_process";
 import process$1 from "node:process";
@@ -566,7 +566,7 @@ function resolveBoundaryPathLexicalSync(params) {
 			rootCanonicalPath: params.rootCanonicalPath,
 			resolveParams: params.params,
 			absolutePath: params.absolutePath,
-			read: (cursor) => fs$1.lstatSync(cursor)
+			read: (cursor) => syncFs.lstatSync(cursor)
 		});
 		if (isPromiseLike(maybeStat)) throw new Error("Unexpected async lexical stat");
 		const stat = maybeStat;
@@ -716,15 +716,15 @@ function resolvePathViaExistingAncestorSync(targetPath) {
 	const normalized = path.resolve(targetPath);
 	let cursor = normalized;
 	const missingSuffix = [];
-	while (!isFilesystemRoot(cursor) && !fs$1.existsSync(cursor)) {
+	while (!isFilesystemRoot(cursor) && !syncFs.existsSync(cursor)) {
 		missingSuffix.unshift(path.basename(cursor));
 		const parent = path.dirname(cursor);
 		if (parent === cursor) break;
 		cursor = parent;
 	}
-	if (!fs$1.existsSync(cursor)) return normalized;
+	if (!syncFs.existsSync(cursor)) return normalized;
 	try {
-		const resolvedAncestor = path.resolve(fs$1.realpathSync(cursor));
+		const resolvedAncestor = path.resolve(syncFs.realpathSync(cursor));
 		if (missingSuffix.length === 0) return resolvedAncestor;
 		return path.resolve(resolvedAncestor, ...missingSuffix);
 	} catch {
@@ -749,7 +749,7 @@ function getPathKindSync(absolutePath, preserveFinalSymlink) {
 	try {
 		return {
 			exists: true,
-			kind: toResolvedKind(preserveFinalSymlink ? fs$1.lstatSync(absolutePath) : fs$1.statSync(absolutePath))
+			kind: toResolvedKind(preserveFinalSymlink ? syncFs.lstatSync(absolutePath) : syncFs.statSync(absolutePath))
 		};
 	} catch (error) {
 		if (isNotFoundPathError(error)) return {
@@ -809,10 +809,10 @@ async function resolveSymlinkHopPath(symlinkPath) {
 }
 function resolveSymlinkHopPathSync(symlinkPath) {
 	try {
-		return path.resolve(fs$1.realpathSync(symlinkPath));
+		return path.resolve(syncFs.realpathSync(symlinkPath));
 	} catch (error) {
 		if (!isNotFoundPathError(error)) throw error;
-		const linkTarget = fs$1.readlinkSync(symlinkPath);
+		const linkTarget = syncFs.readlinkSync(symlinkPath);
 		return resolvePathViaExistingAncestorSync(path.resolve(path.dirname(symlinkPath), linkTarget));
 	}
 }
@@ -836,7 +836,7 @@ function sameFileIdentity(left, right) {
 	return sameFileIdentity$1(left, right);
 }
 function openVerifiedFileSync(params) {
-	const ioFs = params.ioFs ?? fs$1;
+	const ioFs = params.ioFs ?? syncFs;
 	const allowedType = params.allowedType ?? "file";
 	const openReadFlags = ioFs.constants.O_RDONLY | (typeof ioFs.constants.O_NOFOLLOW === "number" ? ioFs.constants.O_NOFOLLOW : 0);
 	let fd = null;
@@ -912,7 +912,7 @@ function canUseBoundaryFileOpen(ioFs) {
 	return typeof ioFs.openSync === "function" && typeof ioFs.closeSync === "function" && typeof ioFs.fstatSync === "function" && typeof ioFs.lstatSync === "function" && typeof ioFs.realpathSync === "function" && typeof ioFs.readFileSync === "function" && typeof ioFs.constants === "object" && ioFs.constants !== null;
 }
 function openBoundaryFileSync(params) {
-	const ioFs = params.ioFs ?? fs$1;
+	const ioFs = params.ioFs ?? syncFs;
 	const resolved = resolveBoundaryFilePathGeneric({
 		absolutePath: params.absolutePath,
 		resolve: (absolutePath) => resolveBoundaryPathSync({
@@ -963,7 +963,7 @@ function finalizeBoundaryFileOpen(params) {
 	});
 }
 async function openBoundaryFile(params) {
-	const ioFs = params.ioFs ?? fs$1;
+	const ioFs = params.ioFs ?? syncFs;
 	const maybeResolved = resolveBoundaryFilePathGeneric({
 		absolutePath: params.absolutePath,
 		resolve: (absolutePath) => resolveBoundaryPath({
@@ -1119,7 +1119,7 @@ function resolveNpmArgvForWindows(argv) {
 	if (!cliName) return null;
 	const nodeDir = path.dirname(process$1.execPath);
 	const cliPath = path.join(nodeDir, "node_modules", "npm", "bin", cliName);
-	if (!fs$1.existsSync(cliPath)) {
+	if (!syncFs.existsSync(cliPath)) {
 		const command = argv[0] ?? "";
 		return [path.extname(command).toLowerCase() ? command : `${command}.cmd`, ...argv.slice(1)];
 	}
@@ -1323,7 +1323,7 @@ async function readPackageName(dir) {
 }
 function readPackageNameSync(dir) {
 	try {
-		const raw = fs$1.readFileSync(path.join(dir, "package.json"), "utf-8");
+		const raw = syncFs.readFileSync(path.join(dir, "package.json"), "utf-8");
 		const parsed = JSON.parse(raw);
 		return typeof parsed.name === "string" ? parsed.name : null;
 	} catch {
@@ -1357,7 +1357,7 @@ function candidateDirsFromArgv1(argv1) {
 	const normalized = path.resolve(argv1);
 	const candidates = [path.dirname(normalized)];
 	try {
-		const resolved = fs$1.realpathSync(normalized);
+		const resolved = syncFs.realpathSync(normalized);
 		if (resolved !== normalized) candidates.push(path.dirname(resolved));
 	} catch {}
 	const parts = normalized.split(path.sep);
@@ -1469,14 +1469,14 @@ async function readWorkspaceFileWithGuards(params) {
 	const identity = workspaceFileIdentity(opened.stat, opened.path);
 	const cached = workspaceFileCache.get(params.filePath);
 	if (cached && cached.identity === identity) {
-		fs$1.closeSync(opened.fd);
+		syncFs.closeSync(opened.fd);
 		return {
 			ok: true,
 			content: cached.content
 		};
 	}
 	try {
-		const content = fs$1.readFileSync(opened.fd, "utf-8");
+		const content = syncFs.readFileSync(opened.fd, "utf-8");
 		workspaceFileCache.set(params.filePath, {
 			content,
 			identity
@@ -1493,7 +1493,7 @@ async function readWorkspaceFileWithGuards(params) {
 			error
 		};
 	} finally {
-		fs$1.closeSync(opened.fd);
+		syncFs.closeSync(opened.fd);
 	}
 }
 function stripFrontMatter(content) {

package/extensions/cclawd-mfa-auth/README.md

@@ -0,0 +1,118 @@
+# Cclawd MFA Auth Plugin
+
+OpenClaw 插件，为多渠道提供 MFA（多因素认证）功能。
+
+## 功能特性
+
+- ✅ **首次对话认证**：用户首次对话时触发 MFA 认证
+- ✅ **敏感操作认证**：敏感操作（如执行命令）需要二次认证
+- ✅ **/reauth 命令**：重置认证状态，重新认证
+- ✅ **多渠道支持**：支持 Web/WebChat 和其他渠道
+- ✅ **轮询认证结果**：自动轮询认证状态，成功后推送通知
+
+## 安装
+
+```bash
+pnpm install
+```
+
+## 配置
+
+通过环境变量配置插件：
+
+```bash
+# Dabby API 配置
+MFA_AUTH_API_KEY=your_api_key_here
+DABBY_API_BASE_URL=https://api.dabby.com
+
+# 认证有效期（毫秒）
+MFA_VERIFICATION_DURATION=120000              # 敏感操作认证有效期，默认 2 分钟
+MFA_FIRST_MESSAGE_AUTH_DURATION=86400000      # 首次认证有效期，默认 24 小时
+
+# 功能开关
+MFA_REQUIRE_AUTH_ON_FIRST_MESSAGE=true        # 启用首次消息认证
+MFA_REQUIRE_AUTH_ON_SENSITIVE_OPERATION=true  # 启用敏感操作认证
+
+# 敏感关键词（逗号分隔）
+MFA_SENSITIVE_KEYWORDS=rm,delete,drop,shutdown
+
+# Gateway 配置
+MFA_GATEWAY_HOST=127.0.0.1                    # Gateway 主机地址
+MFA_ENABLE_AUTH_NOTIFICATION=true             # 启用认证成功通知
+
+# 状态持久化目录
+MFA_AUTH_STATE_DIR=~/.openclaw/cclawd-mfa-auth/
+```
+
+## 使用
+
+### 1. 首次对话认证
+
+用户首次发送消息时，插件会自动触发认证流程：
+
+1. 生成二维码认证链接
+2. 推送认证链接给用户
+3. 轮询认证状态
+4. 认证成功后推送通知
+
+### 2. 敏感操作认证
+
+当用户执行敏感操作（如 bash 命令包含敏感关键词）时：
+
+1. 拦截操作
+2. 要求二次认证
+3. 认证成功后允许执行
+
+### 3. /reauth 命令
+
+用户可以随时发送 `/reauth` 命令重新认证：
+
+```
+/reauth
+```
+
+## 认证流程
+
+```mermaid
+sequenceDiagram
+    participant User
+    participant Plugin
+    participant AuthManager
+    participant DabbyAPI
+    participant NotificationService
+
+    User->>Plugin: 发送消息
+    Plugin->>AuthManager: 检查认证状态
+    alt 未认证
+        AuthManager->>DabbyAPI: 获取二维码
+        DabbyAPI-->>AuthManager: certToken + qrCodeUrl
+        AuthManager->>NotificationService: 推送认证链接
+        NotificationService-->>User: 显示二维码
+        loop 轮询认证结果
+            AuthManager->>DabbyAPI: 检查认证状态
+            DabbyAPI-->>AuthManager: 返回状态
+        end
+        AuthManager->>NotificationService: 推送成功消息
+        NotificationService-->>User: 认证成功
+    end
+```
+
+## 支持的渠道
+
+- ✅ Web/WebChat
+- ✅ Feishu（飞书）
+- 🚧 其他渠道（可扩展）
+
+## 开发
+
+```bash
+# 开发模式
+pnpm dev
+
+# 构建
+pnpm build
+```
+
+## License
+
+MIT

package/extensions/cclawd-mfa-auth/index.ts

@@ -0,0 +1,382 @@
+/**
+ * Cclawd MFA Auth Plugin - Main Entry
+ */
+
+import type { OpenClawPluginApi } from 'openclaw/plugin-sdk';
+import { authManager } from './src/auth-manager.js';
+import { config } from './src/config.js';
+import { NotificationService } from './src/notification-service.js';
+import { pollingManager } from './src/polling-manager.js';
+import { SessionResolver } from './src/session-resolver.js';
+import { sensitiveDetector } from './src/sensitive-detector.js';
+import { qrCodeAuthProvider } from './src/providers/qr-code.js';
+import type { AuthSession, PendingAuthContext } from './src/types.js';
+
+const notificationService = NotificationService.getInstance();
+
+/**
+ * 发送认证消息
+ */
+async function sendAuthMessage(
+  channel: string | undefined,
+  accountId: string | undefined,
+  to: string,
+  message: string,
+  userId: string,
+  overrideSessionKey?: string,
+): Promise<void> {
+  const session: AuthSession = {
+    userId,
+    sessionId: 'notification',
+    authMethod: 'qr-code',
+    timestamp: Date.now(),
+    originalContext: {
+      sessionKey: overrideSessionKey || `${channel || 'web'}:${accountId || ''}:${userId}`,
+      senderId: userId,
+      commandBody: '',
+      channel: channel || 'web',
+      accountId: accountId || '',
+      to,
+      toolName: 'notification',
+      toolParams: {},
+      timestamp: Date.now(),
+      triggerType: 'sensitive_operation',
+    },
+  };
+
+  await notificationService.sendAuthNotification(session, message);
+}
+
+/**
+ * 插件注册函数
+ */
+export default function register(api: OpenClawPluginApi) {
+  console.log('[cclawd-mfa-auth] Plugin registration started');
+  authManager.registerProvider(qrCodeAuthProvider);
+
+  notificationService.setConfig(api.config);
+
+  /**
+   * 处理消息接收事件 - 首次对话认证
+   */
+  api.on('message_received', async (event, ctx) => {
+    await authManager.ensureInitialized();
+
+    api.logger.info(
+      `[cclawd-mfa-auth] First message auth check: config.requireAuthOnFirstMessage=${config.requireAuthOnFirstMessage}`,
+    );
+
+    if (!config.requireAuthOnFirstMessage) {
+      api.logger.warn(`[cclawd-mfa-auth] First message auth is disabled in config, skipping.`);
+      return;
+    }
+
+    const content = event.content || '';
+    const isReauthCommand = content.trim() === '/reauth';
+
+    if (isReauthCommand) {
+      api.logger.info(`[cclawd-mfa-auth] /reauth command detected, skipping first message auth check`);
+      return;
+    }
+
+    // 解析会话信息
+    // metadata.senderId 是 WebChat 的真实用户标识
+    const metadataSenderId = event.metadata?.senderId as string | undefined;
+    
+    const resolved = SessionResolver.resolveFromContext({
+      sessionKey: ctx.sessionKey,
+      channelId: ctx.channelId,
+      conversationId: ctx.conversationId,
+      accountId: ctx.accountId,
+      from: event.from,
+      senderId: metadataSenderId || ctx.senderId,
+    });
+
+    const userId = resolved.userId;
+
+    api.logger.info(`[cclawd-mfa-auth] Extracted userId="${userId}", sessionKey="${resolved.sessionKey}"`);
+
+    // 检查是否已认证
+    if (authManager.isUserVerifiedForFirstMessage(userId)) {
+      api.logger.info(`[cclawd-mfa-auth] User ${userId} already verified for first message`);
+
+      const notificationInfo = authManager.checkAndConsumeNotification(userId);
+      if (notificationInfo) {
+        const messageText = notificationInfo.isReauth
+          ? '✅ 重新认证成功，请继续对话。'
+          : '✅ 首次认证成功，请继续对话。';
+
+        await sendAuthMessage(
+          resolved.channel,
+          resolved.accountId,
+          event.metadata?.to as string | undefined || event.from || userId,
+          messageText,
+          userId,
+          resolved.sessionKey,
+        );
+      }
+      return;
+    }
+
+    api.logger.info(`[cclawd-mfa-auth] First message from unauthenticated user ${userId}, requiring auth`);
+
+    // 生成认证会话
+    const session = await authManager.generateSession(userId, {
+      sessionKey: resolved.sessionKey,
+      senderId: userId,
+      commandBody: event.content || '',
+      channel: resolved.channel,
+      to: event.metadata?.to as string | undefined || event.from,
+      accountId: resolved.accountId,
+      toolName: '',
+      toolParams: {},
+      timestamp: Date.now(),
+      triggerType: 'first_message',
+    });
+
+    if (!session) {
+      api.logger.error(`[cclawd-mfa-auth] Failed to generate first message auth session for user ${userId}`);
+      return;
+    }
+
+    api.logger.info(`[cclawd-mfa-auth] Blocking first message from ${userId}`);
+
+    // 发送认证链接
+    const messageText = `🔐 首次对话需要进行认证
+
+为了您的账户安全，首次对话前需要完成身份验证。
+
+📱 请点击以下链接完成扫码认证:
+${session.qrCodeUrl}
+
+验证有效期: ${Math.floor(config.timeout / 60000)} 分钟`;
+
+    try {
+      await sendAuthMessage(
+        resolved.channel,
+        resolved.accountId,
+        event.metadata?.to as string | undefined || event.from || userId,
+        messageText,
+        userId,
+        resolved.sessionKey,
+      );
+
+      // 启动轮询
+      pollingManager.startPolling(api, userId, session.sessionId, {
+        triggerType: 'first_message',
+        isReauth: false,
+        channel: resolved.channel,
+        accountId: resolved.accountId,
+        to: event.metadata?.to as string | undefined,
+        sessionKey: resolved.sessionKey,
+      });
+
+      api.logger.info(`[cclawd-mfa-auth] Sent first message auth notification`);
+    } catch (error) {
+      api.logger.error(`[cclawd-mfa-auth] Failed to send first message auth notification: ${String(error)}`);
+    }
+  });
+
+  /**
+   * 处理工具调用前事件 - 敏感操作认证
+   */
+  api.on('before_tool_call', async (event, ctx) => {
+    await authManager.ensureInitialized();
+    if (!config.requireAuthOnSensitiveOperation) {
+      return undefined;
+    }
+
+    const { toolName, params } = event;
+
+    api.logger.info(`[cclawd-mfa-auth] Tool call detected: ${toolName}`);
+
+    // 检查是否为敏感操作
+    const sensitiveCheck = sensitiveDetector.checkToolCall(toolName, params || {});
+    if (!sensitiveCheck.isSensitive) {
+      api.logger.info(`[cclawd-mfa-auth] Tool ${toolName} is not sensitive, allowing`);
+      return undefined;
+    }
+
+    // 解析会话信息
+    const resolved = SessionResolver.resolveFromContext({
+      sessionKey: ctx.sessionKey,
+      channelId: ctx.channelId,
+      conversationId: ctx.conversationId,
+      accountId: ctx.accountId,
+      from: ctx.from,
+      senderId: ctx.senderId,
+    });
+
+    const userId = resolved.userId;
+
+    // 检查是否已认证
+    if (authManager.isUserVerifiedForSensitiveOps(userId)) {
+      api.logger.info(`[cclawd-mfa-auth] User ${userId} is verified for sensitive ops, allowing`);
+
+      const notificationInfo = authManager.checkAndConsumeNotification(userId);
+      if (notificationInfo) {
+        await sendAuthMessage(
+          resolved.channel,
+          resolved.accountId,
+          resolved.to || userId,
+          '✅ 二次认证成功，请重新发送之前的命令（或回复"确认"）即可执行。',
+          userId,
+          resolved.sessionKey,
+        );
+      }
+
+      return undefined;
+    }
+
+    api.logger.info(`[cclawd-mfa-auth] User ${userId} is NOT verified for sensitive ops.`);
+
+    // 生成认证会话
+    const session = await authManager.generateSession(userId, {
+      sessionKey: resolved.sessionKey,
+      senderId: userId,
+      commandBody: sensitiveCheck.preview,
+      channel: resolved.channel,
+      to: resolved.to,
+      accountId: resolved.accountId,
+      toolName,
+      toolParams: params || {},
+      timestamp: Date.now(),
+      triggerType: 'sensitive_operation',
+    });
+
+    if (!session) {
+      api.logger.error(`[cclawd-mfa-auth] Failed to generate session for user ${userId}`);
+      return undefined;
+    }
+
+    api.logger.info(`[cclawd-mfa-auth] Blocking sensitive tool call: ${toolName} from ${userId}`);
+
+    // 发送认证链接
+    const messageText = `🔐 该操作需要二次认证
+
+检测到敏感操作: ${sensitiveCheck.preview}
+
+📱 请点击以下链接完成扫码认证:
+${session.qrCodeUrl}
+
+验证有效期: ${Math.floor(config.timeout / 60000)} 分钟
+
+验证成功后，请回复"确认"或者重新发送之前的命令以继续执行。`;
+
+    try {
+      await sendAuthMessage(
+        resolved.channel,
+        resolved.accountId,
+        resolved.to || userId,
+        messageText,
+        userId,
+        resolved.sessionKey,
+      );
+
+      // 启动轮询
+      pollingManager.startPolling(api, userId, session.sessionId, {
+        triggerType: 'sensitive_operation',
+        isReauth: false,
+        channel: resolved.channel,
+        accountId: resolved.accountId,
+        to: resolved.to,
+        sessionKey: resolved.sessionKey,
+      });
+
+      api.logger.info(`[cclawd-mfa-auth] Sent sensitive operation auth notification`);
+    } catch (error) {
+      api.logger.error(`[cclawd-mfa-auth] Failed to send sensitive operation auth notification: ${String(error)}`);
+    }
+
+    // 注册待执行操作
+    authManager.registerPendingExecution(userId, session.sessionId);
+
+    return {
+      block: true,
+      blockReason: `🔐 该操作需要二次认证`,
+    };
+  });
+
+  /**
+   * 注册 /reauth 命令
+   */
+  api.registerCommand({
+    name: 'reauth',
+    description: '重新进行首次对话认证',
+    acceptsArgs: false,
+    requireAuth: false,
+    handler: async (ctx) => {
+      const userId = ctx.from || ctx.senderId || 'unknown';
+      api.logger.info(`[cclawd-mfa-auth] /reauth command received. userId=${userId}`);
+
+      // 清除首次消息认证状态
+      authManager.clearFirstMessageAuth(userId);
+
+      // 解析会话信息
+      const resolved = SessionResolver.resolveFromContext({
+        sessionKey: ctx.sessionKey,
+        channelId: ctx.channel,
+        accountId: ctx.accountId,
+        from: ctx.from,
+        senderId: ctx.senderId,
+        to: ctx.to,
+      });
+
+      // 生成认证会话
+      const session = await authManager.generateSession(userId, {
+        sessionKey: resolved.sessionKey,
+        senderId: userId,
+        commandBody: '/reauth',
+        channel: resolved.channel,
+        to: resolved.to,
+        accountId: resolved.accountId,
+        toolName: '',
+        toolParams: {},
+        timestamp: Date.now(),
+        triggerType: 'first_message',
+      });
+
+      if (!session) {
+        api.logger.error(`[cclawd-mfa-auth] Failed to generate reauth session for user ${userId}`);
+        return { text: '❌ 认证会话创建失败，请稍后重试。' };
+      }
+
+      api.logger.info(`[cclawd-mfa-auth] Reauth requested by user ${userId}, session=${session.sessionId}`);
+
+      const messageText = `🔐 重新认证
+
+📱 请点击以下链接完成扫码认证:
+${session.qrCodeUrl}
+
+验证有效期: ${Math.floor(config.timeout / 60000)} 分钟`;
+
+      try {
+        await sendAuthMessage(
+          resolved.channel,
+          resolved.accountId,
+          resolved.to || userId,
+          messageText,
+          userId,
+          resolved.sessionKey,
+        );
+
+        // 启动轮询
+        pollingManager.startPolling(api, userId, session.sessionId, {
+          triggerType: 'first_message',
+          isReauth: true,
+          channel: resolved.channel,
+          accountId: resolved.accountId,
+          to: resolved.to,
+          sessionKey: resolved.sessionKey,
+        });
+
+        return { text: '📱 认证链接已发送，请查看最新消息。' };
+      } catch (error) {
+        api.logger.error(`[cclawd-mfa-auth] Failed to send reauth link: ${String(error)}`);
+        return { text: '❌ 认证链接发送失败，请稍后重试。' };
+      }
+    },
+  });
+
+  api.logger.info('[cclawd-mfa-auth] Plugin loaded successfully');
+}