hap-cli 0.8.19__tar.gz → 0.8.21__tar.gz

{hap_cli-0.8.19 → hap_cli-0.8.21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: hap-cli
-Version: 0.8.19
+Version: 0.8.21
 Summary: CLI harness for Mingdao HAP - Enterprise no-code platform
 Author: hap-cli
 License: Apache-2.0
@@ -313,6 +313,7 @@ discover every subcommand.
 | `config show` | Display the current configuration summary |
 | `config completion [bash\|zsh\|fish] [--install]` | Enable `<Tab>` completion |
 | `config language [LANG]` | Switch UI language (`en` / `zh-Hans` / `zh-Hant` / `ja`) |
+| `config update [auto\|notify\|off]` | Self-upgrade mode; `notify` only reports, `off` never checks |
 | `config log on / off / status` | Toggle and inspect API logging |
 | `config log level LEVEL` | `DEBUG / INFO / WARNING / ERROR / CRITICAL` |
 | `config log view [--lines N] [--no-follow]` | Tail the log file |

{hap_cli-0.8.19/hap_cli → hap_cli-0.8.21}/README.md

@@ -284,6 +284,7 @@ discover every subcommand.
 | `config show` | Display the current configuration summary |
 | `config completion [bash\|zsh\|fish] [--install]` | Enable `<Tab>` completion |
 | `config language [LANG]` | Switch UI language (`en` / `zh-Hans` / `zh-Hant` / `ja`) |
+| `config update [auto\|notify\|off]` | Self-upgrade mode; `notify` only reports, `off` never checks |
 | `config log on / off / status` | Toggle and inspect API logging |
 | `config log level LEVEL` | `DEBUG / INFO / WARNING / ERROR / CRITICAL` |
 | `config log view [--lines N] [--no-follow]` | Tail the log file |

{hap_cli-0.8.19 → hap_cli-0.8.21/hap_cli}/README.md

@@ -284,6 +284,7 @@ discover every subcommand.
 | `config show` | Display the current configuration summary |
 | `config completion [bash\|zsh\|fish] [--install]` | Enable `<Tab>` completion |
 | `config language [LANG]` | Switch UI language (`en` / `zh-Hans` / `zh-Hant` / `ja`) |
+| `config update [auto\|notify\|off]` | Self-upgrade mode; `notify` only reports, `off` never checks |
 | `config log on / off / status` | Toggle and inspect API logging |
 | `config log level LEVEL` | `DEBUG / INFO / WARNING / ERROR / CRITICAL` |
 | `config log view [--lines N] [--no-follow]` | Tail the log file |

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/README_CN.md

@@ -258,6 +258,7 @@ hap --json worksheet record list WORKSHEET_ID
 | `config show` | 显示 CLI 配置摘要 |
 | `config completion [bash\|zsh\|fish] [--install]` | 启用 `<Tab>` 补全 |
 | `config language [LANG]` | 切换显示语言（`en` / `zh-Hans` / `zh-Hant` / `ja`） |
+| `config update [auto\|notify\|off]` | 自动升级开关；`notify` 只提示不安装，`off` 不检查 |
 | `config log on / off / status` | 日志开关与状态 |
 | `config log level LEVEL` | 设置日志级别（`DEBUG/INFO/WARNING/ERROR/CRITICAL`） |
 | `config log view [--lines N] [--no-follow]` | 跟踪日志文件 |

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/__init__.py

@@ -1,3 +1,3 @@
 """CLI harness for Mingdao HAP (hap-cli)."""
 
-__version__ = "0.8.19"
+__version__ = "0.8.21"

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/commands/config_cmd.py

@@ -122,6 +122,8 @@ def config_completion(shell, install):
 @pass_context
 def config_show(ctx):
     """Display current harness configuration."""
+    from hap_cli.core.update import get_update_mode
+
     log_cfg = load_logging_config()
     data = {
         "logging": {
@@ -129,6 +131,7 @@ def config_show(ctx):
             "level": log_cfg["level"],
             "file": str(resolve_log_path(log_cfg)),
         },
+        "update": get_update_mode(),
     }
 
     def _human(d):
@@ -136,6 +139,7 @@ def config_show(ctx):
         click.echo(f"  enabled : {d['logging']['enabled']}")
         click.echo(f"  level   : {d['logging']['level']}")
         click.echo(f"  file    : {d['logging']['file']}")
+        click.echo(f"update    : {d['update']}")
 
     ctx.output(data, _human)
 
@@ -205,6 +209,46 @@ def log_status(ctx):
     _echo_log_status(ctx, cfg)
 
 
+# ── `hap config update` ───────────────────────────────────────────────────
+
+
+@config.command("update")
+@click.argument(
+    "mode", required=False, type=click.Choice(["auto", "notify", "off"]),
+)
+@pass_context
+def config_update(ctx, mode):
+    """Control whether hap-cli upgrades itself.
+
+    \b
+      auto    check hourly and install new versions (default)
+      notify  check hourly and tell you, but never install
+      off     never check
+
+    Use ``notify`` or ``off`` to pin the version in scripted or
+    production environments. Without an argument, shows the current
+    setting. ``hap update`` still upgrades on demand in every mode.
+    """
+    from hap_cli.core.session import load_config, save_config
+    from hap_cli.core.update import get_update_mode
+
+    if mode is None:
+        current = get_update_mode()
+        if ctx.json_mode:
+            from hap_cli.utils.formatting import output_json
+            output_json({"update": current})
+        else:
+            click.echo(f"Self-update: {current}")
+        return
+
+    save_config({"update": mode})
+    if ctx.json_mode:
+        from hap_cli.utils.formatting import output_json
+        output_json({"status": "ok", "update": mode})
+    else:
+        click.echo(f"Self-update set to: {mode}")
+
+
 # ── `hap config language` ─────────────────────────────────────────────────
 
 

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/action_spec_adapter.py

@@ -110,9 +110,15 @@ def build_button_payload(spec: dict[str, Any]) -> dict[str, Any]:
         # in the UI; for the dedicated 二次确认 button use clickType 2.
         if out["clickType"] == 1 and confirm:
             out["clickType"] = 2
-        out["confirmMsg"] = confirm_msg or "你确认执行此操作吗？"
-        out["sureName"] = spec.get("sureName", "确认")
-        out["cancelName"] = spec.get("cancelName", "取消")
+        # Dialog text is stored on the button itself, so it must be
+        # written in the application's language, not ours. Follows the
+        # active CLI language; an explicit value always wins.
+        from hap_cli.i18n import content_default
+
+        out["confirmMsg"] = confirm_msg or content_default("button.confirmMsg")
+        out["sureName"] = spec.get("sureName") or content_default("button.sure")
+        out["cancelName"] = (
+            spec.get("cancelName") or content_default("button.cancel"))
 
     # enableWhen → filters (reuse the shared filter translator).
     enable_when = spec.get("enableWhen")

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/flow_node.py

@@ -394,27 +394,50 @@ def save_node(
     if select_node_id:
         data["selectNodeId"] = select_node_id
     data.update(config)
-    # Branch items (flowNodeType 2) have an asymmetric read/write key for
-    # their filter: getNodeDetail returns it as ``conditions`` (see
-    # pd-openweb Branch/index.jsx, which reads ``result.conditions``), but
-    # saveNode only persists it under ``operateCondition`` (the same file
-    # sends ``saveNode({ operateCondition: data })``). The value shape is
-    # identical. Saving with the read-side ``conditions`` key is silently
-    # ignored by the server — the save still reports success but the
-    # condition is dropped. Accept the read key so copying a node's
-    # read structure straight back round-trips correctly.
-    if flow_node_type == 2 and "conditions" in data:
-        if "operateCondition" not in data:
-            data["operateCondition"] = data["conditions"]
-            logger.info(
-                "save_node: branch item %s — mapped read-side key "
-                "'conditions' to write-side 'operateCondition'", node_id)
-        # ``conditions`` is not a saveNode key; drop it so it doesn't ride
-        # along as dead weight.
-        data.pop("conditions", None)
+    _map_read_side_keys(data, node_id)
     return session.workflow_call("flowNode/saveNode", data)
 
 
+# Node config keys whose read form differs from their write form. Reading
+# a node, editing one value and writing it back is the natural way to work
+# with these APIs, but the server ignores the read-side key on save — the
+# call still reports success while the value is dropped.
+#
+# The filter is asymmetric on every filtering node in pd-openweb, not just
+# on branches: the component holds it as ``conditions`` and posts it as
+# ``operateCondition``, with an identical value shape.
+#     Branch/index.jsx:184         saveNode({ operateCondition: conditions })
+#     GetMoreRecord/index.jsx:184  saveNode({ operateCondition: conditions })
+#     Search/index.jsx:190         saveNode({ operateCondition: conditions })
+#     FindSystem/index.jsx:110     saveNode({ operateCondition: conditions })
+# ``conditions`` is never itself a saveNode key, so translating it is safe
+# for any node type.
+_READ_TO_WRITE_KEYS = {
+    "conditions": "operateCondition",
+}
+
+
+def _map_read_side_keys(data: dict[str, Any], node_id: str) -> None:
+    """Rewrite read-side config keys to the keys saveNode persists.
+
+    An explicit write-side key always wins; the read-side key is then
+    dropped either way so it cannot ride along as dead weight.
+    """
+    for read_key, write_key in _READ_TO_WRITE_KEYS.items():
+        if read_key not in data:
+            continue
+        if write_key in data:
+            logger.info(
+                "save_node: node %s carries both '%s' and '%s'; keeping "
+                "the write-side value", node_id, read_key, write_key)
+        else:
+            data[write_key] = data[read_key]
+            logger.info(
+                "save_node: node %s — mapped read-side key '%s' to "
+                "write-side '%s'", node_id, read_key, write_key)
+        data.pop(read_key, None)
+
+
 # ── Testing ──────────────────────────────────────────────────────────────
 
 

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/record.py

@@ -1,6 +1,7 @@
 """Record CRUD module for Mingdao HAP."""
 
 import json
+import logging
 import uuid
 from typing import Any, Optional
 
@@ -8,6 +9,8 @@ from hap_cli.core.session import Session, APIError
 from hap_cli.core import worksheet as ws_mod
 from hap_cli.core import global_meta as gm
 
+logger = logging.getLogger("hap_cli.record")
+
 # Discussion source types — pd-openweb src/components/comment/config.js
 #   WORKSHEET    = 7  whole-worksheet discussion
 #   WORKSHEETROW = 8  single record/row discussion
@@ -383,6 +386,41 @@ def _legacy_cell_value(ctrl: dict[str, Any], value: Any) -> str:
     return "" if value is None else str(value)
 
 
+def _controls_for_write(
+    session: Session, worksheet_id: str,
+) -> list[dict[str, Any]]:
+    """Fetch the worksheet's controls for a write, refusing an empty list.
+
+    Every write path type-encodes its cells against this metadata, so an
+    empty list silently disables the encoder: option/member/relation/
+    sub-table values would all take the "unknown field -> send the raw
+    value" fallback and reach the server in whatever shape the caller
+    happened to type. That is how a hand-written 1-D sub-table value
+    (``[{childControlId: value}, ...]``) escaped to the server and failed
+    deserialization into ``List<Cell>`` — the encoder would otherwise have
+    rewritten it to the 2-D form.
+
+    ``get_worksheet_controls`` answers ``[]`` for any response that does
+    not carry a ``controls`` list — a soft failure, ``data: null``, or a
+    permission-degraded envelope — none of which raise. A real worksheet
+    always has controls, so an empty list means "we could not read the
+    fields", never "this worksheet has none". Abort before writing.
+    """
+    controls = ws_mod.get_worksheet_controls(session, worksheet_id)
+    if not controls:
+        logger.warning(
+            "GetWorksheetControls returned no fields for worksheet %s; "
+            "aborting the write instead of sending unencoded cells",
+            worksheet_id,
+        )
+        raise ValueError(
+            f"Could not read the fields of worksheet {worksheet_id}, so "
+            "nothing was written. Check the worksheet id and that your "
+            "account can open it, then try again."
+        )
+    return controls
+
+
 def encode_controls_by_id(
     session: Session,
     worksheet_id: str,
@@ -419,7 +457,7 @@ def encode_controls_by_id(
     (in-place edits keyed by ``rowid``, fresh adds, and deletes — see
     :func:`_sublist_update_value`).
     """
-    controls = ws_mod.get_worksheet_controls(session, worksheet_id)
+    controls = _controls_for_write(session, worksheet_id)
     by_id: dict[str, dict[str, Any]] = {
         c.get("controlId"): c for c in controls if c.get("controlId")
     }
@@ -434,6 +472,14 @@ def encode_controls_by_id(
         raw = rc.get("value")
         ctrl = by_id.get(cid) or by_ref.get(cid)
         if ctrl is None:
+            # Deliberate escape hatch (see docstring), but a value that
+            # skips the type encoder is exactly how a malformed cell
+            # reaches the server, so leave a trace: this is the only
+            # place a write can go out unencoded.
+            logger.warning(
+                "Field %r is not on worksheet %s; its value is sent "
+                "unencoded (no type conversion applied)", cid, worksheet_id,
+            )
             out.append({"controlId": cid, "value": raw})
             continue
         out.append({
@@ -603,7 +649,7 @@ def batch_create_by_name(
     by child controlId; single/multi select -> option keys; etc.).
     Evidence: hap_cli/tests/answer_create_record.md.
     """
-    controls = ws_mod.get_worksheet_controls(session, worksheet_id)
+    controls = _controls_for_write(session, worksheet_id)
     by_name: dict[str, dict[str, Any]] = {}
     for c in controls:
         for key in (c.get("controlName"), c.get("alias"),
@@ -662,7 +708,7 @@ def batch_update_by_name(
     :func:`_sublist_update_value`). Record updates never use the V3
     rows endpoint — V3 silently drops relation / sub-table cells.
     """
-    controls = ws_mod.get_worksheet_controls(session, worksheet_id)
+    controls = _controls_for_write(session, worksheet_id)
     by_name: dict[str, dict[str, Any]] = {}
     for c in controls:
         for key in (c.get("controlName"), c.get("alias"),
@@ -785,6 +831,35 @@ def get_record(
     return session.api_call("Worksheet", "GetRowDetail", data)
 
 
+# The main-site record endpoints have no workflow-suppression parameter.
+# pd-openweb documents UpdateWorksheetRow as worksheetId / rowId /
+# newOldControl / viewId / instanceId / workId / btnId / btnRemark /
+# btnWorksheetId / btnRowId / pushUniqueId / rowStatus / updateType
+# (src/api/worksheet.js:535-548), and AddWorksheetRow likewise has none.
+# ``triggerWorkflow`` belongs to the open API v2 (worksheet/addRow,
+# worksheet/editRow) — a different transport. We used to send it anyway;
+# the main site accepted the body and ignored the flag, so the workflows
+# ran while the caller believed they had been suppressed (confirmed live:
+# a record-update flow stamped its field on an update sent with
+# triggerWorkflow: false).
+#
+# Record writes cannot simply move to the open API: it silently drops
+# RELATE_SHEET / SUB_LIST cells. Until there is a real way to suppress,
+# refusing is the only honest answer — anyone reaching for this is trying
+# to edit data *safely*, and quietly doing the unsafe thing is worse than
+# failing.
+def _reject_workflow_suppression(trigger_workflow: bool) -> None:
+    if trigger_workflow:
+        return
+    raise ValueError(
+        "Workflows cannot be suppressed for this write — they will run "
+        "whatever this command does, so the option is refused rather than "
+        "ignored. To edit records without them, turn the workflow off "
+        "first (hap workflow publish <id> --disable), make the change, "
+        "then turn it back on."
+    )
+
+
 def create_record(
     session: Session,
     worksheet_id: str,
@@ -802,13 +877,13 @@ def create_record(
     Returns:
         Created record info
     """
+    _reject_workflow_suppression(trigger_workflow)
     return session.api_call(
         "Worksheet",
         "AddWorksheetRow",
         {
             "worksheetId": worksheet_id,
             "receiveControls": controls,
-            "triggerWorkflow": trigger_workflow,
         },
     )
 
@@ -832,6 +907,7 @@ def update_record(
     Returns:
         Update result
     """
+    _reject_workflow_suppression(trigger_workflow)
     return session.api_call(
         "Worksheet",
         "UpdateWorksheetRow",
@@ -839,7 +915,6 @@ def update_record(
             "worksheetId": worksheet_id,
             "rowId": row_id,
             "newOldControl": controls,
-            "triggerWorkflow": trigger_workflow,
         },
     )
 

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/session.py

@@ -360,11 +360,19 @@ class Session:
         from hap_cli.core import cli_access
 
         cli_access.ensure_before_request(self, url)
+        from hap_cli.i18n import get_active_language
+
         headers = {
             "Content-Type": "application/json",
             "Authorization": f"md_pss_id {self.auth_token}",
             "X-Requested-With": "XMLHttpRequest",
             "User-Agent": hap_user_agent(),
+            # Give the server the language context it otherwise has to
+            # guess at. Defaults the server fills in (hints, template
+            # text) were coming back in Simplified Chinese for
+            # all-English applications because API requests carried no
+            # language at all — the browser always sends one.
+            "Accept-Language": get_active_language(),
         }
         # pd-openweb sends the caller's own accountId on every request
         # (``src/common/global.js`` ``disposeRequestParams``). Some
@@ -529,28 +537,39 @@ class Session:
         # Detect each and unwrap accordingly.
         if not isinstance(result, dict):
             return result
+        # A non-empty ``exception`` means the call failed, whatever envelope
+        # it arrived in. This is the frontend's own and only test — mdyAPI
+        # rejects on ``if (responseData.exception)`` alone and never looks at
+        # ``status`` (pd-openweb src/common/global.js:846-849). Checking it
+        # before any unwrapping is what makes workflow failures visible: the
+        # workflow envelope has no ``state``, so it used to skip the error
+        # branch entirely and hand the caller a "successful" empty result.
+        exception_msg = str(result.get("exception", "") or "")
+        if exception_msg:
+            code = result.get("code", result.get("state"))
+            # Some HAP deployments tunnel auth failures through the exception
+            # text/code instead of HTTP 401. Surface those as
+            # AuthenticationError so the CLI shows the login hint.
+            if _looks_like_auth_failure(code, exception_msg):
+                raise AuthenticationError(exception_msg, status_code=None)
+            raise APIError(exception_msg, code=code)
         if "status" in result and "data" in result and "state" not in result:
-            # Workflow envelope. status==0 is "ok" here historically; we
-            # don't have a clean way to detect failures via status alone,
-            # so we just unwrap data and trust HTTP status for errors.
+            # Workflow envelope: ``status`` carries no success/failure
+            # semantics (the frontend ignores it), and a failure would have
+            # been caught by the exception check above.
             return result.get("data", result)
         if "state" not in result:
             return result
         if result.get("state") == 0:
-            exception_msg = str(result.get("exception", "") or "")
             code = result.get("code")
-            # Some HAP deployments tunnel auth failures through state=0 with
-            # specific codes/messages instead of HTTP 401. Surface those as
-            # AuthenticationError too so the CLI shows the login hint.
-            if _looks_like_auth_failure(code, exception_msg):
+            # state=0 with no exception text — still a failure, just an
+            # unlabelled one.
+            if _looks_like_auth_failure(code, ""):
                 raise AuthenticationError(
-                    exception_msg or "Authentication failed (upstream reported login required).",
+                    "Authentication failed (upstream reported login required).",
                     status_code=None,
                 )
-            raise APIError(
-                exception_msg or "Unknown API error",
-                code=code,
-            )
+            raise APIError("Unknown API error", code=code)
         return result.get("data", result)
 
     # ── API Call Methods ──────────────────────────────────────────────────
@@ -994,7 +1013,7 @@ PROFILE_FIELDS = (
 # are properties of the human at the terminal / the install, not of any
 # one account, so logger and the language commands keep reading/writing
 # them via the plain load_config()/save_config() top-level accessors.
-GLOBAL_FIELDS = ("logging", "language", "language_source")
+GLOBAL_FIELDS = ("logging", "language", "language_source", "update")
 
 
 def _empty_v2_doc() -> dict:

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/update.py

@@ -25,6 +25,8 @@ from typing import Any, Optional
 
 import requests
 
+from hap_cli.core.session import load_config
+
 logger = logging.getLogger("hap_cli.update")
 
 PYPI_PACKAGE = "hap-cli"
@@ -172,6 +174,27 @@ def save_state(state: dict) -> None:
 # ── Background check orchestration ───────────────────────────────────────
 
 
+UPDATE_MODES = ("auto", "notify", "off")
+DEFAULT_UPDATE_MODE = "auto"
+
+
+def get_update_mode() -> str:
+    """Resolve the self-update mode from config.
+
+    ``auto`` checks and upgrades, ``notify`` checks and reports without
+    upgrading, ``off`` does not check at all. Anything unrecognised — or
+    no setting — is ``auto``, the behaviour that shipped before this was
+    configurable.
+    """
+    try:
+        cfg = load_config() or {}
+    except Exception as e:
+        logger.warning("could not read the update mode from config: %s", e)
+        return DEFAULT_UPDATE_MODE
+    mode = cfg.get("update")
+    return mode if mode in UPDATE_MODES else DEFAULT_UPDATE_MODE
+
+
 def maybe_spawn_background_check() -> None:
     """Spawn a detached background update check if it is due.
 
@@ -179,6 +202,8 @@ def maybe_spawn_background_check() -> None:
     *before* spawning so rapid consecutive commands cannot stack
     duplicate children — at worst a failed child costs one interval.
     """
+    if get_update_mode() == "off":
+        return
     kind = get_install_kind()
     if kind in ("editable", "unknown"):
         return
@@ -246,6 +271,15 @@ def run_background_update() -> None:
         save_state(state)
         return
 
+    if get_update_mode() == "notify":
+        # Report it and stop — the point of this mode is that the
+        # installed version never changes underneath a running script.
+        state["last_result"] = "update_available"
+        state["notified"] = False
+        save_state(state)
+        logger.info("update to %s available (notify-only mode)", latest)
+        return
+
     ok, output = perform_upgrade(get_install_kind())
     if ok:
         state["last_result"] = "upgraded"
@@ -280,6 +314,11 @@ def consume_startup_notice() -> Optional[str]:
             f"Automatic upgrade to {latest} failed — "
             "run `hap update` to upgrade manually."
         )
+    elif result == "update_available":
+        latest = state.get("latest_version") or "a newer version"
+        msg = (
+            f"hap-cli {latest} is available — run `hap update` to install it."
+        )
     else:
         return None
 

{hap_cli-0.8.19 → hap_cli-0.8.21}/hap_cli/core/upload.py

@@ -30,12 +30,11 @@ from urllib.parse import urlparse
 
 import requests
 
-from hap_cli.core.session import Session
+from hap_cli.core.session import Session, SessionError
 logger = logging.getLogger("hap_cli.upload")
 
-# Public-SaaS qiniu upload endpoint. Self-hosted overrides this via
-# FileStoreConfig.uploadHost in Global/GetGlobalMeta.
-_PUBLIC_UPLOAD_HOST = "https://upload.qiniup.com/"
+# The upload endpoint is always read from Global/GetGlobalMeta — there is
+# deliberately no constant to fall back to, see upload_host().
 
 # bucket ids (pd-openweb kc/utils): 4=picture(mdpic), 3=document(mdoc).
 _PICTURE_EXTS = {".jpg", ".jpeg", ".png", ".gif", ".bmp", ".webp", ".svg",
@@ -67,17 +66,36 @@ def _bucket_for_ext(ext: str) -> int:
 
 
 def upload_host(session: Session) -> str:
-    """Resolve the file-store upload endpoint. Self-hosted environments
-    publish it as ``FileStoreConfig.uploadHost``; the public SaaS leaves
-    it empty and uses qiniu directly."""
-    try:
-        meta = session.get_global_meta()
-        host = (meta.get("FileStoreConfig") or {}).get("uploadHost")
+    """Resolve this environment's file-store upload endpoint.
+
+    Global/GetGlobalMeta answers ``{config: {...}, "md.global": {...}}``
+    and publishes the file store under ``md.global.FileStoreConfig`` —
+    the same object every frontend upload posts to
+    (``md.global.FileStoreConfig.uploadHost``, pd-openweb
+    src/library/plupload/createUploader.js:43 and 12 sibling call sites,
+    none of which has a fallback). We used to read ``FileStoreConfig``
+    at the top level, so it was never found on any environment and a
+    hardcoded public-qiniu constant was used instead. That constant
+    equals the public SaaS's own uploadHost, which hid the bug there and
+    broke every environment with its own file store: the bytes went to
+    public qiniu while the upload token came from the environment's
+    store, so the store answered 401 with nothing to point at.
+
+    A missing host is an error rather than a guess — guessing is what
+    turned a routing bug into an unexplainable 401.
+    """
+    meta = session.get_global_meta()
+    for scope in (meta.get("md.global"), meta):
+        if not isinstance(scope, dict):
+            continue
+        host = (scope.get("FileStoreConfig") or {}).get("uploadHost")
         if host:
             return host
-    except Exception as e:  # non-fatal: fall back to the public endpoint
-        logger.warning("uploadHost lookup via GetGlobalMeta failed: %s", e)
-    return _PUBLIC_UPLOAD_HOST
+    raise SessionError(
+        "This server did not publish a file upload address, so the file "
+        "cannot be uploaded. Check that you are signed in to the right "
+        "server, then try again."
+    )
 
 
 def get_upload_token(