arkclaw-webchat-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arkclaw-webchat-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: CLI to chat with an ArkClaw EE space's Claw over enterprise SSO — zero permanent AK/SK.
 Author: ArkClaw Team
 Keywords: arkclaw,cli,ee,openclaw,sso,sts
@@ -29,9 +29,10 @@ own SSO identity, no passwords, no permanent keys.** Works the same for a human
 at a prompt and for another agent/script (`--json` + exit codes).
 
 ```bash
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com   # browser SSO, once
-arkclaw agents                                                        # list the claws you can chat
-arkclaw chat ci-xxxxxxxx                                              # talk to one
+arkclaw init        # one-time interactive setup (asks only what it can't auto-detect)
+arkclaw login       # browser SSO
+arkclaw agents      # list the claws you can chat
+arkclaw chat ci-xxxxxxxx
 ```
 
 ---
@@ -68,8 +69,13 @@ uv venv && uv pip install -e .
 ## Quick start
 
 ```bash
-# 1. log in to your space (a browser opens; sign in with SSO)
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com
+# 0. one-time setup — interactive. Asks for your space address and (only if the
+#    space doesn't already publish them) the CLI client + STS role. Saved to
+#    ~/.arkclaw/defaults.json so you never type them again.
+arkclaw init
+
+# 1. log in (a browser opens; sign in with SSO)
+arkclaw login
 
 # 2. see which claws you can talk to
 arkclaw agents
@@ -80,9 +86,10 @@ arkclaw chat ci-xxxxxxxx
 arkclaw chat ci-xxxxxxxx -m "用一句话介绍你自己"
 ```
 
-`login` figures out the rest from the address (your identity pool, region). If
-your space hasn't published auto-discovery yet, you may need to point it at the
-STS role once — see **[Configuration](#configuration)**.
+`arkclaw init` resolves everything it can from the address (identity pool,
+region) and only prompts for what's missing. Once your space publishes
+auto-discovery, `init` asks for nothing but the address — and you can even skip
+straight to `arkclaw login https://your-space...`. See **[Configuration](#configuration)**.
 
 ---
 
@@ -90,7 +97,8 @@ STS role once — see **[Configuration](#configuration)**.
 
 | Command | What it does |
 |---|---|
-| `arkclaw login <space-url>` | Browser SSO login. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw (otherwise the last one you opened in the browser). Bare `arkclaw login` re-logs into the previous space. |
+| `arkclaw init [address]` | One-time interactive setup. Saves the address + (only what isn't auto-discovered) the CLI client and STS role to `~/.arkclaw/defaults.json`, so later commands need no env/flags. |
+| `arkclaw login [space-url]` | Browser SSO login. Uses `init` defaults if you omit the URL. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw. Bare `arkclaw login` re-logs into the previous space. |
 | `arkclaw agents` | List the claws/agents you can chat with. |
 | `arkclaw chat [TARGET] [MSG]` | Chat. `TARGET` = a claw id (`ci-...`), an agent name (from `agents`), or a profile. With `MSG` → one-shot; without → interactive REPL. `-f` attach files, `-o` write the reply, `--session NAME` name the conversation, `--approve-all` auto-approve tool runs. |
 | `arkclaw <name>` | Shortcut: `arkclaw 答疑助手` ≡ `arkclaw chat 答疑助手`. |
@@ -161,9 +169,14 @@ arkclaw ls --clawid ci-other        # a different claw
 ## Configuration
 
 `login` resolves config in this order: **explicit flag → `ARKCLAW_*` env →
-the space's published discovery → derived from the address**. You normally only
-type the address. Until your platform publishes auto-discovery, a deployment may
-supply these (non-secret) via env:
+the space's published discovery → `arkclaw init` defaults → derived from the
+address**. You normally only type the address.
+
+**The easy way — `arkclaw init`** asks once (interactively) for whatever the
+space doesn't yet auto-publish, and saves it. After that, just `arkclaw login`.
+
+**The env way** (scripts/CI, or instead of `init`) — supply the same non-secret
+values via env:
 
 | Env | Purpose |
 |---|---|
@@ -171,7 +184,7 @@ supply these (non-secret) via env:
 | `ARKCLAW_ROLE_TRN` | STS role that mints the ChatToken (openclaw). |
 | `ARKCLAW_REGION` / `ARKCLAW_SPACE_ID` | Override region / space (usually auto). |
 
-Other config: `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
+Other config: `~/.arkclaw/defaults.json` (`init` answers, 0600), `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
 
 > **Escape hatch (admin/test):** `arkclaw login <url> --transport openclaw --static-creds` uses `VOLCENGINE_ACCESS_KEY`/`SECRET_KEY` from the env instead of SSO — convenient for CI, but it's account-level keys, not identity-through.
 

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/README.md

@@ -5,9 +5,10 @@ own SSO identity, no passwords, no permanent keys.** Works the same for a human
 at a prompt and for another agent/script (`--json` + exit codes).
 
 ```bash
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com   # browser SSO, once
-arkclaw agents                                                        # list the claws you can chat
-arkclaw chat ci-xxxxxxxx                                              # talk to one
+arkclaw init        # one-time interactive setup (asks only what it can't auto-detect)
+arkclaw login       # browser SSO
+arkclaw agents      # list the claws you can chat
+arkclaw chat ci-xxxxxxxx
 ```
 
 ---
@@ -44,8 +45,13 @@ uv venv && uv pip install -e .
 ## Quick start
 
 ```bash
-# 1. log in to your space (a browser opens; sign in with SSO)
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com
+# 0. one-time setup — interactive. Asks for your space address and (only if the
+#    space doesn't already publish them) the CLI client + STS role. Saved to
+#    ~/.arkclaw/defaults.json so you never type them again.
+arkclaw init
+
+# 1. log in (a browser opens; sign in with SSO)
+arkclaw login
 
 # 2. see which claws you can talk to
 arkclaw agents
@@ -56,9 +62,10 @@ arkclaw chat ci-xxxxxxxx
 arkclaw chat ci-xxxxxxxx -m "用一句话介绍你自己"
 ```
 
-`login` figures out the rest from the address (your identity pool, region). If
-your space hasn't published auto-discovery yet, you may need to point it at the
-STS role once — see **[Configuration](#configuration)**.
+`arkclaw init` resolves everything it can from the address (identity pool,
+region) and only prompts for what's missing. Once your space publishes
+auto-discovery, `init` asks for nothing but the address — and you can even skip
+straight to `arkclaw login https://your-space...`. See **[Configuration](#configuration)**.
 
 ---
 
@@ -66,7 +73,8 @@ STS role once — see **[Configuration](#configuration)**.
 
 | Command | What it does |
 |---|---|
-| `arkclaw login <space-url>` | Browser SSO login. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw (otherwise the last one you opened in the browser). Bare `arkclaw login` re-logs into the previous space. |
+| `arkclaw init [address]` | One-time interactive setup. Saves the address + (only what isn't auto-discovered) the CLI client and STS role to `~/.arkclaw/defaults.json`, so later commands need no env/flags. |
+| `arkclaw login [space-url]` | Browser SSO login. Uses `init` defaults if you omit the URL. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw. Bare `arkclaw login` re-logs into the previous space. |
 | `arkclaw agents` | List the claws/agents you can chat with. |
 | `arkclaw chat [TARGET] [MSG]` | Chat. `TARGET` = a claw id (`ci-...`), an agent name (from `agents`), or a profile. With `MSG` → one-shot; without → interactive REPL. `-f` attach files, `-o` write the reply, `--session NAME` name the conversation, `--approve-all` auto-approve tool runs. |
 | `arkclaw <name>` | Shortcut: `arkclaw 答疑助手` ≡ `arkclaw chat 答疑助手`. |
@@ -137,9 +145,14 @@ arkclaw ls --clawid ci-other        # a different claw
 ## Configuration
 
 `login` resolves config in this order: **explicit flag → `ARKCLAW_*` env →
-the space's published discovery → derived from the address**. You normally only
-type the address. Until your platform publishes auto-discovery, a deployment may
-supply these (non-secret) via env:
+the space's published discovery → `arkclaw init` defaults → derived from the
+address**. You normally only type the address.
+
+**The easy way — `arkclaw init`** asks once (interactively) for whatever the
+space doesn't yet auto-publish, and saves it. After that, just `arkclaw login`.
+
+**The env way** (scripts/CI, or instead of `init`) — supply the same non-secret
+values via env:
 
 | Env | Purpose |
 |---|---|
@@ -147,7 +160,7 @@ supply these (non-secret) via env:
 | `ARKCLAW_ROLE_TRN` | STS role that mints the ChatToken (openclaw). |
 | `ARKCLAW_REGION` / `ARKCLAW_SPACE_ID` | Override region / space (usually auto). |
 
-Other config: `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
+Other config: `~/.arkclaw/defaults.json` (`init` answers, 0600), `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
 
 > **Escape hatch (admin/test):** `arkclaw login <url> --transport openclaw --static-creds` uses `VOLCENGINE_ACCESS_KEY`/`SECRET_KEY` from the env instead of SSO — convenient for CI, but it's account-level keys, not identity-through.
 

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arkclaw-webchat-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "CLI to chat with an ArkClaw EE space's Claw over enterprise SSO — zero permanent AK/SK."
 readme = "README.md"
 requires-python = ">=3.10"

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/src/ee_claw/cli.py

@@ -47,6 +47,20 @@ def _run(emitter: Emitter, fn: Callable[[], Any]) -> None:
     raise typer.Exit(emitter.ok(data))
 
 
+@app.command()
+def init(
+    address: str | None = typer.Argument(
+        None, metavar="[ADDRESS]", help="Space login URL; omit to be prompted."
+    ),
+    json_mode: bool = _json_opt(),
+) -> None:
+    """One-time interactive setup: capture the login address + (only what isn't
+    auto-discovered) the CLI client and STS role, so later `arkclaw login`
+    needs no env vars or flags. Run this once, then `arkclaw login`."""
+    emitter = Emitter(json_mode=json_mode)
+    _run(emitter, lambda: flows.do_init(emitter, address))
+
+
 @app.command()
 def login(
     address: str | None = typer.Argument(

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/src/ee_claw/config.py

@@ -176,6 +176,45 @@ def list_agent_names() -> list[str]:
     return sorted(_load_agents())
 
 
+# --- init defaults ------------------------------------------------------------
+# What `arkclaw init` captures once (interactively) so later `arkclaw login`
+# needs no env/flags: the address + the non-secret bits a platform-published
+# /.well-known/arkclaw-cli would otherwise supply. Explicit, user-set — NOT the
+# auto-learned cache. A live well-known still overrides these at login time.
+
+_DEFAULTS_FILE = "defaults.json"
+_DEFAULT_KEYS = (
+    "address", "issuer", "client_id", "transport", "region",
+    "role_trn", "provider_trn", "endpoint", "space_id", "clawid",
+)
+
+
+def _defaults_path() -> pathlib.Path:
+    return pathlib.Path.home() / ".arkclaw" / _DEFAULTS_FILE
+
+
+def load_defaults() -> dict[str, object]:
+    """`arkclaw init` config (empty dict if none). Non-secret only."""
+    path = _defaults_path()
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text())
+    except ValueError:
+        return {}
+    return {k: v for k, v in data.items() if k in _DEFAULT_KEYS and v} if isinstance(data, dict) else {}
+
+
+def save_defaults(values: dict[str, object]) -> None:
+    """Persist `arkclaw init` answers (whitelisted, non-None, non-secret)."""
+    keep = {k: v for k, v in values.items() if k in _DEFAULT_KEYS and v}
+    _dir()
+    fd = os.open(_defaults_path(), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(json.dumps(keep, ensure_ascii=False))
+    os.chmod(_defaults_path(), 0o600)
+
+
 # --- Profiles (multi-pool / multi-claw) ---------------------------------------
 # A profile is a named snapshot of the non-secret session config. Tokens are
 # keyed by space host in the secret store, so switching profiles reattaches to

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.3.0}/src/ee_claw/flows.py

@@ -105,6 +105,63 @@ def _is_userpool_address(host: str) -> bool:
     return ".userpool.auth.id." in host or host.startswith("userpool-")
 
 
+def do_init(emitter: Emitter, address: str | None = None) -> dict[str, Any]:
+    """``arkclaw init``: one-time interactive setup. Captures the login address
+    plus the bits not yet auto-discoverable (the CLI's OAuth client, the STS
+    role) so that afterwards ``arkclaw login`` needs no env vars or flags.
+    Anything the space already self-describes (issuer, region, and — once the
+    platform publishes it — client_id/role) is auto-filled and not asked."""
+    if emitter.json or not sys.stdin.isatty():
+        raise ValidationError(
+            "arkclaw init 是交互式的,需要终端。",
+            hint="在终端直接运行 `arkclaw init`;脚本里改用 env(ARKCLAW_CLIENT_ID/ROLE_TRN)+ flags。",
+        )
+
+    def ask(label: str, default: str | None = None, *, required: bool = False) -> str | None:
+        suffix = f" [{default}]" if default else ""
+        while True:
+            ans = input(f"  {label}{suffix}: ").strip() or (default or "")
+            if ans or not required:
+                return ans or None
+            emitter.line("    (必填)")
+
+    emitter.line("arkclaw init —— 一次性配置(能自动发现的不会问你)\n")
+    address = address or ask("空间登录地址 (https://…)", required=True)
+    base, host = _normalize(str(address))
+    disc = discover_cli_config(base) or {}
+    issuer = disc.get("issuer") or (f"https://{host}" if _is_userpool_address(host) else None)
+    region = disc.get("region") or derive_region(base)
+    if issuer:
+        emitter.line("  ✓ 自动发现身份池 issuer")
+    if region:
+        emitter.line(f"  ✓ 区域: {region}")
+
+    # User-facing name is "webchat" (the ChatToken/wss path); internally it's
+    # the "openclaw" transport. "a2a" is unchanged.
+    disc_t = str(disc.get("transport") or "")
+    transport_in = ask("传输方式 (webchat/a2a)", default=("a2a" if disc_t == "a2a" else "webchat")) or "webchat"
+    transport = "a2a" if transport_in.lower() == "a2a" else "openclaw"
+    client_id = disc.get("client_id") or ask(
+        "CLI client_id(public OAuth 客户端,问管理员;平台发布发现后免此项)", required=True
+    )
+    role_trn: object = None
+    endpoint: object = None
+    if transport == "openclaw":
+        role_trn = disc.get("role_trn") or ask("STS role TRN (trn:iam::<账号>:role/<名字>)", required=True)
+    else:
+        endpoint = disc.get("endpoint") or ask("A2A endpoint (https://…)", required=True)
+    clawid = disc.get("clawid") or ask("默认 claw id (ci-…,可留空,登录后用 arkclaw agents 选)")
+
+    saved = {
+        "address": base, "issuer": issuer, "client_id": client_id, "transport": transport,
+        "region": region, "role_trn": role_trn, "provider_trn": disc.get("provider_trn"),
+        "endpoint": endpoint, "space_id": disc.get("space_id"), "clawid": clawid,
+    }
+    config_mod.save_defaults(saved)
+    emitter.line("\n✓ 配置已存到 ~/.arkclaw/defaults.json。现在运行:  arkclaw login")
+    return {k: v for k, v in saved.items() if v}
+
+
 def do_login(
     url: str | None,
     emitter: Emitter,
@@ -138,31 +195,34 @@ def do_login(
     A bare ``arkclaw login`` (no URL) re-logs into the previous space,
     inheriting every non-secret setting from the last login.
     """
+    defaults = config_mod.load_defaults()  # what `arkclaw init` captured, if any
     if not url:
         prev = config_mod.load_config()
-        if not prev or not (prev.url or prev.space):
+        if prev and (prev.url or prev.space):
+            url = prev.url or f"https://{prev.space}"
+            emitter.line(f"↻ 重新登录上次的空间: {url}({prev.transport})")
+            transport = transport or prev.transport
+            endpoint = endpoint or prev.endpoint
+            region = region or prev.region
+            role_trn = role_trn or prev.role_trn
+            provider_trn = provider_trn or prev.provider_trn
+            issuer = issuer or prev.issuer
+            client_id = client_id or prev.client_id
+            clawid = clawid or prev.claw
+        elif defaults.get("address"):
+            url = str(defaults["address"])
+            emitter.line(f"↻ 用 arkclaw init 的配置登录: {url}")
+        else:
             raise ValidationError(
                 "缺少空间地址(首次登录必填)。",
-                hint="例: arkclaw login https://<space-url> [--transport a2a];"
-                "之后裸 `arkclaw login` 即可续登上次的空间。",
+                hint="先跑 `arkclaw init` 配置一次,或 `arkclaw login https://<space-url>`。",
             )
-        url = prev.url or f"https://{prev.space}"
-        emitter.line(f"↻ 重新登录上次的空间: {url}({prev.transport})")
-        transport = transport or prev.transport
-        endpoint = endpoint or prev.endpoint
-        region = region or prev.region
-        role_trn = role_trn or prev.role_trn
-        provider_trn = provider_trn or prev.provider_trn
-        issuer = issuer or prev.issuer
-        client_id = client_id or prev.client_id
-        clawid = clawid or prev.claw
     base, host = _normalize(url)
 
-    # The space self-describes via GET /.well-known/arkclaw-cli (non-secret:
-    # issuer/client_id/transport/region/space_id/role_trn/provider_trn/clawid).
-    # When the platform publishes it, the user gives ONLY the address — every
-    # field below resolves from it. Order: explicit flag > env > well-known.
-    disc = discover_cli_config(base) or {}
+    # Resolution: explicit flag > env > the space's published
+    # /.well-known/arkclaw-cli > `arkclaw init` defaults > derived. The live
+    # well-known overrides init defaults; nothing is hardcoded per space.
+    disc = {**defaults, **(discover_cli_config(base) or {})}
     transport = transport or str(disc.get("transport") or "") or "openclaw"
     clawid = clawid or disc.get("clawid")  # type: ignore[assignment]
     region = (