jackwener/OpenCLI · error · AuthRequiredError

Xianyu item detail requires a logged-in browser session

Error message

Xianyu item detail requires a logged-in browser session

What it means

The `xianyu item` command drives a logged-in browser to www.goofish.com and calls the mtop item-detail API via page.evaluate. When the in-page script reports `error: 'auth-required'`, the library throws AuthRequiredError for domain 'www.goofish.com' — the mtop API rejected the call because the browser session has no valid logged-in cookies. The error carries a hint telling you to open Chrome/Chromium and log in to the site, and exits with the NOPERM code.

Source

Thrown at clis/xianyu/item.js:125

    site: 'xianyu',
    name: 'item',
    access: 'read',
    description: '查看闲鱼商品详情',
    domain: 'www.goofish.com',
    strategy: Strategy.COOKIE,
    navigateBefore: false,
    browser: true,
    args: [
        { name: 'item_id', required: true, positional: true, help: '闲鱼商品 item_id' },
    ],
    columns: ['item_id', 'title', 'price', 'condition', 'brand', 'location', 'seller_name', 'want_count'],
    func: async (page, kwargs) => {
        const itemId = normalizeNumericId(kwargs.item_id, 'item_id', '1040754408976');
        await page.goto(buildItemUrl(itemId));
        await page.wait(2);
        const result = await page.evaluate(buildFetchItemEvaluate(itemId));
        if (result?.error === 'auth-required') {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu item detail requires a logged-in browser session');
        }
        if (result?.error === 'blocked') {
            throw new EmptyResultError('xianyu item', 'Xianyu item detail is blocked by verification or risk control');
        }
        if (result?.error === 'mtop-not-ready') {
            throw selectorError('window.lib.mtop', '闲鱼页面未完成初始化，无法调用商品详情接口');
        }
        if (!result || typeof result !== 'object') {
            throw new EmptyResultError('xianyu item', '闲鱼商品详情接口未返回有效数据');
        }
        const errorCode = String(result.error_code || '');
        const errorMessage = String(result.error_message || '');
        if (/FAIL_SYS_SESSION_EXPIRED|SESSION_EXPIRED|FAIL_SYS/.test(errorCode) || /FAIL_SYS_SESSION_EXPIRED|SESSION_EXPIRED/.test(errorMessage)) {
            throw new AuthRequiredError('www.goofish.com', 'Xianyu item detail requires a logged-in browser session');
        }
        if (result.error) {
            throw new EmptyResultError('xianyu item', errorMessage || `Xianyu item detail request failed: ${result.error}`);
        }

View on GitHub (pinned to 49907e53dc)

Solutions

Open Chrome/Chromium with the same profile the CLI uses and log in to https://www.goofish.com manually.
Verify login persisted by re-running the command — mtop now carries valid session cookies.
In automation, complete a one-time interactive login before headless runs, and refresh the session when it expires.
Catch code 'AUTH_REQUIRED' in scripts and prompt for re-login instead of retrying.

Example fix

// before
const detail = await cli.run(['xianyu', 'item', '--item-id', '1040754408976']); // AUTH_REQUIRED in CI
// after
try {
  const detail = await cli.run(['xianyu', 'item', '--item-id', '1040754408976']);
} catch (err) {
  if (err.code === 'AUTH_REQUIRED') {
    console.error('Run: open browser, log in to https://www.goofish.com, then retry');
    process.exit(err.exitCode);
  }
  throw err;
}

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-check login state before fetching item detail:
const who = await cli.run(['xianyu', 'me']).catch(() => null);
if (!who) throw new Error('Not logged in to goofish.com — log in via browser first');

Type guard

function isAuthRequiredError(err) {
  return err && err.code === 'AUTH_REQUIRED' && err.domain === 'www.goofish.com';
}

Try / catch

try {
  const detail = await cli.run(['xianyu', 'item', '--item-id', itemId]);
} catch (err) {
  if (err.code === 'AUTH_REQUIRED') {
    console.error(err.hint); // 'open Chrome and log in to https://www.goofish.com'
    return null;
  }
  throw err;
}

Prevention

Always verify the browser profile has an active goofish.com session before automated runs.
Do a one-time interactive login before switching to headless/CI execution.
Watch for AUTH_REQUIRED as a signal to refresh cookies rather than retrying.
Keep a dedicated, persistent browser profile so cookies survive restarts.

When it happens

Trigger: Running `xianyu item --item-id <id>` when the underlying browser profile has no goofish.com login cookies, the session cookie is absent/expired, or the mtop response indicates a session-expired/auth failure (`auth-required` from the evaluate result).

Common situations: Running the CLI in headless/CI environments where no one ever logged into goofish.com; cookies cleared or rotated by the browser; Xianyu server-side invalidated the session (risk control, long idle); pointing at a fresh browser profile directory.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/6f1f1e6ce55c3d11. Report an issue: GitHub.