jackwener/OpenCLI · critical · AuthRequiredError

auth

Error message

auth

What it means

After the token cookie exists, verifyXueqiuIdentity runs an in-page whoami probe; if the probe reports kind:'auth', it throws AuthRequiredError('xueqiu.com', probe.detail). This means the cookie is present but the server still treats the session as unauthenticated — the token is invalid, expired, or not accepted by the API.

Source

Thrown at clis/xueqiu/auth.js:42

      if (!res.ok) return { kind: 'http', httpStatus: res.status };
      const d = await res.json();
      if (d?.error_code === 60201) {
        return { kind: 'auth', detail: 'xueqiu portfolio API error_code 60201 用户id无效 — anonymous' };
      }
      if (d?.error_code) {
        return { kind: 'xq-error', errorCode: d.error_code, detail: d.error_description || 'xueqiu API error' };
      }
      const uCookie = document.cookie.split('; ').find(c => c.startsWith('u='))?.split('=')[1] || '';
      const cookiesuCookie = document.cookie.split('; ').find(c => c.startsWith('cookiesu='))?.split('=')[1] || '';
      if (!uCookie || uCookie === cookiesuCookie) {
        return { kind: 'auth', detail: 'xueqiu u cookie equals cookiesu (device id) — anonymous despite portfolio API 200' };
      }
      return { ok: true, user_id: uCookie };
    } catch (e) {
      return { kind: 'exception', detail: String(e && e.message || e) };
    }
  })()`);
  if (probe?.kind === 'auth') throw new AuthRequiredError('xueqiu.com', probe.detail);
  if (probe?.kind === 'http') throw new CommandExecutionError(`HTTP ${probe.httpStatus} from xueqiu stock API: ${probe.detail || ''}`);
  if (probe?.kind === 'xq-error') throw new CommandExecutionError(`xueqiu API error_code ${probe.errorCode}: ${probe.detail}`);
  if (probe?.kind === 'exception') throw new CommandExecutionError(`xueqiu whoami failed: ${probe.detail}`);
  if (!probe?.ok) throw new CommandExecutionError(`Unexpected xueqiu probe: ${JSON.stringify(probe)}`);
  return { user_id: String(probe.user_id) };
}

registerSiteAuthCommands({
  site: 'xueqiu',
  domain: 'xueqiu.com',
  loginUrl: 'https://xueqiu.com/',
  columns: ['user_id'],
  quickCheck: hasXueqiuAccessToken,
  verify: verifyXueqiuIdentity,
  poll: async (page) => {
    if (!await hasXueqiuAccessToken(page)) {
      throw new AuthRequiredError('xueqiu.com', 'Waiting for Xueqiu xq_a_token cookie');
    }

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Re-login to xueqiu.com in the automated browser to mint fresh cookies
  2. Confirm companion cookies (e.g. xq_r_token) are also present, not just xq_a_token
  3. Avoid sharing one account across sessions that rotate the token
  4. Retry once after re-auth, then check xueqiu service status if it persists

Example fix

// before
if (probe?.kind === 'auth') throw new AuthRequiredError('xueqiu.com', probe.detail);
// after (user action)
await page.login('xueqiu.com'); // refresh expired token, then rerun verifyXueqiuIdentity
Defensive patterns

Strategy: retry

Validate before calling

const cookies = await page.getCookies({ url: 'https://xueqiu.com' });
const hasToken = cookies.some(c => c.name === 'xq_a_token' && c.value);
if (!hasToken) throw new Error('xq_a_token missing');
// token presence is not enough; validate via the whoami probe before real calls

Try / catch

try { await verifyXueqiuIdentity(page); } catch (e) { if (String(e).includes('AuthRequired') || String(e).includes('auth')) { await page.login('xueqiu.com'); return verifyXueqiuIdentity(page); } throw e; }

Prevention

When it happens

Trigger: The in-page fetch to xueqiu's whoami/stock API returns an auth-kind rejection despite xq_a_token existing: expired/rotated token, logged-out session elsewhere invalidating the token, missing companion cookies (xq_r_token), or CSRF/origin checks failing.

Common situations: Long-lived automation sessions whose token silently expired, logging in on another device that rotated the token, partial cookie sets after a cleared-domain purge, or xueqiu tightening auth requirements.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/7494aa02a18cb892. Report an issue: GitHub.