coze_lab 0.1.27 → 0.1.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "coze_lab",
-  "version": "0.1.27",
+  "version": "0.1.28",
   "description": "Configure local AI agents (Claude Code, Codex, OpenClaw) to report traces to CozeLoop",
   "keywords": [
     "cozeloop",
@@ -14,6 +14,9 @@
   "bin": {
     "coze_lab": "index.js"
   },
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
   "files": [
     "index.js",
     "scripts/claude-code/cozeloop_hook.py",

package/scripts/claude-code/cozeloop_hook.py

@@ -195,7 +195,7 @@ def _extract_logid(msg: str) -> str:
     return "".join(logid)
 
 
-def _make_finish_event_processor():
+def _make_finish_event_processor(upload_events: Optional[List[str]] = None):
     """Return a trace_finish_event_processor that surfaces failures + logid.
 
     The CozeLoop SDK calls this for each flush event; on failure we print the
@@ -207,6 +207,8 @@ def _make_finish_event_processor():
             if not getattr(info, "is_event_fail", False):
                 return
             detail = getattr(info, "detail_msg", "") or ""
+            if upload_events is not None:
+                upload_events.append(detail or "trace export failed")
             logid = _extract_logid(detail)
             if logid:
                 print(f"[CozeLoop] 上报失败 logid={logid} (可用 bytedcli log get-logid-log {logid} 排查)", file=sys.stderr)
@@ -254,7 +256,11 @@ def _refresh_token(refresh_token: str) -> Optional[str]:
         req = urllib.request.Request(
             f"{_COZE_API}/api/permission/oauth2/token",
             data=payload,
-            headers={"Content-Type": "application/json"},
+            headers={
+                "Content-Type": "application/json",
+                "x-tt-env": "ppe_cozelab",
+                "x-use-ppe": "1",
+            },
         )
         with urllib.request.urlopen(req, timeout=10) as resp:
             data = json.loads(resp.read())
@@ -292,28 +298,48 @@ def get_api_base_url() -> str:
         os.environ.get("COZELOOP_API_BASE_URL", "")
     )
 
+def _token_from_credentials() -> Optional[str]:
+    creds = _load_credentials()
+    if not creds:
+        return None
+    expires_at_sec = creds.get("expires_at", 0) / 1000
+    remaining = expires_at_sec - time.time()
+    if remaining > _REFRESH_THRESHOLD:
+        debug_log(f"Cached token valid, expires in {int(remaining)}s.")
+        return creds.get("access_token")
+    if creds.get("refresh_token"):
+        debug_log(f"Token expiring in {int(remaining)}s, refreshing...")
+        new_token = _refresh_token(creds["refresh_token"])
+        if new_token:
+            return new_token
+        debug_log("Refresh failed.")
+    return None
+
+
 def get_fresh_token() -> Optional[str]:
-    """Return a valid access token, refreshing if needed. Falls back to env var."""
+    """Return a valid access token, refreshing if needed."""
     env_token = os.environ.get("COZELOOP_API_TOKEN")
     env_coze_token = os.environ.get("COZE_API_TOKEN")
+    is_cloud = os.environ.get("COZELAB_ONBOARD_CLOUD", "").lower() in ("1", "true", "yes")
+    if is_cloud:
+        return env_token or env_coze_token or _token_from_credentials()
+
+    # Local onboard used to write a short-lived access token into settings.local.json.
+    # If credentials exist but cannot be refreshed, do not fall back to that stale
+    # env token; failing closed keeps state from advancing on a known-bad token.
+    creds = _load_credentials()
+    if creds:
+        return _token_from_credentials()
+    if env_token and not env_coze_token:
+        token = _token_from_credentials()
+        if token:
+            return token
+        return env_token
     if env_token:
         return env_token
     if env_coze_token:
         return env_coze_token
-    creds = _load_credentials()
-    if creds:
-        expires_at_sec = creds.get("expires_at", 0) / 1000
-        remaining = expires_at_sec - time.time()
-        if remaining > _REFRESH_THRESHOLD:
-            debug_log(f"Cached token valid, expires in {int(remaining)}s.")
-            return creds["access_token"]
-        if creds.get("refresh_token"):
-            debug_log(f"Token expiring in {int(remaining)}s, refreshing...")
-            new_token = _refresh_token(creds["refresh_token"])
-            if new_token:
-                return new_token
-            debug_log("Refresh failed, falling back to env var.")
-    return None
+    return _token_from_credentials()
 
 # -------------------------------------------------------------------------
 
@@ -931,10 +957,11 @@ def send_turns_to_cozeloop(turns: List[Dict[str, Any]], session_id: str, history
     creds = _load_credentials()
     workspace_id = (creds or {}).get("workspace_id") or os.environ.get("COZELOOP_WORKSPACE_ID", "") or _DEFAULT_WORKSPACE_ID
     os.environ["COZELOOP_WORKSPACE_ID"] = workspace_id
+    upload_events: List[str] = []
     client_kwargs = {
         "ultra_large_report": True,
         "upload_timeout": 120,
-        "trace_finish_event_processor": _make_finish_event_processor(),
+        "trace_finish_event_processor": _make_finish_event_processor(upload_events),
     }
     if workspace_id:
         client_kwargs["workspace_id"] = workspace_id
@@ -1391,11 +1418,18 @@ def send_turns_to_cozeloop(turns: List[Dict[str, Any]], session_id: str, history
     except Exception as e:
         print(f"[CozeLoop] 上报失败 ✗ {e}", file=sys.stderr)
         debug_log(f"An error occurred while sending traces to CozeLoop: {e}")
+        return None
     finally:
         # Crucial: close the client to ensure all buffered traces are sent.
         client.close()
         debug_log("CozeLoop client closed.")
 
+    if upload_events:
+        debug_log(f"Upload failed, state not advanced. Last failure: {upload_events[-1][:500]}")
+        return None
+
+    return True
+
 
 # --- Hook Input ---
 
@@ -1505,7 +1539,10 @@ def main():
             debug_log("No coze-context found in any turn (incl. history), skipping upload.")
             return
         print(f"[CozeLoop] 开始上报: session={session_id}, turns={len(turns)}", file=sys.stderr)
-        send_turns_to_cozeloop(turns, session_id, history_turns)
+        uploaded = send_turns_to_cozeloop(turns, session_id, history_turns)
+        if uploaded is None:
+            debug_log("Send failed, state not advanced.")
+            return
 
         # Update state with the new last processed line number
         last_line_in_batch = max(msg.get("_line_number", 0) for msg in new_messages)

package/scripts/codex/cozeloop_hook.py

@@ -137,7 +137,7 @@ def _extract_logid(msg: str) -> str:
     return "".join(logid)
 
 
-def _make_finish_event_processor():
+def _make_finish_event_processor(upload_events: Optional[List[str]] = None):
     """Return a trace_finish_event_processor that surfaces failures + logid.
 
     The CozeLoop SDK calls this for each flush event; on failure we print the
@@ -150,6 +150,8 @@ def _make_finish_event_processor():
                 hook_log("upload success")
                 return
             detail = getattr(info, "detail_msg", "") or ""
+            if upload_events is not None:
+                upload_events.append(detail or "trace export failed")
             logid = _extract_logid(detail)
             if logid:
                 hook_log(f"upload failed logid={logid} detail={detail[:500]}")
@@ -191,15 +193,21 @@ def _refresh_token(refresh_tok: str):
         req = urllib.request.Request(
             f"{_COZE_API}/api/permission/oauth2/token",
             data=payload,
-            headers={"Content-Type": "application/json"},
+            headers={
+                "Content-Type": "application/json",
+                "x-tt-env": "ppe_cozelab",
+                "x-use-ppe": "1",
+            },
         )
         with urllib.request.urlopen(req, timeout=10) as resp:
             data = json.loads(resp.read())
         if data.get("access_token"):
+            existing = _load_credentials() or {}
             creds = {
                 "access_token": data["access_token"],
                 "refresh_token": data.get("refresh_token", refresh_tok),
-                "expires_at": data.get("expires_in", 0) * 1000  # unix timestamp in seconds
+                "expires_at": data.get("expires_in", 0) * 1000,  # unix timestamp in seconds
+                "workspace_id": existing.get("workspace_id", ""),
             }
             _save_credentials(creds)
             return creds["access_token"]
@@ -229,23 +237,43 @@ def get_api_base_url() -> str:
     )
 
 
+def _token_from_credentials():
+    creds = _load_credentials()
+    if not creds:
+        return None
+    remaining = creds.get("expires_at", 0) / 1000 - time.time()
+    if remaining > _REFRESH_THRESHOLD:
+        return creds.get("access_token")
+    if creds.get("refresh_token"):
+        new_token = _refresh_token(creds["refresh_token"])
+        if new_token:
+            return new_token
+    return None
+
+
 def get_fresh_token():
     env_token = os.environ.get("COZELOOP_API_TOKEN")
     env_coze_token = os.environ.get("COZE_API_TOKEN")
+    is_cloud = os.environ.get("COZELAB_ONBOARD_CLOUD", "").lower() in ("1", "true", "yes")
+    if is_cloud:
+        return env_token or env_coze_token or _token_from_credentials()
+
+    # Local onboard used to write a short-lived access token into cozeloop.env.
+    # If credentials exist but cannot be refreshed, do not fall back to that stale
+    # env token; failing closed keeps state from advancing on a known-bad token.
+    creds = _load_credentials()
+    if creds:
+        return _token_from_credentials()
+    if env_token and not env_coze_token:
+        token = _token_from_credentials()
+        if token:
+            return token
+        return env_token
     if env_token:
         return env_token
     if env_coze_token:
         return env_coze_token
-    creds = _load_credentials()
-    if creds:
-        remaining = creds.get("expires_at", 0) / 1000 - time.time()
-        if remaining > _REFRESH_THRESHOLD:
-            return creds["access_token"]
-        if creds.get("refresh_token"):
-            new_token = _refresh_token(creds["refresh_token"])
-            if new_token:
-                return new_token
-    return None
+    return _token_from_credentials()
 # -------------------------------------------------------------------------
 
 # --- SDK Import ---
@@ -966,10 +994,11 @@ def send_turns_to_cozeloop(turns: List[Dict[str, Any]], session_id: str, model_n
     workspace_id = (creds or {}).get("workspace_id") or os.environ.get("COZELOOP_WORKSPACE_ID", "") or _DEFAULT_WORKSPACE_ID
     os.environ["COZELOOP_WORKSPACE_ID"] = workspace_id
     hook_log(f"workspace_id={workspace_id}")
+    upload_events: List[str] = []
     client_kwargs = {
         "ultra_large_report": True,
         "upload_timeout": 120,
-        "trace_finish_event_processor": _make_finish_event_processor(),
+        "trace_finish_event_processor": _make_finish_event_processor(upload_events),
     }
     api_base_url = get_api_base_url()
     if api_base_url:
@@ -1352,6 +1381,10 @@ def send_turns_to_cozeloop(turns: List[Dict[str, Any]], session_id: str, model_n
         hook_log("client closed")
         debug_log("CozeLoop client closed.")
 
+    if upload_events:
+        hook_log(f"upload failed state not advanced failures={len(upload_events)} detail={upload_events[-1][:500]}")
+        return None
+
     return ctx
 
 

package/scripts/openclaw/dist/cozeloop-exporter.js

@@ -44,10 +44,12 @@ async function _refreshToken(refreshTok) {
                 try {
                     const d = JSON.parse(buf);
                     if (d.access_token) {
+                        const existing = _loadCreds() ?? {};
                         const creds = {
                             access_token: d.access_token,
                             refresh_token: d.refresh_token ?? refreshTok,
                             expires_at: (d.expires_in ?? 0) * 1000,  // unix timestamp in seconds
+                            workspace_id: existing.workspace_id ?? "",
                         };
                         _saveCreds(creds);
                         resolve(creds.access_token);
@@ -62,7 +64,8 @@ async function _refreshToken(refreshTok) {
     });
 }
 
-async function getRefreshedToken(currentAuthorization) {
+async function getRefreshedToken(currentAuthorization, opts = {}) {
+    if (opts.disableLocalCredentials) return currentAuthorization;
     const creds = _loadCreds();
     if (!creds) return currentAuthorization; // no creds file, keep as-is
     const remaining = (creds.expires_at ?? 0) - Date.now();
@@ -71,7 +74,7 @@ async function getRefreshedToken(currentAuthorization) {
         const newToken = await _refreshToken(creds.refresh_token);
         if (newToken) return `Bearer ${newToken}`;
     }
-    return currentAuthorization; // fallback
+    return null;
 }
 // ─────────────────────────────────────────────────────────────────────────
 
@@ -131,7 +134,9 @@ export class CozeloopExporter {
         return attrs;
     }
     async refreshAuthIfNeeded() {
-        const fresh = await getRefreshedToken(this.config.authorization);
+        const fresh = await getRefreshedToken(this.config.authorization, {
+            disableLocalCredentials: this.config.disableLocalCredentials,
+        });
         if (fresh && fresh !== this.config.authorization) {
             this.api.logger.info("[CozeloopTrace] Token refreshed, re-initializing exporter...");
             this.config.authorization = fresh;
@@ -143,6 +148,9 @@ export class CozeloopExporter {
                 this.provider = null;
                 this.tracer = null;
             }
+        } else if (fresh === null) {
+            this.api.logger.error("[CozeloopTrace] Local credentials exist but token refresh failed; refusing to reuse stale authorization.");
+            this.config.authorization = "";
         }
     }
     async ensureInitialized() {

package/scripts/openclaw/dist/index.js

@@ -513,6 +513,7 @@ const cozeloopTracePlugin = {
             batchSize: pluginConfig.batchSize || 10,
             batchInterval: pluginConfig.batchInterval || 5000,
             enabledHooks: pluginConfig.enabledHooks,
+            disableLocalCredentials: pluginConfig.disableLocalCredentials === true,
         };
         const exporter = new CozeloopExporter(api, config);
         // per-agent trace 放行：traceAgentIds 为 onboard 写入的 allowlist（小写归一）。

package/scripts/openclaw/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "openclaw-cozeloop-trace",
   "name": "OpenClaw CozeLoop Trace",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Report OpenClaw execution traces to CozeLoop via OpenTelemetry",
   "type": "plugin",
   "entry": "./dist/index.js",
@@ -49,6 +49,11 @@
           "type": "string"
         },
         "description": "List of hooks to enable (if not set, all hooks are enabled)"
+      },
+      "disableLocalCredentials": {
+        "type": "boolean",
+        "default": false,
+        "description": "Disable ~/.cozeloop credentials refresh and use configured authorization only"
       }
     }
   }

package/scripts/shared/cozeloop_refresh.py

@@ -25,13 +25,19 @@ def refresh(rt):
     try:
         body = json.dumps({"grant_type":"refresh_token","client_id":CLIENT_ID,"refresh_token":rt}).encode()
         req = urllib.request.Request(f"{COZE_API}/api/permission/oauth2/token",
-            data=body, headers={"Content-Type":"application/json"})
+            data=body, headers={
+                "Content-Type":"application/json",
+                "x-tt-env":"ppe_cozelab",
+                "x-use-ppe":"1",
+            })
         with urllib.request.urlopen(req, timeout=10) as r:
             d = json.loads(r.read())
         if d.get("access_token"):
+            existing = load() or {}
             save({"access_token":d["access_token"],
                   "refresh_token":d.get("refresh_token",rt),
-                  "expires_at":d.get("expires_in",0)*1000})
+                  "expires_at":d.get("expires_in",0)*1000,
+                  "workspace_id":existing.get("workspace_id","")})
             return True
     except Exception as e:
         print(f"[cozeloop_refresh] refresh failed: {e}", file=sys.stderr)
@@ -50,4 +56,3 @@ def main():
             print("[cozeloop_refresh] refresh failed, token may expire soon", file=sys.stderr)
 
 main()
-