arkclaw-webchat-cli 0.2.0__tar.gz → 0.4.0__tar.gz

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: arkclaw-webchat-cli
-Version: 0.2.0
+Version: 0.4.0
 Summary: CLI to chat with an ArkClaw EE space's Claw over enterprise SSO — zero permanent AK/SK.
 Author: ArkClaw Team
 Keywords: arkclaw,cli,ee,openclaw,sso,sts
@@ -29,9 +29,10 @@ own SSO identity, no passwords, no permanent keys.** Works the same for a human
 at a prompt and for another agent/script (`--json` + exit codes).
 
 ```bash
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com   # browser SSO, once
-arkclaw agents                                                        # list the claws you can chat
-arkclaw chat ci-xxxxxxxx                                              # talk to one
+arkclaw init        # one-time interactive setup (asks only what it can't auto-detect)
+arkclaw login       # browser SSO
+arkclaw agents      # list the claws you can chat
+arkclaw chat ci-xxxxxxxx
 ```
 
 ---
@@ -39,7 +40,7 @@ arkclaw chat ci-xxxxxxxx                                              # talk to
 ## What it can do
 
 - **Log in as you** — browser SSO (PKCE), short-lived token, auto-refresh. No AK/SK, no client secret, nothing permanent on disk but a token in your OS keychain.
-- **List your agents** — `arkclaw agents` shows the claws you can chat with.
+- **List your agents** — `arkclaw agents` shows the claws you've chatted with (kept locally; add one with `arkclaw chat ci-...`).
 - **Chat** — interactive REPL or one-shot `-m`, streaming token-by-token, with a live "what's it doing" spinner and tool-event trace.
 - **Talk to a specific claw** — by id (`chat ci-...`) or by name (`chat 答疑助手`).
 - **Manage a claw's files** — read/write its managed workspace files (`AGENTS.md`, `SOUL.md`, `MEMORY.md`, …) with `ls` / `pull` / `push`.
@@ -68,10 +69,15 @@ uv venv && uv pip install -e .
 ## Quick start
 
 ```bash
-# 1. log in to your space (a browser opens; sign in with SSO)
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com
+# 0. one-time setup — interactive. Asks for your space address and (only if the
+#    space doesn't already publish them) the CLI client + STS role. Saved to
+#    ~/.arkclaw/defaults.json so you never type them again.
+arkclaw init
+
+# 1. log in (a browser opens; sign in with SSO)
+arkclaw login
 
-# 2. see which claws you can talk to
+# 2. list the claws you've used (empty at first — you add them by chatting)
 arkclaw agents
 
 # 3. chat — interactive…
@@ -80,9 +86,10 @@ arkclaw chat ci-xxxxxxxx
 arkclaw chat ci-xxxxxxxx -m "用一句话介绍你自己"
 ```
 
-`login` figures out the rest from the address (your identity pool, region). If
-your space hasn't published auto-discovery yet, you may need to point it at the
-STS role once — see **[Configuration](#configuration)**.
+`arkclaw init` resolves everything it can from the address (identity pool,
+region) and only prompts for what's missing. Once your space publishes
+auto-discovery, `init` asks for nothing but the address — and you can even skip
+straight to `arkclaw login https://your-space...`. See **[Configuration](#configuration)**.
 
 ---
 
@@ -90,8 +97,9 @@ STS role once — see **[Configuration](#configuration)**.
 
 | Command | What it does |
 |---|---|
-| `arkclaw login <space-url>` | Browser SSO login. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw (otherwise the last one you opened in the browser). Bare `arkclaw login` re-logs into the previous space. |
-| `arkclaw agents` | List the claws/agents you can chat with. |
+| `arkclaw init [address]` | One-time interactive setup. Saves the address + (only what isn't auto-discovered) the CLI client and STS role to `~/.arkclaw/defaults.json`, so later commands need no env/flags. |
+| `arkclaw login [space-url]` | Browser SSO login. Uses `init` defaults if you omit the URL. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw. Bare `arkclaw login` re-logs into the previous space. |
+| `arkclaw agents` | List the claws you've used from this machine (local history, newest first) + your default claw. Add a claw by chatting it once (`arkclaw chat ci-...`). Not a space-wide directory. |
 | `arkclaw chat [TARGET] [MSG]` | Chat. `TARGET` = a claw id (`ci-...`), an agent name (from `agents`), or a profile. With `MSG` → one-shot; without → interactive REPL. `-f` attach files, `-o` write the reply, `--session NAME` name the conversation, `--approve-all` auto-approve tool runs. |
 | `arkclaw <name>` | Shortcut: `arkclaw 答疑助手` ≡ `arkclaw chat 答疑助手`. |
 | `arkclaw ls` | List the claw's managed workspace files. |
@@ -161,9 +169,14 @@ arkclaw ls --clawid ci-other        # a different claw
 ## Configuration
 
 `login` resolves config in this order: **explicit flag → `ARKCLAW_*` env →
-the space's published discovery → derived from the address**. You normally only
-type the address. Until your platform publishes auto-discovery, a deployment may
-supply these (non-secret) via env:
+the space's published discovery → `arkclaw init` defaults → derived from the
+address**. You normally only type the address.
+
+**The easy way — `arkclaw init`** asks once (interactively) for whatever the
+space doesn't yet auto-publish, and saves it. After that, just `arkclaw login`.
+
+**The env way** (scripts/CI, or instead of `init`) — supply the same non-secret
+values via env:
 
 | Env | Purpose |
 |---|---|
@@ -171,7 +184,7 @@ supply these (non-secret) via env:
 | `ARKCLAW_ROLE_TRN` | STS role that mints the ChatToken (openclaw). |
 | `ARKCLAW_REGION` / `ARKCLAW_SPACE_ID` | Override region / space (usually auto). |
 
-Other config: `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
+Other config: `~/.arkclaw/defaults.json` (`init` answers, 0600), `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
 
 > **Escape hatch (admin/test):** `arkclaw login <url> --transport openclaw --static-creds` uses `VOLCENGINE_ACCESS_KEY`/`SECRET_KEY` from the env instead of SSO — convenient for CI, but it's account-level keys, not identity-through.
 

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/README.md

@@ -5,9 +5,10 @@ own SSO identity, no passwords, no permanent keys.** Works the same for a human
 at a prompt and for another agent/script (`--json` + exit codes).
 
 ```bash
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com   # browser SSO, once
-arkclaw agents                                                        # list the claws you can chat
-arkclaw chat ci-xxxxxxxx                                              # talk to one
+arkclaw init        # one-time interactive setup (asks only what it can't auto-detect)
+arkclaw login       # browser SSO
+arkclaw agents      # list the claws you can chat
+arkclaw chat ci-xxxxxxxx
 ```
 
 ---
@@ -15,7 +16,7 @@ arkclaw chat ci-xxxxxxxx                                              # talk to
 ## What it can do
 
 - **Log in as you** — browser SSO (PKCE), short-lived token, auto-refresh. No AK/SK, no client secret, nothing permanent on disk but a token in your OS keychain.
-- **List your agents** — `arkclaw agents` shows the claws you can chat with.
+- **List your agents** — `arkclaw agents` shows the claws you've chatted with (kept locally; add one with `arkclaw chat ci-...`).
 - **Chat** — interactive REPL or one-shot `-m`, streaming token-by-token, with a live "what's it doing" spinner and tool-event trace.
 - **Talk to a specific claw** — by id (`chat ci-...`) or by name (`chat 答疑助手`).
 - **Manage a claw's files** — read/write its managed workspace files (`AGENTS.md`, `SOUL.md`, `MEMORY.md`, …) with `ls` / `pull` / `push`.
@@ -44,10 +45,15 @@ uv venv && uv pip install -e .
 ## Quick start
 
 ```bash
-# 1. log in to your space (a browser opens; sign in with SSO)
-arkclaw login https://your-space.arkclaw-enterprise-bj.volceapi.com
+# 0. one-time setup — interactive. Asks for your space address and (only if the
+#    space doesn't already publish them) the CLI client + STS role. Saved to
+#    ~/.arkclaw/defaults.json so you never type them again.
+arkclaw init
+
+# 1. log in (a browser opens; sign in with SSO)
+arkclaw login
 
-# 2. see which claws you can talk to
+# 2. list the claws you've used (empty at first — you add them by chatting)
 arkclaw agents
 
 # 3. chat — interactive…
@@ -56,9 +62,10 @@ arkclaw chat ci-xxxxxxxx
 arkclaw chat ci-xxxxxxxx -m "用一句话介绍你自己"
 ```
 
-`login` figures out the rest from the address (your identity pool, region). If
-your space hasn't published auto-discovery yet, you may need to point it at the
-STS role once — see **[Configuration](#configuration)**.
+`arkclaw init` resolves everything it can from the address (identity pool,
+region) and only prompts for what's missing. Once your space publishes
+auto-discovery, `init` asks for nothing but the address — and you can even skip
+straight to `arkclaw login https://your-space...`. See **[Configuration](#configuration)**.
 
 ---
 
@@ -66,8 +73,9 @@ STS role once — see **[Configuration](#configuration)**.
 
 | Command | What it does |
 |---|---|
-| `arkclaw login <space-url>` | Browser SSO login. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw (otherwise the last one you opened in the browser). Bare `arkclaw login` re-logs into the previous space. |
-| `arkclaw agents` | List the claws/agents you can chat with. |
+| `arkclaw init [address]` | One-time interactive setup. Saves the address + (only what isn't auto-discovered) the CLI client and STS role to `~/.arkclaw/defaults.json`, so later commands need no env/flags. |
+| `arkclaw login [space-url]` | Browser SSO login. Uses `init` defaults if you omit the URL. `--transport a2a --endpoint <url>` for an agent endpoint. `--clawid ci-...` sets a default claw. Bare `arkclaw login` re-logs into the previous space. |
+| `arkclaw agents` | List the claws you've used from this machine (local history, newest first) + your default claw. Add a claw by chatting it once (`arkclaw chat ci-...`). Not a space-wide directory. |
 | `arkclaw chat [TARGET] [MSG]` | Chat. `TARGET` = a claw id (`ci-...`), an agent name (from `agents`), or a profile. With `MSG` → one-shot; without → interactive REPL. `-f` attach files, `-o` write the reply, `--session NAME` name the conversation, `--approve-all` auto-approve tool runs. |
 | `arkclaw <name>` | Shortcut: `arkclaw 答疑助手` ≡ `arkclaw chat 答疑助手`. |
 | `arkclaw ls` | List the claw's managed workspace files. |
@@ -137,9 +145,14 @@ arkclaw ls --clawid ci-other        # a different claw
 ## Configuration
 
 `login` resolves config in this order: **explicit flag → `ARKCLAW_*` env →
-the space's published discovery → derived from the address**. You normally only
-type the address. Until your platform publishes auto-discovery, a deployment may
-supply these (non-secret) via env:
+the space's published discovery → `arkclaw init` defaults → derived from the
+address**. You normally only type the address.
+
+**The easy way — `arkclaw init`** asks once (interactively) for whatever the
+space doesn't yet auto-publish, and saves it. After that, just `arkclaw login`.
+
+**The env way** (scripts/CI, or instead of `init`) — supply the same non-secret
+values via env:
 
 | Env | Purpose |
 |---|---|
@@ -147,7 +160,7 @@ supply these (non-secret) via env:
 | `ARKCLAW_ROLE_TRN` | STS role that mints the ChatToken (openclaw). |
 | `ARKCLAW_REGION` / `ARKCLAW_SPACE_ID` | Override region / space (usually auto). |
 
-Other config: `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
+Other config: `~/.arkclaw/defaults.json` (`init` answers, 0600), `~/.arkclaw/session.json` (routing, 0600), `~/.arkclaw/cmdpolicy.json` (tool-approval allow/deny), OS keychain (tokens).
 
 > **Escape hatch (admin/test):** `arkclaw login <url> --transport openclaw --static-creds` uses `VOLCENGINE_ACCESS_KEY`/`SECRET_KEY` from the env instead of SSO — convenient for CI, but it's account-level keys, not identity-through.
 

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "arkclaw-webchat-cli"
-version = "0.2.0"
+version = "0.4.0"
 description = "CLI to chat with an ArkClaw EE space's Claw over enterprise SSO — zero permanent AK/SK."
 readme = "README.md"
 requires-python = ">=3.10"

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/src/ee_claw/cli.py

@@ -47,6 +47,20 @@ def _run(emitter: Emitter, fn: Callable[[], Any]) -> None:
     raise typer.Exit(emitter.ok(data))
 
 
+@app.command()
+def init(
+    address: str | None = typer.Argument(
+        None, metavar="[ADDRESS]", help="Space login URL; omit to be prompted."
+    ),
+    json_mode: bool = _json_opt(),
+) -> None:
+    """One-time interactive setup: capture the login address + (only what isn't
+    auto-discovered) the CLI client and STS role, so later `arkclaw login`
+    needs no env vars or flags. Run this once, then `arkclaw login`."""
+    emitter = Emitter(json_mode=json_mode)
+    _run(emitter, lambda: flows.do_init(emitter, address))
+
+
 @app.command()
 def login(
     address: str | None = typer.Argument(

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/src/ee_claw/config.py

@@ -176,6 +176,45 @@ def list_agent_names() -> list[str]:
     return sorted(_load_agents())
 
 
+# --- init defaults ------------------------------------------------------------
+# What `arkclaw init` captures once (interactively) so later `arkclaw login`
+# needs no env/flags: the address + the non-secret bits a platform-published
+# /.well-known/arkclaw-cli would otherwise supply. Explicit, user-set — NOT the
+# auto-learned cache. A live well-known still overrides these at login time.
+
+_DEFAULTS_FILE = "defaults.json"
+_DEFAULT_KEYS = (
+    "address", "issuer", "client_id", "transport", "region",
+    "role_trn", "provider_trn", "endpoint", "space_id", "clawid",
+)
+
+
+def _defaults_path() -> pathlib.Path:
+    return pathlib.Path.home() / ".arkclaw" / _DEFAULTS_FILE
+
+
+def load_defaults() -> dict[str, object]:
+    """`arkclaw init` config (empty dict if none). Non-secret only."""
+    path = _defaults_path()
+    if not path.exists():
+        return {}
+    try:
+        data = json.loads(path.read_text())
+    except ValueError:
+        return {}
+    return {k: v for k, v in data.items() if k in _DEFAULT_KEYS and v} if isinstance(data, dict) else {}
+
+
+def save_defaults(values: dict[str, object]) -> None:
+    """Persist `arkclaw init` answers (whitelisted, non-None, non-secret)."""
+    keep = {k: v for k, v in values.items() if k in _DEFAULT_KEYS and v}
+    _dir()
+    fd = os.open(_defaults_path(), os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(json.dumps(keep, ensure_ascii=False))
+    os.chmod(_defaults_path(), 0o600)
+
+
 # --- Profiles (multi-pool / multi-claw) ---------------------------------------
 # A profile is a named snapshot of the non-secret session config. Tokens are
 # keyed by space host in the secret store, so switching profiles reattaches to

{arkclaw_webchat_cli-0.2.0 → arkclaw_webchat_cli-0.4.0}/src/ee_claw/flows.py

@@ -11,7 +11,6 @@ and every error is a typed :class:`~ee_claw.errors.ArkclawError`.
 from __future__ import annotations
 
 import asyncio
-import dataclasses
 import json
 import os
 import pathlib
@@ -105,6 +104,63 @@ def _is_userpool_address(host: str) -> bool:
     return ".userpool.auth.id." in host or host.startswith("userpool-")
 
 
+def do_init(emitter: Emitter, address: str | None = None) -> dict[str, Any]:
+    """``arkclaw init``: one-time interactive setup. Captures the login address
+    plus the bits not yet auto-discoverable (the CLI's OAuth client, the STS
+    role) so that afterwards ``arkclaw login`` needs no env vars or flags.
+    Anything the space already self-describes (issuer, region, and — once the
+    platform publishes it — client_id/role) is auto-filled and not asked."""
+    if emitter.json or not sys.stdin.isatty():
+        raise ValidationError(
+            "arkclaw init 是交互式的,需要终端。",
+            hint="在终端直接运行 `arkclaw init`;脚本里改用 env(ARKCLAW_CLIENT_ID/ROLE_TRN)+ flags。",
+        )
+
+    def ask(label: str, default: str | None = None, *, required: bool = False) -> str | None:
+        suffix = f" [{default}]" if default else ""
+        while True:
+            ans = input(f"  {label}{suffix}: ").strip() or (default or "")
+            if ans or not required:
+                return ans or None
+            emitter.line("    (必填)")
+
+    emitter.line("arkclaw init —— 一次性配置(能自动发现的不会问你)\n")
+    address = address or ask("空间登录地址 (https://…)", required=True)
+    base, host = _normalize(str(address))
+    disc = discover_cli_config(base) or {}
+    issuer = disc.get("issuer") or (f"https://{host}" if _is_userpool_address(host) else None)
+    region = disc.get("region") or derive_region(base)
+    if issuer:
+        emitter.line("  ✓ 自动发现身份池 issuer")
+    if region:
+        emitter.line(f"  ✓ 区域: {region}")
+
+    # User-facing name is "webchat" (the ChatToken/wss path); internally it's
+    # the "openclaw" transport. "a2a" is unchanged.
+    disc_t = str(disc.get("transport") or "")
+    transport_in = ask("传输方式 (webchat/a2a)", default=("a2a" if disc_t == "a2a" else "webchat")) or "webchat"
+    transport = "a2a" if transport_in.lower() == "a2a" else "openclaw"
+    client_id = disc.get("client_id") or ask(
+        "CLI client_id(public OAuth 客户端,问管理员;平台发布发现后免此项)", required=True
+    )
+    role_trn: object = None
+    endpoint: object = None
+    if transport == "openclaw":
+        role_trn = disc.get("role_trn") or ask("STS role TRN (trn:iam::<账号>:role/<名字>)", required=True)
+    else:
+        endpoint = disc.get("endpoint") or ask("A2A endpoint (https://…)", required=True)
+    clawid = disc.get("clawid") or ask("默认 claw id (ci-…,可留空,登录后用 arkclaw agents 选)")
+
+    saved = {
+        "address": base, "issuer": issuer, "client_id": client_id, "transport": transport,
+        "region": region, "role_trn": role_trn, "provider_trn": disc.get("provider_trn"),
+        "endpoint": endpoint, "space_id": disc.get("space_id"), "clawid": clawid,
+    }
+    config_mod.save_defaults(saved)
+    emitter.line("\n✓ 配置已存到 ~/.arkclaw/defaults.json。现在运行:  arkclaw login")
+    return {k: v for k, v in saved.items() if v}
+
+
 def do_login(
     url: str | None,
     emitter: Emitter,
@@ -138,31 +194,34 @@ def do_login(
     A bare ``arkclaw login`` (no URL) re-logs into the previous space,
     inheriting every non-secret setting from the last login.
     """
+    defaults = config_mod.load_defaults()  # what `arkclaw init` captured, if any
     if not url:
         prev = config_mod.load_config()
-        if not prev or not (prev.url or prev.space):
+        if prev and (prev.url or prev.space):
+            url = prev.url or f"https://{prev.space}"
+            emitter.line(f"↻ 重新登录上次的空间: {url}({prev.transport})")
+            transport = transport or prev.transport
+            endpoint = endpoint or prev.endpoint
+            region = region or prev.region
+            role_trn = role_trn or prev.role_trn
+            provider_trn = provider_trn or prev.provider_trn
+            issuer = issuer or prev.issuer
+            client_id = client_id or prev.client_id
+            clawid = clawid or prev.claw
+        elif defaults.get("address"):
+            url = str(defaults["address"])
+            emitter.line(f"↻ 用 arkclaw init 的配置登录: {url}")
+        else:
             raise ValidationError(
                 "缺少空间地址(首次登录必填)。",
-                hint="例: arkclaw login https://<space-url> [--transport a2a];"
-                "之后裸 `arkclaw login` 即可续登上次的空间。",
+                hint="先跑 `arkclaw init` 配置一次,或 `arkclaw login https://<space-url>`。",
             )
-        url = prev.url or f"https://{prev.space}"
-        emitter.line(f"↻ 重新登录上次的空间: {url}({prev.transport})")
-        transport = transport or prev.transport
-        endpoint = endpoint or prev.endpoint
-        region = region or prev.region
-        role_trn = role_trn or prev.role_trn
-        provider_trn = provider_trn or prev.provider_trn
-        issuer = issuer or prev.issuer
-        client_id = client_id or prev.client_id
-        clawid = clawid or prev.claw
     base, host = _normalize(url)
 
-    # The space self-describes via GET /.well-known/arkclaw-cli (non-secret:
-    # issuer/client_id/transport/region/space_id/role_trn/provider_trn/clawid).
-    # When the platform publishes it, the user gives ONLY the address — every
-    # field below resolves from it. Order: explicit flag > env > well-known.
-    disc = discover_cli_config(base) or {}
+    # Resolution: explicit flag > env > the space's published
+    # /.well-known/arkclaw-cli > `arkclaw init` defaults > derived. The live
+    # well-known overrides init defaults; nothing is hardcoded per space.
+    disc = {**defaults, **(discover_cli_config(base) or {})}
     transport = transport or str(disc.get("transport") or "") or "openclaw"
     clawid = clawid or disc.get("clawid")  # type: ignore[assignment]
     region = (
@@ -810,11 +869,16 @@ def _ago(ts: object) -> str:
 
 
 def do_agents(emitter: Emitter) -> dict[str, Any]:
-    """``arkclaw agents``: the agents/claws you can chat with — nothing else.
-    openclaw → the claws across your space(s) (space auto-discovered if login
-    didn't pin one); a2a → the agent at the endpoint (its card). Each is
-    recorded so ``chat <name>`` works. Profiles live under ``arkclaw profile``,
-    recent sessions under ``arkclaw sessions``. Human view is tabular."""
+    """``arkclaw agents``: the agents/claws you can chat with.
+
+    openclaw → the claws YOU have used from this machine (kept locally, newest
+    first), plus your default claw. This is deliberately NOT a server-side
+    enumeration of the space — that API returns every member's claws to anyone
+    (no per-user scoping is reachable by the CLI's role), so we don't call it.
+    You add a claw to this list by chatting it once: ``arkclaw chat ci-...``.
+
+    a2a → the agent at the endpoint (its card). Profiles live under ``arkclaw
+    profile``, full conversation history under ``arkclaw sessions``."""
     cfg = config_mod.load_config()
     if not cfg or not cfg.space:
         raise NoLoginError("尚未登录。", hint="先运行: arkclaw login <空间地址>")
@@ -871,73 +935,40 @@ def do_agents(emitter: Emitter) -> dict[str, Any]:
             )
     elif cfg.transport == "openclaw":
         emitter.line(f"★ 当前登录(openclaw)· 空间 {cfg.space}")
-        _, id_token = _load_session()
-        try:
-            creds: dict[str, str] | None = _openclaw_creds(cfg, id_token)
-        except ArkclawError as e:
-            creds = None
-            current["claws_error"] = {"code": e.code, "message": e.message}
-        claws: list[dict[str, Any]] = []
-        if creds is not None:
-            # Which space(s) to list? If login didn't pin a space_id, discover
-            # the user's spaces — so `agents` lists the chat-able claws from the
-            # address alone. Listing may be denied by a least-privilege role.
-            space_ids: list[str] = [str(cfg.space_id)] if cfg.space_id else []
-            if not space_ids:
-                try:
-                    spaces = control.call_action(
-                        "ListClawSpaces", {"ProjectName": "default", "MaxResults": 50},
-                        region=str(cfg.region), creds=creds,
-                    )
-                    assert isinstance(spaces, dict)
-                    space_ids = [
-                        str(s["SpaceId"]) for s in (spaces.get("Spaces") or [])
-                        if isinstance(s, dict) and s.get("SpaceId")
-                    ]
-                    if len(space_ids) == 1:  # cache it so later calls skip discovery
-                        config_mod.save_config(dataclasses.replace(cfg, space_id=space_ids[0]))
-                except ArkclawError as e:
-                    current["claws_error"] = {"code": e.code, "message": e.message}
-            for sid in space_ids:
-                try:
-                    result = redact_obj(control.call_action(
-                        "ListClawInstances",
-                        {"SpaceId": sid, "ProjectName": "default", "MaxResults": 100},
-                        region=str(cfg.region), creds=creds,
-                    ))
-                    assert isinstance(result, dict)
-                    items = result.get("Items") or result.get("ClawInstances") or []
-                    claws += [it for it in items if isinstance(it, dict)]
-                except ArkclawError as e:
-                    current["claws_error"] = {"code": e.code, "message": e.message}
+        # The claws you can chat = the ones YOU have used from this machine,
+        # remembered locally — NOT a server enumeration of the space. The
+        # space-wide ListClawInstances returns every member's claws to anyone
+        # (no per-user scoping reachable by the CLI's role), so we don't call it.
+        # New claws enter via `arkclaw chat ci-...`; each chat is recorded
+        # (record_session) and shows up here next time.
+        seen: dict[str, float] = {}
+        for s in config_mod.list_sessions():
+            cid = s.get("claw")
+            if s.get("space") == cfg.space and cid:
+                ts = s.get("last_used")
+                seen[str(cid)] = max(seen.get(str(cid), 0.0), float(ts) if isinstance(ts, (int, float)) else 0.0)
+        if cfg.claw and str(cfg.claw) not in seen:
+            seen[str(cfg.claw)] = 0.0  # the default claw, even if not chatted yet
+        claws = [
+            {"ClawInstanceId": cid, "last_used": ts}
+            for cid, ts in sorted(seen.items(), key=lambda kv: kv[1], reverse=True)
+        ]
         current["claws"] = claws
-        for it in claws:  # claw Name → chat <名字>
-            cid = it.get("ClawInstanceId") or it.get("Id")
-            if it.get("Name") and cid:
-                config_mod.record_agent(str(it["Name"]), dataclasses.replace(cfg, claw=str(cid)))
+        current["source"] = "local-history"
         if claws:
             emitter.table(
-                ["Claw(可 chat)", "名称", "状态", "默认"],
+                ["Claw(可 chat)", "上次使用", "默认"],
                 [
                     [
-                        it.get("ClawInstanceId") or it.get("Id") or "—",
-                        it.get("Name", ""),
-                        it.get("Status", ""),
-                        "★" if (it.get("ClawInstanceId") or it.get("Id")) == cfg.claw else "",
+                        str(c["ClawInstanceId"]),
+                        _ago(c["last_used"]) if c["last_used"] else "—",
+                        "★" if c["ClawInstanceId"] == cfg.claw else "",
                     ]
-                    for it in claws
+                    for c in claws
                 ],
             )
         else:
-            err = current.get("claws_error")
-            emitter.table(
-                ["Claw(可 chat)", "状态", "说明"],
-                [[
-                    cfg.claw or "(用 --clawid 直连)",
-                    "默认目标" if cfg.claw else "—",
-                    f"列表不可用: {err['code']}" if isinstance(err, dict) else "没有可用 claw",
-                ]],
-            )
+            emitter.line("  还没用过任何 claw。用 `arkclaw chat ci-xxxx` 开始,之后这里会记住它。")
 
     # `agents` is the list of agents you can chat — nothing else. Saved
     # profiles live under `arkclaw profile`, recent sessions under