goofish-cli 0.2.2__tar.gz → 0.2.4__tar.gz

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/CHANGELOG.md

@@ -6,6 +6,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [Unreleased]
 
+## [0.2.4] - 2026-04-22
+
+### Added
+- **`auth login --qr` 扫码登录兜底**（`core/qr_login.py`）：v0.2.3 的"快速进入"
+  免密登录依赖浏览器免密记忆，换机 / 长期不登 / 清 cookie 后记忆失效就没法用。
+  v0.2.4 补上扫码路径——Playwright 开干净 tmp profile goto 首页触发 passport
+  iframe（`styleType=vertical` 布局里 QR canvas 首屏就在 DOM 里，无需切 tab），
+  用户用手机闲鱼 App 扫码 + 手机确认后，轮询 `context.cookies()` 直到见到完整
+  session cookie（`_m_h5_tk / unb / cookie2`）即判成功，抓快照写回
+  `~/.goofish-cli/cookies.json`。
+  - `--qr-timeout N`（默认 120s）/ `GOOFISH_QR_TIMEOUT=N` 可调；超时抛
+    `AuthRequiredError`，提示延长超时重试。
+  - 传 `goofish_page(cookies={})` 是关键——不传空 dict 会走 `Session.load` 把
+    已有 cookie 灌进去，passport 就优先走"快速进入"跳过 QR，用户看不到扫码界面。
+  - 和 v0.2.3 refresh 自动路径分工：refresh=无感续命（SESSION_EXPIRED 时自动
+    点"快速进入"），qr_login=显式扫码（需用户拿手机）。不混用，不塞进 refresh
+    自动 retry（扫码时间不可控，会违反"无感"语义）。
+
+### Changed
+- `auth login` 新增 `--qr` / `--qr-timeout` flag；`--qr` 与 `<source>` /
+  `--raw` / `--browser` 互斥，组合使用会直接报错（QR 走独立 Playwright 浏览器，
+  同时传其它来源会让用户困惑）。
+
+## [0.2.3] - 2026-04-22
+
+### Added
+- **自动点击 passport 弹窗"快速进入"免密登录**（`core/refresh.py::_try_quick_enter`）：
+  v0.2.2 的 Playwright goto 首页在系统 Chrome 里抓出的 cookie 指纹不匹配时会弹
+  `#alibaba-login-box` 登录框，服务端拒发完整 session cookie 导致后续 mtop 报
+  `FAIL_SYS_SESSION_EXPIRED`。v0.2.3 起自动识别弹窗并点"快速进入"走浏览器免密
+  记忆登录，无需用户交互完成 session 恢复。刷新后追加访问 `/bought` 触发强鉴权页
+  下发完整 `cookie2 / sgcookie / _tb_token_`。
+- `goofish_page()` 已经支持的 `cookies=` 注入点被 refresh 复用，调用方 session
+  和浏览器上下文的登录态保持一致（承接 v0.2.2 Copilot review 的改造）。
+
+### Changed
+- mtop auto-refresh 错误码匹配从"仅 token 层"扩展到**也处理 session 层失效**
+  （`FAIL_SYS_SESSION_EXPIRED`）。`_is_token_expired_error` 重命名为
+  `_is_recoverable_auth_error`，语义更清晰。`FAIL_SYS_ILLEGAL_ACCESS` 仍不在
+  可恢复列表（风控层问题，刷 cookie 救不了）。
+
 ## [0.2.2] - 2026-04-22
 
 ### Added
@@ -86,7 +127,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - 本版本需要用户手动从浏览器导入 cookie（含 `unb` / `_m_h5_tk` / `x5sec`）
 - 遇到 `RGV587_ERROR` 风控时，需在浏览器完成滑块验证并**重新导出**带 `x5sec` 的 cookie
 
-[Unreleased]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.2...HEAD
+[Unreleased]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.4...HEAD
+[0.2.4]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.3...v0.2.4
+[0.2.3]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.2...v0.2.3
 [0.2.2]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.1...v0.2.2
 [0.2.1]: https://github.com/fancyboi999/goofish-cli/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/fancyboi999/goofish-cli/compare/v0.1.0...v0.2.0

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: goofish-cli
-Version: 0.2.2
+Version: 0.2.4
 Summary: 闲鱼 CLI — 支持 MCP，未来支持 Claude Skills。为 AI Agent 提供闲鱼自动化基础能力。
 Project-URL: Homepage, https://github.com/fancyboi999/goofish-cli
 Project-URL: Repository, https://github.com/fancyboi999/goofish-cli

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "goofish-cli"
-version = "0.2.2"
+version = "0.2.4"
 description = "闲鱼 CLI — 支持 MCP，未来支持 Claude Skills。为 AI Agent 提供闲鱼自动化基础能力。"
 readme = "README.md"
 license = { text = "Apache-2.0" }

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/src/goofish_cli/commands/auth/login.py

@@ -10,6 +10,7 @@
 - `auth login --browser edge`      指定单个浏览器
 - `auth login <path>`              从 JSON 文件导入
 - `auth login <cookie_str> --raw`  粘贴 "k=v; k=v" 字符串
+- `auth login --qr`                扫码登录（兜底：浏览器免密记忆失效 / 换机 / 首次用）
 
 触发条件：
 1. 所有浏览器都没拿到 → 报错里列出手动兜底方案
@@ -38,10 +39,34 @@ def login(
     *,
     raw: bool = False,
     browser: str = "auto",
+    qr: bool = False,
+    qr_timeout: int | None = None,
 ) -> dict[str, object]:
     target = DEFAULT_COOKIE_PATH
 
-    if source is None:
+    if qr:
+        # QR 和其它来源互斥：QR 会起独立 Playwright 浏览器，source / --raw / 指定
+        # --browser 没意义还会让用户困惑（"我传的 cookie 哪去了？"）
+        if source is not None or raw or browser != "auto":
+            raise ValueError(
+                "--qr 不能与 <source> / --raw / --browser 同时使用"
+                "（QR 走独立的 Playwright 浏览器）"
+            )
+        # qr_timeout=None 让 core.qr_login 走统一的 env → 默认值 兜底逻辑；
+        # 这里若写 int 默认（例如 120）会把 env 覆盖路径挡掉（CLI 总是显式传值）。
+        from goofish_cli.core.qr_login import login_via_qr
+        cookies = login_via_qr(timeout=qr_timeout, persist=False)
+        if not cookies:
+            # 空 dict 可能来自两种失败：超时未扫码，或 Playwright 起不来（Chrome
+            # 未装、端口占用等）。文案同时覆盖，让用户知道去翻日志。
+            raise AuthRequiredError(
+                "QR 扫码登录未完成——可能是超时内未扫码 / 手机未确认，"
+                "也可能是 Playwright 浏览器启动失败（Chrome 未装、端口占用等，"
+                "详见前面的 warning 日志）。可重试并延长超时："
+                "goofish auth login --qr --qr-timeout 180"
+            )
+        source_label = "qr"
+    elif source is None:
         if raw:
             # --raw 要求紧跟 cookie 字符串；如果没传 source，说明用户漏了参数——
             # 不能静默走浏览器 auto-detect，否则 --raw 被吞，用户会困惑。

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/src/goofish_cli/core/mtop.py

@@ -74,8 +74,10 @@ def call(
 ) -> dict[str, Any]:
     """调用 mtop 接口。返回原始 JSON。失败抛 GoofishError 子类。
 
-    `_auto_refresh=True`：遇到 `FAIL_SYS_TOKEN_EXOIRED` 时自动用 Playwright goto
-    闲鱼首页刷一次 cookie 再重试一次。递归调用时用 False 避免死循环。
+    `_auto_refresh=True`：遇到 token 层（`FAIL_SYS_TOKEN_EXOIRED`）或 session 层
+    （`FAIL_SYS_SESSION_EXPIRED`）失效时，自动用 Playwright 访问闲鱼首页 + 点
+    passport 弹窗的"快速进入"免密登录刷新 cookie 后重试一次。递归调用时置 False
+    避免死循环。
     """
     url = f"{MTOP_HOST}/h5/{api}/{version}/"
     t_ms = str(int(time.time() * 1000))
@@ -114,14 +116,16 @@ def call(
     try:
         _classify_error(raw, api)
     except AuthRequiredError as e:
-        # 只对 h5_tk 层的过期做自动刷新 —— session 级失效（FAIL_SYS_SESSION_EXPIRED
-        # / ILLEGAL_ACCESS）通常意味着 unb/cookie2 也得换，不是刷 _m_h5_tk 能救的。
-        if not (_auto_refresh and _is_token_expired_error(e)):
+        # token 层（_m_h5_tk 过期）和 session 层（cookie2/sgcookie 失效）都可以通过
+        # Playwright goto 闲鱼首页 → 点 passport 弹窗的"快速进入"免密记忆登录恢复。
+        # v0.2.3 起统一由 refresh_cookies_via_browser 处理；`ILLEGAL_ACCESS` 是风控
+        # 层面问题，刷 cookie 也救不了，不在可恢复列表内。
+        if not (_auto_refresh and _is_recoverable_auth_error(e)):
             raise
         from goofish_cli.core.refresh import is_enabled, refresh_cookies_via_browser
         if not is_enabled():
             raise
-        logger.info(f"[{api}] 检测到 _m_h5_tk 过期，尝试 Playwright goto 刷新 cookie…")
+        logger.info(f"[{api}] 检测到登录态失效，尝试 Playwright 免密登录刷新 cookie…")
         if not refresh_cookies_via_browser(session):
             raise
         # 刷新成功：重试一次，禁用递归自动刷新
@@ -134,9 +138,20 @@ def call(
     return raw
 
 
-def _is_token_expired_error(e: AuthRequiredError) -> bool:
+def _is_recoverable_auth_error(e: AuthRequiredError) -> bool:
+    """可通过 Playwright 自动刷新恢复的登录态失效错误码。
+
+    - TOKEN_EXOIRED / TOKEN_EMPTY / 令牌过期 → h5_tk 层，goto 首页即续
+    - SESSION_EXPIRED → session 层，点'快速进入'免密记忆登录恢复
+    - ILLEGAL_ACCESS → 风控层，不在此列（救不了）
+    """
     msg = str(e)
-    return any(kw in msg for kw in ("FAIL_SYS_TOKEN_EXOIRED", "FAIL_SYS_TOKEN_EMPTY", "令牌过期"))
+    return any(kw in msg for kw in (
+        "FAIL_SYS_TOKEN_EXOIRED",
+        "FAIL_SYS_TOKEN_EMPTY",
+        "FAIL_SYS_SESSION_EXPIRED",
+        "令牌过期",
+    ))
 
 
 def _classify_error(raw: dict[str, Any], api: str) -> None:

goofish_cli-0.2.4/src/goofish_cli/core/qr_login.py

@@ -0,0 +1,139 @@
+"""扫码登录——浏览器免密记忆失效时的 auth fallback。
+
+与 v0.2.3 `core/refresh.py` 的分工：
+- refresh：遇 mtop SESSION_EXPIRED 时**自动**点"快速进入"免密登录，无需用户交互。
+- qr_login：用户免密记忆彻底清空（换机 / 长期不登 / 清 cookie）时，走**扫码**
+  拿一份全新 session。必须显式触发（`auth login --qr`），因为需要用户拿手机。
+
+不把 QR 塞进 refresh 自动路径的原因：refresh 的合约是"无感续命"，扫码要用户
+参与，时间不可控，违反合约。所以两条路并存，根据"浏览器是否还认识你"自动/手动选。
+
+passport 页面（`passport.goofish.com/mini_login.htm?...&styleType=vertical`）的
+vertical 布局里扫码区和密码区并排，canvas 首屏就在 DOM 里——不用切 tab。
+
+流程：
+1. `goofish_page(cookies={})` 开**干净 tmp profile**（否则 passport 会优先走"快速
+   进入"跳过 QR）
+2. goto 首页触发 `#alibaba-login-box` iframe
+3. 等 `.qrcode-login canvas` 渲染 → QR 就绪
+4. 轮询 `context.cookies()`：看见 `_m_h5_tk / unb / cookie2` 全到位说明扫码 +
+   手机端确认都过了，抓快照返回
+5. 超时（默认 120s，`GOOFISH_QR_TIMEOUT` 可调）→ 空 dict，上层报 AuthRequiredError
+"""
+from __future__ import annotations
+
+import asyncio
+import os
+import time
+from typing import Any
+
+from loguru import logger
+
+from goofish_cli.core.session import resolve_cookie_path, write_cookies_json
+
+HOME_URL = "https://www.goofish.com"
+
+# 扫码 + 手机确认后，passport 会下发完整 session cookie。这三个齐了才算真的登上：
+# _m_h5_tk 是 h5 签名、unb 是用户 id、cookie2 是 session token。
+_REQUIRED_LOGIN_COOKIES = ("_m_h5_tk", "unb", "cookie2")
+
+_DEFAULT_QR_TIMEOUT = 120
+
+
+async def _wait_for_qr(page: Any, timeout_ms: int = 15000) -> bool:
+    """等 passport iframe 里 QR canvas 渲染出来（说明可扫）。"""
+    try:
+        iframe_el = await page.wait_for_selector("#alibaba-login-box", timeout=timeout_ms)
+    except Exception as e:  # noqa: BLE001
+        logger.warning(f"[qr] 未检测到 passport iframe：{e}（首页或许已登录？）")
+        return False
+    frame = await iframe_el.content_frame()
+    if not frame:
+        logger.warning("[qr] passport iframe content_frame 未就绪")
+        return False
+    try:
+        await frame.wait_for_load_state("domcontentloaded", timeout=5000)
+        await frame.wait_for_selector(".qrcode-login canvas", timeout=timeout_ms)
+        return True
+    except Exception as e:  # noqa: BLE001
+        logger.warning(f"[qr] QR canvas 未渲染：{e}")
+        return False
+
+
+def _has_all_login_cookies(cookies_list: list[dict[str, Any]]) -> bool:
+    names = {c.get("name") for c in cookies_list if c.get("value")}
+    return all(k in names for k in _REQUIRED_LOGIN_COOKIES)
+
+
+async def _login_via_qr_async(timeout: int) -> dict[str, str]:
+    # 延迟 import——单测环境没装 playwright 也能 import 本模块
+    from goofish_cli.core.browser import goofish_page
+
+    # cookies={} 是关键：不传空 dict 会走 Session.load 把现有登录态灌进去，
+    # passport 就优先走"快速进入"跳过 QR，用户看不到扫码界面。
+    async with goofish_page(cookies={}) as page:
+        await page.goto(HOME_URL, wait_until="domcontentloaded")
+        await page.wait_for_timeout(1500)
+
+        if not await _wait_for_qr(page):
+            return {}
+
+        logger.info(f"[qr] 请用手机闲鱼 App 扫码登录（{timeout}s 超时）")
+
+        # 轮询 cookies：扫码 → 手机确认 → passport 下发完整 session 一般 < 5s
+        deadline = time.monotonic() + timeout
+        while time.monotonic() < deadline:
+            cookies_list = await page.context.cookies()
+            if _has_all_login_cookies(cookies_list):
+                logger.info("[qr] 扫码成功，session cookies 已下发")
+                return {
+                    c["name"]: c["value"]
+                    for c in cookies_list
+                    if c.get("name") and c.get("value")
+                }
+            await asyncio.sleep(1.0)
+
+        logger.warning(f"[qr] {timeout}s 超时未登录成功")
+        return {}
+
+
+def _resolve_timeout(timeout: int | None) -> int:
+    """timeout=None 时读 env；env 未设或非整数时回退默认值（不让 CLI 崩）。"""
+    if timeout is not None:
+        return timeout
+    raw = os.environ.get("GOOFISH_QR_TIMEOUT")
+    if not raw:
+        return _DEFAULT_QR_TIMEOUT
+    try:
+        return int(raw)
+    except ValueError:
+        logger.warning(
+            f"GOOFISH_QR_TIMEOUT={raw!r} 不是整数，回退默认 {_DEFAULT_QR_TIMEOUT}s"
+        )
+        return _DEFAULT_QR_TIMEOUT
+
+
+def login_via_qr(*, timeout: int | None = None, persist: bool = True) -> dict[str, str]:
+    """阻塞：起 Playwright 让用户扫码，成功返回 cookies 并可选写回磁盘。
+
+    空 dict 表示超时或 Playwright 异常（Chrome 未装等）。
+    """
+    timeout = _resolve_timeout(timeout)
+    try:
+        cookies = asyncio.run(_login_via_qr_async(timeout))
+    except Exception as e:  # noqa: BLE001 — Playwright 起不来、Chrome 未装等都走这里
+        logger.warning(f"QR 扫码登录失败：{e}")
+        return {}
+
+    if not cookies:
+        return {}
+
+    if persist:
+        path = resolve_cookie_path()
+        try:
+            write_cookies_json(path, cookies)
+            logger.info(f"cookie 已写回 {path}")
+        except OSError as e:
+            logger.warning(f"写回 cookies.json 失败（内存里仍生效）：{e}")
+
+    return cookies

goofish_cli-0.2.4/src/goofish_cli/core/refresh.py

@@ -0,0 +1,146 @@
+"""遇 token/session 层失效时用 Playwright 自动刷新 cookie。
+
+`_m_h5_tk` 只有 10 分钟有效期，服务端在浏览器**活跃访问**闲鱼页面时通过
+`Set-Cookie` 续期；浏览器静默几分钟就会过期。mcp/cli 用 `browser_cookie3`
+从磁盘抓快照，命中"抓的时候还没过期、用的时候已过"的窗口很常见。
+
+进一步：系统 Chrome 里被 `browser_cookie3` 抓走的 cookie 注入到 Playwright
+tmp profile 后，服务端因为指纹不对会把这份 cookie 视为"半失效 session"，
+首页访问会弹 passport 登录框 —— 弹窗里有 `快速进入`（免密记忆登录）按钮，
+我们自动点一下就能让服务端重新下发完整 session cookie，整个过程用户无感。
+
+流程（v0.2.3）：
+1. goto 首页 → 可能弹 `#alibaba-login-box` 登录 iframe
+2. iframe 里定位 `快速进入` 按钮并点击（免密记忆登录）
+3. 等 modal 消失 → goto `/bought` 触发强鉴权页下发完整 session
+4. 抓 Playwright context.cookies() 作为新快照
+
+开关：`GOOFISH_AUTO_REFRESH_TOKEN=0` 可关闭（CI 或想自定义刷新策略时）。
+
+注意：闲鱼后端返回的错误码是 `FAIL_SYS_TOKEN_EXOIRED`（是 EXOIRED 不是 EXPIRED，
+拼写没写错），和 `_AUTH_KEYWORDS` / `_is_recoverable_auth_error` 匹配一致。
+"""
+from __future__ import annotations
+
+import asyncio
+import os
+from typing import Any
+
+from loguru import logger
+
+from goofish_cli.core.session import Session, resolve_cookie_path, write_cookies_json
+
+HOME_URL = "https://www.goofish.com"
+# 强鉴权页，goto 后服务端必须下发完整 session cookie（cookie2/sgcookie/_tb_token_）
+AUTH_PROBE_URL = "https://www.goofish.com/bought"
+
+# 刷新成功的必需字段：`_m_h5_tk`（h5 签名）和 `unb`（用户 id）是任何请求都要的；
+# `cookie2` 是真正的 session token —— 光有 _m_h5_tk/unb 没有 cookie2 仍会被
+# 服务端判定 SESSION_EXPIRED。所以"刷新成功"必须见到 cookie2 被下发。
+_REQUIRED_FRESH_COOKIES = ("_m_h5_tk", "unb", "cookie2")
+
+
+async def _try_quick_enter(page: Any) -> bool:
+    """闲鱼首页若弹 passport 登录框，点'快速进入'走免密记忆登录。
+
+    无弹窗 → 当作已登录返回 True。
+    有弹窗但按钮不存在或点击失败 → 返回 False（浏览器里可能连免密记忆都清空了，
+    这种情况需要扫码，不在本函数职责内，由调用方决定降级路径）。
+    """
+    iframe_el = await page.query_selector("#alibaba-login-box")
+    if not iframe_el:
+        return True
+    frame = await iframe_el.content_frame()
+    if not frame:
+        logger.debug("[refresh] alibaba-login-box iframe content_frame 未就绪")
+        return False
+    try:
+        # 显式 timeout：Playwright 默认 30s 太长，会让整个 refresh 流程卡住
+        await frame.wait_for_load_state("domcontentloaded", timeout=5000)
+        # 给 iframe 里的 Vue/React 组件一点时间 mount
+        await page.wait_for_timeout(800)
+        await frame.get_by_text("快速进入", exact=True).first.click(timeout=5000)
+        logger.info("[refresh] 点击 passport '快速进入' 免密登录")
+        await page.wait_for_selector("#alibaba-login-box", state="hidden", timeout=10000)
+        return True
+    except Exception as e:  # noqa: BLE001
+        logger.warning(f"[refresh] '快速进入'不可用（浏览器免密记忆可能已失效）：{e}")
+        return False
+
+
+async def _refresh_async(cookies: dict[str, str]) -> dict[str, str]:
+    # 延迟 import：测试环境没装 playwright 也能 import refresh 模块
+    from goofish_cli.core.browser import goofish_page
+
+    # 显式传 cookies——让 Playwright context 注入**调用方当前 session** 的登录态，
+    # 而不是让 goofish_page 再走一次 Session.load() 从磁盘拉（内存里可能已被改）。
+    async with goofish_page(cookies=cookies) as page:
+        await page.goto(HOME_URL, wait_until="domcontentloaded")
+        # 给弹窗 + mtop h5 sign 一些时间渲染
+        await page.wait_for_timeout(1500)
+
+        # 有弹窗但"快速进入"不可用 → 浏览器免密记忆彻底失效，后续 goto /bought
+        # 也只会被跳登录页。直接返回空 dict 让上层报原始 AuthRequiredError，
+        # 避免返回"只更新了 _m_h5_tk 但 session 仍失效"的假成功 cookies。
+        if not await _try_quick_enter(page):
+            return {}
+
+        # 访问强鉴权页，触发服务端下发完整 session cookies（cookie2 / sgcookie /
+        # _tb_token_ 会被 Set-Cookie 刷新）。
+        try:
+            await page.goto(AUTH_PROBE_URL, wait_until="domcontentloaded", timeout=15000)
+            await page.wait_for_timeout(1500)
+        except Exception as e:  # noqa: BLE001
+            logger.debug(f"[refresh] goto {AUTH_PROBE_URL} 异常（忽略）：{e}")
+
+        pw_cookies = await page.context.cookies()
+
+    return {c["name"]: c["value"] for c in pw_cookies if c.get("name") and c.get("value")}
+
+
+def is_enabled() -> bool:
+    return os.environ.get("GOOFISH_AUTO_REFRESH_TOKEN") != "0"
+
+
+def refresh_cookies_via_browser(session: Session, *, persist: bool = True) -> bool:
+    """用 Playwright 刷一次闲鱼 cookie 合并回 session。
+
+    流程见模块 docstring。成功返回 True，否则 False（调用方按 False 走原始
+    AuthRequiredError 让上层报给用户）。
+    """
+    current = {name: value for name, value in session.http.cookies.items() if value}
+    try:
+        fresh = asyncio.run(_refresh_async(current))
+    except Exception as e:  # noqa: BLE001 — Playwright 起不来、Chrome 未装、超时等都走这里
+        logger.warning(f"用 Playwright 刷 cookie 失败：{e}")
+        return False
+
+    missing = [k for k in _REQUIRED_FRESH_COOKIES if k not in fresh]
+    if missing:
+        logger.warning(
+            f"刷 cookie 后仍缺关键字段 {missing}（可能'快速进入'未成功或 session 未下发），"
+            f"跳过合并（拿到 {len(fresh)} 个 cookie）"
+        )
+        return False
+
+    # 关键：直接 `update(fresh)` 会造成跨 domain 同名 cookie 并存（如 .goofish.com 下
+    # 一份旧 _m_h5_tk + Playwright 又写入一份新的），后续 `cookies.get(name)` 会抛
+    # "There are multiple cookies with name"。所以先删掉所有将被更新的 name 的旧条目。
+    names_to_refresh = set(fresh.keys())
+    for cookie in list(session.http.cookies):
+        if cookie.name in names_to_refresh:
+            session.http.cookies.clear(domain=cookie.domain, path=cookie.path, name=cookie.name)
+    session.http.cookies.update(fresh)
+
+    if persist:
+        # 尊重 GOOFISH_COOKIES_PATH —— 用户配置了自定义路径时不能写默认路径后再下次
+        # Session.load 又去读自定义路径，造成"刷新了但下次启动又回到旧的"。
+        path = resolve_cookie_path()
+        # 此时 session.http.cookies 已没有同名冲突，安全转 dict
+        merged = {**dict(session.http.cookies), **fresh}
+        try:
+            write_cookies_json(path, merged)
+            logger.info(f"cookie 已刷新并写回 {path}")
+        except OSError as e:
+            logger.debug(f"写回 cookies.json 失败（内存里仍生效）：{e}")
+    return True

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/tests/test_mtop.py

@@ -38,3 +38,22 @@ def test_classify_not_found():
 
     with pytest.raises(NotFoundError):
         _classify_error({"ret": ["FAIL_BIZ_ITEM_NOT_FOUND::商品不存在"]}, "mtop.test")
+
+
+@pytest.mark.parametrize(
+    "msg,expected",
+    [
+        ("[api] 登录态失效：FAIL_SYS_TOKEN_EXOIRED::令牌过期", True),
+        ("[api] 登录态失效：FAIL_SYS_TOKEN_EMPTY::令牌为空", True),
+        ("[api] 登录态失效：FAIL_SYS_SESSION_EXPIRED::Session过期", True),
+        ("[api] 登录态失效：令牌过期", True),
+        # 风控/权限类刷 cookie 救不了，不触发自动刷新
+        ("[api] 登录态失效：FAIL_SYS_ILLEGAL_ACCESS::非法访问", False),
+        ("[api] 未找到：FAIL_BIZ_ITEM_NOT_FOUND", False),
+    ],
+)
+def test_is_recoverable_auth_error(msg, expected):
+    from goofish_cli.core.errors import AuthRequiredError
+    from goofish_cli.core.mtop import _is_recoverable_auth_error
+
+    assert _is_recoverable_auth_error(AuthRequiredError(msg)) is expected

goofish_cli-0.2.4/tests/test_qr_login.py

@@ -0,0 +1,129 @@
+"""测 qr_login 模块。Playwright 走真浏览器不进单测，mock 掉 asyncio.run。"""
+from __future__ import annotations
+
+from unittest.mock import patch
+
+import pytest
+
+from goofish_cli.core import qr_login
+
+
+def _fake_run(result):
+    """模拟 asyncio.run：close 掉传入的 coroutine（避免 unawaited warning）后返回结果。"""
+    def _inner(coro):
+        coro.close()
+        return result
+    return _inner
+
+
+def _fake_run_raises(exc):
+    def _inner(coro):
+        coro.close()
+        raise exc
+    return _inner
+
+
+def test_login_via_qr_success_writes_disk(tmp_path, monkeypatch):
+    monkeypatch.setenv("GOOFISH_COOKIES_PATH", str(tmp_path / "cookies.json"))
+    fake = {"_m_h5_tk": "t", "unb": "u", "cookie2": "c", "sgcookie": "s"}
+    with patch.object(qr_login, "asyncio") as mock_async:
+        mock_async.run.side_effect = _fake_run(fake)
+        out = qr_login.login_via_qr(timeout=10, persist=True)
+
+    assert out == fake
+    assert (tmp_path / "cookies.json").exists()
+
+
+def test_login_via_qr_success_no_persist(tmp_path, monkeypatch):
+    monkeypatch.setenv("GOOFISH_COOKIES_PATH", str(tmp_path / "cookies.json"))
+    fake = {"_m_h5_tk": "t", "unb": "u", "cookie2": "c"}
+    with patch.object(qr_login, "asyncio") as mock_async:
+        mock_async.run.side_effect = _fake_run(fake)
+        out = qr_login.login_via_qr(timeout=10, persist=False)
+
+    assert out == fake
+    assert not (tmp_path / "cookies.json").exists()
+
+
+def test_login_via_qr_timeout_returns_empty(tmp_path, monkeypatch):
+    monkeypatch.setenv("GOOFISH_COOKIES_PATH", str(tmp_path / "cookies.json"))
+    with patch.object(qr_login, "asyncio") as mock_async:
+        mock_async.run.side_effect = _fake_run({})  # 模拟超时没拿到 cookies
+        out = qr_login.login_via_qr(timeout=5, persist=True)
+
+    assert out == {}
+    # 空结果不应写盘
+    assert not (tmp_path / "cookies.json").exists()
+
+
+def test_login_via_qr_swallows_playwright_exception():
+    with patch.object(qr_login, "asyncio") as mock_async:
+        mock_async.run.side_effect = _fake_run_raises(RuntimeError("chrome not installed"))
+        out = qr_login.login_via_qr(timeout=5, persist=False)
+    assert out == {}
+
+
+def test_login_via_qr_respects_env_timeout(monkeypatch):
+    """timeout=None 时读 GOOFISH_QR_TIMEOUT，传给 _login_via_qr_async。"""
+    monkeypatch.setenv("GOOFISH_QR_TIMEOUT", "30")
+    captured: list[int] = []
+
+    async def _record(t):
+        captured.append(t)
+        return {}
+
+    monkeypatch.setattr(qr_login, "_login_via_qr_async", _record)
+    out = qr_login.login_via_qr(persist=False)
+
+    assert captured == [30]
+    assert out == {}
+
+
+def test_login_via_qr_env_invalid_falls_back(monkeypatch):
+    """Copilot review：env 非整数不能让命令崩，要 warn + 回退默认。"""
+    monkeypatch.setenv("GOOFISH_QR_TIMEOUT", "not-a-number")
+    captured: list[int] = []
+
+    async def _record(t):
+        captured.append(t)
+        return {}
+
+    monkeypatch.setattr(qr_login, "_login_via_qr_async", _record)
+    # 不应抛 ValueError
+    out = qr_login.login_via_qr(persist=False)
+
+    assert captured == [qr_login._DEFAULT_QR_TIMEOUT]
+    assert out == {}
+
+
+def test_login_via_qr_explicit_timeout_wins_over_env(monkeypatch):
+    """显式传 timeout 时不读 env。"""
+    monkeypatch.setenv("GOOFISH_QR_TIMEOUT", "999")
+    captured: list[int] = []
+
+    async def _record(t):
+        captured.append(t)
+        return {}
+
+    monkeypatch.setattr(qr_login, "_login_via_qr_async", _record)
+    qr_login.login_via_qr(timeout=42, persist=False)
+
+    assert captured == [42]
+
+
+@pytest.mark.parametrize(
+    "cookies,expected",
+    [
+        ([{"name": "_m_h5_tk", "value": "a"},
+          {"name": "unb", "value": "b"},
+          {"name": "cookie2", "value": "c"}], True),
+        ([{"name": "_m_h5_tk", "value": "a"},
+          {"name": "unb", "value": "b"}], False),  # 缺 cookie2
+        ([{"name": "_m_h5_tk", "value": "a"},
+          {"name": "unb", "value": ""},  # unb 为空等于没有
+          {"name": "cookie2", "value": "c"}], False),
+        ([], False),
+    ],
+)
+def test_has_all_login_cookies(cookies, expected):
+    assert qr_login._has_all_login_cookies(cookies) is expected

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/tests/test_refresh.py

@@ -74,7 +74,7 @@ def test_refresh_respects_custom_cookie_path(tmp_path, monkeypatch):
     monkeypatch.setenv("GOOFISH_COOKIES_PATH", str(custom))
 
     session = _make_session({"_m_h5_tk": "old", "unb": "u1"})
-    fresh = {"_m_h5_tk": "new", "unb": "u1"}
+    fresh = {"_m_h5_tk": "new", "unb": "u1", "cookie2": "c"}
     with patch.object(refresh, "asyncio") as mock_async:
         mock_async.run.side_effect = _fake_run(fresh)
         ok = refresh.refresh_cookies_via_browser(session)
@@ -85,6 +85,23 @@ def test_refresh_respects_custom_cookie_path(tmp_path, monkeypatch):
     assert not (tmp_path / "cookies.json").exists()
 
 
+def test_refresh_fails_when_cookie2_missing(tmp_path, monkeypatch):
+    """cookie2 是真正的 session token，缺它必须判失败（v0.2.3 Copilot review）。"""
+    session = _make_session({"_m_h5_tk": "old", "unb": "u1", "cookie2": "old_c"})
+    monkeypatch.setenv("GOOFISH_COOKIES_PATH", str(tmp_path / "cookies.json"))
+
+    # fresh 有 _m_h5_tk / unb 但无 cookie2 —— 过去会误判成功，现在必须 False
+    fresh = {"_m_h5_tk": "new", "unb": "u1"}
+    with patch.object(refresh, "asyncio") as mock_async:
+        mock_async.run.side_effect = _fake_run(fresh)
+        ok = refresh.refresh_cookies_via_browser(session)
+
+    assert ok is False
+    # 旧 cookie 不能被覆盖
+    assert session.http.cookies.get("_m_h5_tk") == "old"
+    assert not (tmp_path / "cookies.json").exists()
+
+
 def test_refresh_swallows_playwright_exception():
     session = _make_session({"_m_h5_tk": "old", "unb": "u1"})
     with patch.object(refresh, "asyncio") as mock_async:

{goofish_cli-0.2.2 → goofish_cli-0.2.4}/uv.lock

@@ -307,7 +307,7 @@ wheels = [
 
 [[package]]
 name = "goofish-cli"
-version = "0.2.2"
+version = "0.2.4"
 source = { editable = "." }
 dependencies = [
     { name = "browser-cookie3" },

goofish_cli-0.2.2/src/goofish_cli/core/refresh.py

@@ -1,80 +0,0 @@
-"""遇 FAIL_SYS_TOKEN_EXOIRED 时用 Playwright goto 闲鱼首页刷新 cookie。
-
-`_m_h5_tk` 只有 10 分钟有效期，服务端在浏览器**活跃访问**闲鱼页面时通过
-`Set-Cookie` 续期；浏览器静默几分钟就会过期。mcp/cli 用 `browser_cookie3`
-从磁盘抓快照，命中"抓的时候还没过期、用的时候已过"的窗口很常见。
-
-与其让用户手动去浏览器刷新，不如我们自己用 Playwright `goto` 一次首页——
-反正 search/item view 的浏览器基础设施已经搭好了，直接复用。
-
-开关：`GOOFISH_AUTO_REFRESH_TOKEN=0` 可关闭（CI 或想自定义刷新策略时）。
-
-注意：闲鱼后端返回的错误码是 `FAIL_SYS_TOKEN_EXOIRED`（是 EXOIRED 不是 EXPIRED，
-拼写没写错），和 `_AUTH_KEYWORDS` / `_is_token_expired_error` 匹配一致。
-"""
-from __future__ import annotations
-
-import asyncio
-import os
-
-from loguru import logger
-
-from goofish_cli.core.session import Session, resolve_cookie_path, write_cookies_json
-
-
-async def _refresh_async(url: str, cookies: dict[str, str]) -> dict[str, str]:
-    # 延迟 import：测试环境没装 playwright 也能 import refresh 模块
-    from goofish_cli.core.browser import goofish_page
-
-    # 显式传 cookies——让 Playwright context 注入**调用方当前 session** 的登录态，
-    # 而不是让 goofish_page 再走一次 Session.load() 从磁盘拉（内存里可能已被改）。
-    async with goofish_page(cookies=cookies) as page:
-        await page.goto(url, wait_until="domcontentloaded")
-        # 给 mtop h5 sign 一些时间跑完并让服务端 Set-Cookie 新 _m_h5_tk
-        await page.wait_for_timeout(1500)
-        pw_cookies = await page.context.cookies()
-
-    return {c["name"]: c["value"] for c in pw_cookies if c.get("name") and c.get("value")}
-
-
-def is_enabled() -> bool:
-    return os.environ.get("GOOFISH_AUTO_REFRESH_TOKEN") != "0"
-
-
-def refresh_cookies_via_browser(session: Session, *, persist: bool = True) -> bool:
-    """用 Playwright goto 一次闲鱼首页拿新 cookie 并合并回 session。
-
-    成功返回 True，否则 False（调用方按 False 走原始 AuthRequiredError）。
-    """
-    current = {name: value for name, value in session.http.cookies.items() if value}
-    try:
-        fresh = asyncio.run(_refresh_async("https://www.goofish.com", current))
-    except Exception as e:  # noqa: BLE001 — Playwright 起不来、Chrome 未装、超时等都走这里
-        logger.warning(f"用 Playwright 刷 cookie 失败：{e}")
-        return False
-
-    if "_m_h5_tk" not in fresh or "unb" not in fresh:
-        logger.warning(f"刷 cookie 后仍缺关键字段，跳过合并（拿到 {len(fresh)} 个 cookie）")
-        return False
-
-    # 关键：直接 `update(fresh)` 会造成跨 domain 同名 cookie 并存（如 .goofish.com 下
-    # 一份旧 _m_h5_tk + Playwright 又写入一份新的），后续 `cookies.get(name)` 会抛
-    # "There are multiple cookies with name"。所以先删掉所有将被更新的 name 的旧条目。
-    names_to_refresh = set(fresh.keys())
-    for cookie in list(session.http.cookies):
-        if cookie.name in names_to_refresh:
-            session.http.cookies.clear(domain=cookie.domain, path=cookie.path, name=cookie.name)
-    session.http.cookies.update(fresh)
-
-    if persist:
-        # 尊重 GOOFISH_COOKIES_PATH —— 用户配置了自定义路径时不能写默认路径后再下次
-        # Session.load 又去读自定义路径，造成"刷新了但下次启动又回到旧的"。
-        path = resolve_cookie_path()
-        # 此时 session.http.cookies 已没有同名冲突，安全转 dict
-        merged = {**dict(session.http.cookies), **fresh}
-        try:
-            write_cookies_json(path, merged)
-            logger.info(f"cookie 已刷新并写回 {path}")
-        except OSError as e:
-            logger.debug(f"写回 cookies.json 失败（内存里仍生效）：{e}")
-    return True